Analysis
- max time kernel
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 11:02
Behavioral task
behavioral1
Sample
2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 940KB
- Sample260629-m46a2adv7k
- SHA256 c65dce22c16fc24f4aa2b223f60d1f410356427c43df47c4bb4b7c462e4ffd56
- MD5 f5947d9692369b2fc6dadd7b90d2c555
- SHA1 595eefb809e16ff9b0e8cee35fd2f4cb7db18e72
- SHA512 49d590cd74b44e4ee6e93e729e9636ca6aa148b70ca3d336ead28d87f848485459c6d7e3bd25cf438c67011eb72251d88be87272d9c41ee788ef1fbb0868f4bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wC:A3k03kHRJh
- TLSH T10E25AF13EB9504E9D10AC1749AD58A23EB75BC56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 34 IoCs
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c630-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d5-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4356-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3140-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b6-200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b7-207.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ba-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bb-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bd-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198be-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b8-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-473.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-487.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019957-554.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019958-585.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019959-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995a-613.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019964-614.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019965-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996b-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019970-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019971-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019976-649.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997e-662.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b42-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019fd7-804.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019fd5-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a4fc-1006.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a17d-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000019dd9-1233.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000188f1-1485.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c630-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d5-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198b6-200.dat aspack_v212_v242 behavioral2/files/0x00030000000198b7-207.dat aspack_v212_v242 behavioral2/files/0x00030000000198ba-226.dat aspack_v212_v242 behavioral2/files/0x00030000000198bb-245.dat aspack_v212_v242 behavioral2/files/0x00030000000198bd-258.dat aspack_v212_v242 behavioral2/files/0x00030000000198be-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198b8-266.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-473.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-480.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-487.dat aspack_v212_v242 behavioral2/files/0x0003000000019957-554.dat aspack_v212_v242 behavioral2/files/0x0003000000019958-585.dat aspack_v212_v242 behavioral2/files/0x0003000000019959-599.dat aspack_v212_v242 behavioral2/files/0x000300000001995a-613.dat aspack_v212_v242 behavioral2/files/0x0003000000019964-614.dat aspack_v212_v242 behavioral2/files/0x0003000000019965-621.dat aspack_v212_v242 behavioral2/files/0x000300000001996b-634.dat aspack_v212_v242 behavioral2/files/0x0003000000019970-641.dat aspack_v212_v242 behavioral2/files/0x0003000000019971-642.dat aspack_v212_v242 behavioral2/files/0x0003000000019976-649.dat aspack_v212_v242 behavioral2/files/0x000300000001997e-662.dat aspack_v212_v242 behavioral2/files/0x0003000000019b42-735.dat aspack_v212_v242 behavioral2/files/0x0003000000019fd7-804.dat aspack_v212_v242 behavioral2/files/0x0003000000019fd5-811.dat aspack_v212_v242 behavioral2/files/0x000300000001a4fc-1006.dat aspack_v212_v242 behavioral2/files/0x000400000001a17d-1178.dat aspack_v212_v242 behavioral2/files/0x0009000000019dd9-1233.dat aspack_v212_v242 behavioral2/files/0x00080000000188f1-1485.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3140 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4356 2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3140 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_f5947d9692369b2fc6dadd7b90d2c555_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4356
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 940KB
- SHA256 c65dce22c16fc24f4aa2b223f60d1f410356427c43df47c4bb4b7c462e4ffd56
- MD5 f5947d9692369b2fc6dadd7b90d2c555
- SHA1 595eefb809e16ff9b0e8cee35fd2f4cb7db18e72
- SHA512 49d590cd74b44e4ee6e93e729e9636ca6aa148b70ca3d336ead28d87f848485459c6d7e3bd25cf438c67011eb72251d88be87272d9c41ee788ef1fbb0868f4bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wC:A3k03kHRJh
- TLSH T10E25AF13EB9504E9D10AC1749AD58A23EB75BC56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 969KB
- SHA256 4fa2c5a039b2f1d4384dc7927a11980860ee218a4b1a30dc235629694a3cf001
- MD5 a863b02e6a4b458733884d7458288e06
- SHA1 5792cb16ef29c9dd9e41068cf56c6638fe4bc5f5
- SHA512 e6dfbd4d6d6a9d7dbb1382af36cc1b0e5fd68c0519f4382b1ab4ec9a2707b42c99b07afe1636e98bd39afdbed1325cb7a8d94ae5a53e32c84b8062efc89a9fcf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wUP:A3k03kHRJv
- TLSH T1F525AF13EB9504E5D10AC174AAE59A23EB75BC56176093DF2358C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 4319ac33959b5429d140a50f8a65039405b5e59d92b3ec27b4026beec4c8a1c8
- MD5 0118b4b2af5c467d53e5cc45168ce2b1
- SHA1 f379cda26ebcc5450e512dd876b63c892f8286fb
- SHA512 f96ba9bcba2d7ee2625990c5759d33108762111b87d6f975ddedfe4142d6c34373002e5fa52c9ca66a77a9ddb433b4d5ef1463155b6761224e55f7950cd9c59f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wC0Le5ji0hmxNrM:A3k03kHRJ9Pji0Aj
- TLSH T1C0658D17F6A402B5D027C1B9C9D69A5AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 34dc4f7bf8bbf4e3a4af4c1bd8647be6630c226ad05c658aefbf2f106255adf6
- MD5 b5361a33a688f44dac7f8e55ba8c2be5
- SHA1 6bfcba3f0c988b65903b7a75e28d39e65cbab51e
- SHA512 da4eaca5a5ecaeb63d2e0f4df7230456cc53308d6d7e3d71a16786bc0d933674b233a4785ea928a3a495c4ba1bdb6fb6071fb1f6dd1359b2818aa5ac95657b03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wMa:A3k03kHRJ
- TLSH T12D25AF13EB9500E9E10AC1749AE54A23EB757C56176097DF2368C6152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 963KB
- SHA256 6b4507ce4487edb5a69bfa8670ccbca7123cc0eab0a14b4e2ebd8ac6ab96da7f
- MD5 59a3f3775b8a4cf54bd58e1e90200368
- SHA1 b4828ee790252ee3ed64ce09f35b1d81d51fd456
- SHA512 51bdd5f07818d7ae7ef96846b5a5f2d3fe4eb21c7ace138c7f339567a910b6f27372a6fb46bbac88e7b30252265f982ff60c7e5027f3677a10fc791c39269f27
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wGZ:A3k03kHRJx
- TLSH T1F325AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 963KB
- SHA256 09f5907fd31b0d2c67c5cb39ba94ffdb9ea7a05aa54f4fb7744ee690c4458f31
- MD5 da86932ee0e659ad619a9cb8e6ad8740
- SHA1 56674180e33e3119c11c97245e93aeaab1bf650a
- SHA512 c86685128131f2d783b72a4eab0dca840d436e8a45bbcb64fcc504f52ba2a281d09e7a39cceaa6c719a0b01391f03db0f33b07a3b8173cca887899d5d731a421
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wx1:A3k03kHRJ+
- TLSH T1E325AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 963KB
- SHA256 26b16ad42ea943a4a265ebbc98932a22c815641b0c5a42bb1661c75c9c86bf92
- MD5 54f9aedab523c661745b91e00dea447e
- SHA1 52edeaec38bafa8b8a61138ba7b68f515a226580
- SHA512 ae9378d1a6803a99cb95d6f54688a48fffbc32324402c3793abe087f2c3b3424859438e778493fd67e6d56a4c411d8c86eeed918549d938abb5a41e8f03b92e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wl6:A3k03kHRJZ
- TLSH T1CB25AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 963KB
- SHA256 6f3f44b2d8e6b76f22ad84ef854680d25f30450752be2cfadf32b8d7b0454be1
- MD5 a5ae0f63e1a33fb8a89536875db37906
- SHA1 419f3d26e15bd085f8f51a68dd7d80b193db8d31
- SHA512 613bfd48adf07f8c5ca771d83c1375c712ee14bac8ea53931d72ff94de91f99191051f7977ba58478785787f353529b58be8e68bdc39786a234ccce91ccc9e17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1w7N:A3k03kHRJA
- TLSH T1B425AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 963KB
- SHA256 e6be469d41672c767b24d060a87845d9518d361a1ecc435be5de6b6ce61937c7
- MD5 ff0fadb2b14f83d97fc31f3096ec0701
- SHA1 decb630da8ee534acfb58f7e9dc4dbca90c8f86a
- SHA512 0115fd55be3226bc474eed59d845966b2342ff16438d50b845b0e66366dca42a5a6be2510d39a353ec8da01cda5f0d5f91b882926bc0a729834f749858f4fb04
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wZf:A3k03kHRJY
- TLSH T1F525AF13EB9504E9D10AC174AAD54A23EB75BD56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 963KB
- SHA256 79faa674036f5cc39db1dd32bcba26d310fdc4e9607ba98b8c42532cb33acacb
- MD5 712c247931f695df6b8d8f02e6fc95d6
- SHA1 8514323a1b0db15864e00ed6dfd31258ba0eb884
- SHA512 b43bfae4e760feb3d644d9aef3d941b1424a1890b70537f97094b340b8e41730721ba621e511a6e16ec815ed939a720c569dabde24d01d57b9aabb7d59a2e37d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wbo:A3k03kHRJF
- TLSH T14725AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 963KB
- SHA256 4e0abeb20d8ca58dc36f3c747c13e848749d7e5ca9b21f521d571c836f3dfecf
- MD5 8655edbb80cb3b11cca3e2a18727977b
- SHA1 f8e00a3fcc00241c249745fcc98b4b382b4744c4
- SHA512 e7848a838d99e726a57548e43f17c787c75d3759d22973198926ef32086a78240c2d1f22ac75327bdcdf6a37207961ee20cfea9ef5bbd7ce939fe70dce63cde0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wPu:A3k03kHRJn
- TLSH T1FD25AF13EB9504E9E10AC174AAD54A23EB75BD56176093DF2358C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 7d38613d3633f4e0ce026be99dfc7c948d7ff61f77c38fcd0abfe80dd4405323
- MD5 c92ea59a883479a709053617409719f4
- SHA1 9e5ba402f96cd55d111933f12244ac286e27deaa
- SHA512 4d03bdc69f4fb1a13f2c1f5cff268a35c3443fb3f83243ad971954458649d96ba9f4d830b9abd311a88d6b3b5f614228f2edc4b4b67ad5c33b064ad97ad51e61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1w7L:A3k03kHRJm
- TLSH T19925AF13EB9504E9D10AC174AAD54A23EB75BD56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 fabb0a7b591ec90ec98140a9da87802cb0d20f19dfb183a095aef6e5d7680261
- MD5 180f9ee8cb966df0bb6673c47f8e3999
- SHA1 1a3f33853db7f41506d6298f5b5f8cf7ba6d83c7
- SHA512 773c238d8b31b092508aad12fdbb510d8a3f0657f418a30fc10e1e3333171cd6acdb126f5b5d7e48fc39492e6440681663fdd25a508512bbded68ee111721485
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wBM:A3k03kHRJD
- TLSH T11825AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 eaa9c7cc7a2dcca11b9c29875a5b1f9bdb64d61fd8c42d809cb519651bd66d13
- MD5 9ec5cdef2fa957c3b2e4c811a446d592
- SHA1 99661d6a77c74c069b765c03a5f667bbdc16c3eb
- SHA512 b5ea0ef81df47399616af2151fbc2024bb4c922c8cedef533dc3f51a922b4913b5faa7b990cbbf940ed388a49005b38f1ee62cf1ca8ea68902a3ecd43cfd4f36
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wqh:A3k03kHRJ9
- TLSH T1FD25AF13EB9504E9D10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 963KB
- SHA256 16d481fe05cb2ca5f5ab849fb7af8d2354dcd27ab875539d678eb16a7adc7d9a
- MD5 d4da27ec1710bb00b8ff9f8c561681df
- SHA1 4b898161c3106977d4cc19e7cc8ac937f550a284
- SHA512 9c4483c89164c246fe40936c8b38fee5836dbfbee8d4dc966187ee26f38b13ed75d6685d9b1549b43d2146d719bd0603e4e43e9461174e66a9678288371343b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1w0D:A3k03kHRJt
- TLSH T13425AF13EB9504E9D10AC174AAD54A23EB75BD56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 963KB
- SHA256 a5ffeede0535c74e77a5d658a60e1f263e1f151d77463369bc9ea825325b382c
- MD5 062be167dcce0c982c423c801aaefc6e
- SHA1 19333b73b9d5f9f64be24b129b6fd63decb92148
- SHA512 6782bfaff37f16f8e2a2d271897780c959798df72f2c4803fdec26746676e9332a04027562a07afdf87d503f4b6edc46f945da68d441284f6d160d7c3e1e04b1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wQd:A3k03kHRJ/
- TLSH T1BB25AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 963KB
- SHA256 03e2957395fd496e140ed0fd82874e9db88de4698de6d320a9bd9aa08d35d488
- MD5 ecf71345fdde220f98feb540797bd8c2
- SHA1 bf4daabd92bfc56840f65f7bfd72d8d883bae5a2
- SHA512 6e0dddd200f03459952a52be643a795f46be93b96c37429b34e54b1958436bda56c18a3531c5d5107e9d5bc64a2f5e956d1c13d3f581e4c2a3e093a8ecd8ad28
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wEM:A3k03kHRJe
- TLSH T17725AF13EB9504E9D10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 963KB
- SHA256 89ff198eb005e7d7eea58f87affba1966ad8ef9d72d64ebae486e5c95f7f86b6
- MD5 b1c36adbbab8807eb0876ff1ae507c73
- SHA1 eff48b0faac7111045ac315268732556b28e06c8
- SHA512 fdf226e437268a49d48a78b61e86945eb6fa8803d93fbf6a2998df578952cd5cf3fbf9b99df6e3624db5483135300f015acb2664e3b951412a2540b1470ef060
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wxW:A3k03kHRJx
- TLSH T1D725AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 963KB
- SHA256 9240caee9d455591a2fab62250373865eb2823778f4197abd288aa0aefc4b785
- MD5 a0c02eaa5954371b22ff0e1d20936017
- SHA1 25e4949ada211e4ac0c4575087a88634748cbe4e
- SHA512 ff620648098f35352e99747b57e54cd2f4d458f7170839d64ce2ec5271aa4cde1e01e6ff4f1316c8654b7b19e04df298f325af2e9ba05cdfe7ee86ac8f8d0e0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wI93:A3k03kHRJ/
- TLSH T16A25AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 963KB
- SHA256 a6ccb977538a77136d60fc7329db81568c77ada69508f9befe3333e9328c9e9b
- MD5 52b35bc2cc3138a50110188a1f3b5a75
- SHA1 d9c1a6080cb00995a1f07a246a961a3662c35ea9
- SHA512 7f992e955682e20659927031126b3d5884c4d1b89048a60b61e7bff61b59b58fe028d82fbd1b333710fa7711a2d2ea0b27f4aaf0fe912f870ec3a42c6f09c84c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1we/:A3k03kHRJb
- TLSH T1C925AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 963KB
- SHA256 67fc45ecd5aea91115e275b2b0aeb22e881ea381e7b42af5accb1c7661d66e66
- MD5 afd28dbe463a961952943dadba0b98ca
- SHA1 ed4cb7ca61b3b97f85fc5a124465440d7c575e91
- SHA512 d3513b01fca06ea711b6ee805700ffc6faa491ab47818fb1bdd546c05f8db11a0a4bab5cb4aa3884d83cfb4525b6f6e9ccafe549ed35feb3bd123fdb3d1219f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1w+a:A3k03kHRJs
- TLSH T10325AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 963KB
- SHA256 3f7a3a8c70fe38ab0034ea0a782f2e176ef31a22bebd68148f06fff2d2be308b
- MD5 c0fa1f49a1d4ae436f4e1d98018894f5
- SHA1 2ef2618d9d56a3a08e297855a4d12b2e050590d0
- SHA512 df9da85a85b9aa6d43ea49c8051e2050254ddd4df869ef321ff28e1f41afceffeaa40d8bcab01861a5769eb7b6f6ce41563da3a57f637d2cbcb984ed32a48a36
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wKj:A3k03kHRJt
- TLSH T1BA25AF13EB9504E9E10AC174AAD54A23EB75BD56176093DF2358C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 963KB
- SHA256 57d11fdd0e44521c1d770c882863be66bf2f8fcbe3d191ddfe7f75697dcef6d8
- MD5 3a8a9a2a2bb8f96e3abd3ee679148deb
- SHA1 2677a606390670ab748298a959980d63b71d47c6
- SHA512 1d94ada52aa40211a7afa1869d5e4a415bde34feef967f23916b535a4f74c2d5fff5f5b34aecb3b8634c70b678f219ea95c34c5bd0069c330e9f46dcd2afa323
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wDQ:A3k03kHRJl
- TLSH T1F325AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 963KB
- SHA256 4a747a57fe9abec89788e236cd9cb963a23b41ab6347ae292066d20e5c078f18
- MD5 480d52090deada5d4067f016a54c9e25
- SHA1 d184050bcb3e57b9a2c18e2985820be73fb66c1c
- SHA512 e120abeaa558dc6225c8c3521acb44daeb2a8e74a4f8067b23a8cb9679a87d53390cf77f6e17750135ca13f60ddb3d0ddafe1ca66ee77f441fbb56f5fb47fd37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1w6i:A3k03kHRJM
- TLSH T1DE25AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 963KB
- SHA256 577d50983dc785913484ae546033722564d0f9cb9a46aa6080bcd7b7d313e5a1
- MD5 59a470100ea5b9c7ea389ac947a6cef8
- SHA1 bcc9ed684ac2c243095f19031649e47fdefb843f
- SHA512 92b735a7268fa1afe26143f65fe370f1c74af92875d88067daa8d2a32df52a3a4f073483edaea132b8a1bddfaa9b823fc53c7eea1c086916d6356c714d910e4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wQ9:A3k03kHRJ7
- TLSH T18C25AF13EB9504E9E10AC174AAD54A23EB75BD56176093DF2358C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 fa4c64ff2afba6f04a40b4e9721b88a4bcc1bc2c0534e6d079a87a63cc6e4513
- MD5 306e532cbd7343a81fe76e66bf5aacb3
- SHA1 a758b5d94b5b1b5ea0ed800a924f42df0d2dc976
- SHA512 4bd307b1cfaf96146032fdb87946f4b5479b59413eec1a0d87e6369fe6fb456969acebb1a828b794a1c7cb8dee2630c68f63af374671491ee8c0c0a3d3992504
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wOv:A3k03kHRJz
- TLSH T1E225AF13EB9504E9E10AC174AAD54A23EB757D56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
- Size 961KB
- SHA256 3161584f7cf157ab70491863be381747ff0925b91aa0e432ec8b33d0dfe9bf9e
- MD5 9ec4b50022bd7b535b3db241af50408a
- SHA1 5ec1ec6d8dc192eb4d26ff64ae71fdac74509ab8
- SHA512 07a0c9490337c1b95f1f2a860f504407135da41e9e977e90abd67fcb2aac19609653f38a8602e2282cbcc78124ab21b4a8c023b35c662ce3b2735cb23ff7ac52
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1w3:A3k03kHRJ
- TLSH T13125AF13EB9500E9D10AC1749AE58A23EB75BD56176097DF2358C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
- Size 961KB
- SHA256 61404d08e289590988bbe7559c47d591cde80d610d9fdac5320d98ce0c088a5e
- MD5 21791de84754640c8bf9c245a766ee86
- SHA1 abe17c0fc11f6fbde52d6d7969e6006f52aa337b
- SHA512 1bb1e132cd31f26913047f1e49bf07858f55732850f0590af6edebc7fc7455d439663d9f79a95a2446b529173c9c2e42022b94e2dfc29222a116b11721a1cc44
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wrj:A3k03kHRJG
- TLSH T1D725AE13EB9500E9D10AC1749AE58A23EB75BD56176097DF2358C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 973KB
- SHA256 3902fb253f7663ee1a0cc8b765ab6de8e8e887e5464282cdf1f997938622de30
- MD5 b79162fc85e9b91821dc19228dc16d86
- SHA1 2541f9010457762dd34cce6cc9617720a76cdaf6
- SHA512 fd83366449b893ef8e4074a1d029975881539d77977661f6bff88c6a4507036d2f94265c42da31c9c749bc7c01142fa26185dcc0d4d17024f5821dc264bd93e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wv1:A3k03kHRJ41
- TLSH T17525AE13EB9500E5D10AC1749AE59A23EB75BD56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
- Size 1019KB
- SHA256 beab97fd6590ad1c46fe1b5a9bf2028e1b0be282efc5703e278cdc49d4e360ae
- MD5 b548453aad18b430712034c9ad27a716
- SHA1 65c687ab4e392e0b30f87976270ea45cf7b78b62
- SHA512 df03fe995b008bb4196a50f783221d5e8c7bde1bc10ad21340c01b0c389e499a94a37784fe6cdc0683dcee23aedcc0b28b088ee3a6c3af667bce7b06e7e6e191
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1wgF:A3k03kHRJn
- TLSH T18225AE03E6D500E5D64A8130DEDA8A22FA35BD92176097EF2368F7152F727C07B397A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$
- Size 1.4MB
- SHA256 4f0f76d178d9d9644c4aceca8066bafdd7387ac76dd5330ca39cc7675594e7e7
- MD5 cb566e0aa26df59c3863480a0fe2cf03
- SHA1 9790d104ca6faf36ddb41d1a03411deced500478
- SHA512 0bcdabc92d7fd79aeb9dcee2e09c86d17e738568bb362a85c5b0a28740c87bac5c3a8d55b28a08ae48df5bc10839c274334d13bd6c3a77c149d2c94deaaa979c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1w4i6:A3k03kHRJni6
- TLSH T1CC654A83AB469CB5F14C88349591823D96777E2D07E386CB635E7E0A5F3578C2AF8318
- MD5 SHA1 SHA512 SSDEEP TLSH