Analysis
- max time kernel
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 12:00
Behavioral task
behavioral1
Sample
2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 937KB
- Sample260629-n6c8pscv4t
- SHA256 0b880d673f625aee357ca2ce0fd4bbc92594876a53f1c13d6c7300729a5ca905
- MD5 d4ebd992ad0def15f82b12e939b4bdbc
- SHA1 4057fb9863b23fe0f6ee04e3b47cec06a92ca93d
- SHA512 4120542a56f5f48d2548c7e869a8d962e02236728c0286648e930cb5d67e3c15c1c9b39488911e7e3695996ce7dad29f1e071e86b0a4c6ca20c8c41a64e54671
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqa:A3k03kHRJARJ
- TLSH T17D159D03F79800E8D15AC1789AA69A23FB767C520730A7DF135496162F72BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/5728-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c6c0-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2ed-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5976-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5728-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-207.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019950-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019961-516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996b-535.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996c-578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996d-597.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996e-598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019978-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019979-613.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997f-627.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019984-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019985-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998a-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019992-643.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019adb-668.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019aec-711.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b34-724.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b38-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b15-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b6a-752.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b41-760.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b75-767.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b12-768.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b53-769.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b56-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a081-1021.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ac70-1284.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c6c0-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c3-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2ed-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-200.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-207.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-220.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-245.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-258.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-266.dat aspack_v212_v242 behavioral2/files/0x0003000000019950-497.dat aspack_v212_v242 behavioral2/files/0x0003000000019961-516.dat aspack_v212_v242 behavioral2/files/0x000300000001996b-535.dat aspack_v212_v242 behavioral2/files/0x000300000001996c-578.dat aspack_v212_v242 behavioral2/files/0x000300000001996d-597.dat aspack_v212_v242 behavioral2/files/0x000300000001996e-598.dat aspack_v212_v242 behavioral2/files/0x0003000000019978-611.dat aspack_v212_v242 behavioral2/files/0x0003000000019979-613.dat aspack_v212_v242 behavioral2/files/0x000300000001997f-627.dat aspack_v212_v242 behavioral2/files/0x0003000000019984-634.dat aspack_v212_v242 behavioral2/files/0x0003000000019985-641.dat aspack_v212_v242 behavioral2/files/0x000300000001998a-642.dat aspack_v212_v242 behavioral2/files/0x0003000000019992-643.dat aspack_v212_v242 behavioral2/files/0x0003000000019adb-668.dat aspack_v212_v242 behavioral2/files/0x0003000000019aec-711.dat aspack_v212_v242 behavioral2/files/0x0003000000019b34-724.dat aspack_v212_v242 behavioral2/files/0x0003000000019b38-737.dat aspack_v212_v242 behavioral2/files/0x0003000000019b15-744.dat aspack_v212_v242 behavioral2/files/0x0003000000019b6a-752.dat aspack_v212_v242 behavioral2/files/0x0003000000019b41-760.dat aspack_v212_v242 behavioral2/files/0x0003000000019b75-767.dat aspack_v212_v242 behavioral2/files/0x0003000000019b12-768.dat aspack_v212_v242 behavioral2/files/0x0003000000019b53-769.dat aspack_v212_v242 behavioral2/files/0x0003000000019b56-800.dat aspack_v212_v242 behavioral2/files/0x000300000001a081-1021.dat aspack_v212_v242 behavioral2/files/0x000400000001ac70-1284.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5976 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5728 2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5976 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_d4ebd992ad0def15f82b12e939b4bdbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5728
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 937KB
- SHA256 0b880d673f625aee357ca2ce0fd4bbc92594876a53f1c13d6c7300729a5ca905
- MD5 d4ebd992ad0def15f82b12e939b4bdbc
- SHA1 4057fb9863b23fe0f6ee04e3b47cec06a92ca93d
- SHA512 4120542a56f5f48d2548c7e869a8d962e02236728c0286648e930cb5d67e3c15c1c9b39488911e7e3695996ce7dad29f1e071e86b0a4c6ca20c8c41a64e54671
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqa:A3k03kHRJARJ
- TLSH T17D159D03F79800E8D15AC1789AA69A23FB767C520730A7DF135496162F72BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 b94432b8a55668d5246d3131534df8f35e9aee7de4b132ce06d3857c52a4f2fd
- MD5 4574cdb15a1139f07156cb1991d1539f
- SHA1 8bb77c2dcc80722ea8be2751b555ab775c1c2c4a
- SHA512 ce5ba5ff4ffcf955f490052b62442756fbf5291f9de5d1b0c15214e5f89230f0f68a715ae07f65ce69da1d62b21855237b947cc810cdd2610d1ddcd8e5053490
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaP0Le5ji0hmxNrM:A3k03kHRJARJDPji0Aj
- TLSH T1C6657C17F6A802B5D067C179C5D29A5AFA72384207309BCF1394C7292F67BE19F3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 951KB
- SHA256 a1068edc77bcbece3e463017d8280cc61a8e5a2d24f8370c87056018c7d43163
- MD5 8a867f38f71475d7cc10d9ddd048d988
- SHA1 e51bd97082d5e7ddfd6a6748a60b1cbfb996e327
- SHA512 655fcbeb550c89ef2de04c100fd101fe30d30228de297f0cda9e7de029814f33ace09c4568c78fafc970391c57d673c49961f25ffb9e37a63b6246a80bbfcfb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaRa:A3k03kHRJARJ
- TLSH T1B3259D03E79800E8D25AC1789AA69A23FB767C520730A7DF1354D6162F72BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 960KB
- SHA256 a77cd6c9c3f9a6d5d8e98e27c8e5cd737a4bb23d80f53c91827e80b7ff107562
- MD5 d6ba91e77b8597d78636b14b326baf74
- SHA1 37a13d7cfbb7aa1c2382f3fb63c317d3430f2170
- SHA512 2cdcfc632e8eced8b0e7bf65403e010adf32835668e4d0af10be65b1f48697d66ac245ed5319405b2ac5a66ab6764ab4e23577ceff8f1ce4268040dabd0e6078
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqapZ:A3k03kHRJARJX
- TLSH T14D259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 960KB
- SHA256 5b3026e2828e5bb7d3af7865b0eab24f85f46f4b7ea8f0845b5d69f6c77284cd
- MD5 d048e6fdbf0bb3abea58557f7ef3e8b8
- SHA1 e1a2f1db749279971c91f67072e5567b4eaedf90
- SHA512 a41f2ac8691d569f41b08790952f463c512b2a0699dcef09a3fa5763a905bc505641097fd19855bc46bc785116c2b597b872f6a60f0060c4256411f97b4e73f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaC1:A3k03kHRJARJQ
- TLSH T13E259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 960KB
- SHA256 58938efa399cb355a303b311e79d5485b13fdbe52f7590bb2e9973e6a0b12f2c
- MD5 9ecad6d665b5dfc4d9068c36f2ef68d4
- SHA1 190ab0175ea2f321503b0438a40faf13d79745e8
- SHA512 f202bf4bb9bfc52600a652476cc67edad891dd4950f978765651a6116796f85580f552dd328b26e03bee6ccba804626d8d5e0340b6a0c53e81067a7ad577c1c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqao6:A3k03kHRJARJr
- TLSH T11E259D03E79800E8D25AC1789AA69A23FB757C52073097DF1364D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 960KB
- SHA256 d828a6925e26c3a5ad7ae28a0516fd039dfc4ed6ad291b161529187e53f5dac6
- MD5 5d68294c3e5f9940fcc61ccf32d60047
- SHA1 592a835fa9583b37b4547a70c2876a984acf4d78
- SHA512 c2f1ebd566d8cda5a6e802499f340417e9eb004fff06b188adec742fef4267e6ba582002963d9c150f7ed362e8c3edc903cfc7b0005417dc3fb4270f492beb2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqasN:A3k03kHRJARJW
- TLSH T123259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 960KB
- SHA256 cd0587ccf5a7e9adea2367e2adb2822e57adf777c7eaa18fbd80a377643a6725
- MD5 3a600d1170183f3e85acd20f837e3eb9
- SHA1 a0c814382b263c90ea10d0cdda773c6dc5e4942e
- SHA512 8c86a607e2d4497bd804a0b44cf7a39ad335738bbfa53e2796fc7d7a07482e95223f620a85898337b849290e3ba49c2c7431adf1297e9f087adc835ec77173e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaif:A3k03kHRJARJq
- TLSH T103259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 960KB
- SHA256 ab40c2d5d6851b8e2de8030435ea2f80e7e39531c965dfa059cb651dad14d275
- MD5 1d0738c679188c7865adaf2770f86a6d
- SHA1 cbfc598c0ef5e45205800eb60d59edf69c1e6afb
- SHA512 3a3f522cb782f7bfaf70aac2dc8c799bd58099a69f8002655c395e6788ebe2a5d07762e2b4c65b7a52b4f65114c4a0beaa50743705668f1178eaa7a0d7b65c48
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqa8o:A3k03kHRJARJz
- TLSH T115259D03E79800E8D25AC1789AA69A23FB757C560730A7DF1354D6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 960KB
- SHA256 cbac773997bb5893c9c35c486a6ac2f796fe0c213c13b01e0e175779a6c1b537
- MD5 e87a198300f67fa9678da0ada268ee87
- SHA1 83aa0aee71458b0fadb19db4b3b3c9ad4ad92c4f
- SHA512 d696fed40a12d6390b194a9cb0d834ba848a62c8aa7832542d59eef9f98e0470e515580ed3348c984bca4e30b3694f670b076b733ca6ca5a34443513c99c23b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqacu:A3k03kHRJARJl
- TLSH T1F1259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 960KB
- SHA256 19b4a399dffcf3bae0fadb4c8b76d917ab5cd7c0b16aa0cc0f243bcb2e3319e1
- MD5 e16b95f7f291a7009541de393b07ec46
- SHA1 19a6c3d58ae58490eb273394475c066632747cf4
- SHA512 72364eb3996c21d4d0d47817fd0535f1397426113db6fa3515128242a56773b539e9541f4f8cbc101bc4d8cc2892a5cced92e6afa8e69c59ecf8cc6b0bfed905
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqagF:A3k03kHRJARJk
- TLSH T143259D03E79800E8D25AC1789AA69A23FB757C52073097DF1364D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 960KB
- SHA256 24acb4b35a25515102a13c00e1fa219caefc0a5d89d405e4207c70f1b1eeba09
- MD5 72dc864b8a49e9c7c06d7cc94cbdf8e2
- SHA1 627cac79afab2d106693af2659599227193e647f
- SHA512 c9a13f5acc00c1031d3a985bf48c3526565865a94c54035971ebe3d838ffa41e613c6d008e8a10b0e57390e3d1d741006d8d2cf497550ff9f27a8fab6a788921
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqa5j:A3k03kHRJARJd
- TLSH T1B8259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 960KB
- SHA256 2a8c1a2fd81671ff60408a6e902b3a6d2080d04a14b8445a9868eef32f4e8b09
- MD5 5d1a03f6210afce40d02c8435474a5ab
- SHA1 fd503bb121ac1e2f58616e107493628fbd859e01
- SHA512 6bc4778a50d52401c82b409f50190f5d4f546849c6aebfe461ba42e0526ba378283b821c0a224ec77b038fca4e736e720a290569c2fd7258559d9a3586dd835c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqavD:A3k03kHRJARJv
- TLSH T144259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 960KB
- SHA256 a94be9d9020b65fb335977068de525243f4a8c9a6ebf21a19c78afa211a709b1
- MD5 b01ecd4b558fbd11bfa504fc55fed44d
- SHA1 29e68b32c4b7dede996a8f9ff73297218655517a
- SHA512 1283981746d08849d8bb2d2411ba417560ea3510c8fc29dc70b617eb6fb2027f6cd6637e3ee056b2a8d2ae4559aaabac3520494727682e03f3c5a9fd83618c29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqa3d:A3k03kHRJARJ5
- TLSH T166259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 960KB
- SHA256 2ab63374af28e4329851a1243f9d86238ec47f8c218448ce29d3d590a6c29c4b
- MD5 42495e42dd8924904dc5410631e97cba
- SHA1 e97e65568d2a31aa86984a63c97533f0d40802b2
- SHA512 f7683a4072ce4cb26f135fa5ac0c0d1ebc52fbba0f2cf4104651b0e9201a544b533cfa0134d309a046865d88b88a0f67d98ea0dc4d039776532ebc8fd8d3c402
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaXM:A3k03kHRJARJw
- TLSH T1E6259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 960KB
- SHA256 34d2e2b90fd4ab1340a1dc66454094c363822a00b92def7b3b1da3af6f0ea724
- MD5 62cdfbf4d0ae3193d8907cec810acd1e
- SHA1 790709b930f13d3d44b81e203b4c32699cbbf21b
- SHA512 f18a68d3fbfd9b57aa60ced908541fd54729ddee37834cc1e87b73ec4385426b9797003488d156a829320d190e3916b34424cffb5177262c769fe45fa891236f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaEW:A3k03kHRJARJb
- TLSH T101259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 960KB
- SHA256 e2ca0984175998d6f5ab119f7efb17bd989653e3fbc971b5ac0f87164fdaf68f
- MD5 aebebbc568588013a9b89e3fea02e07d
- SHA1 e489d285cfceec082e7a48a882a8077c6a398b14
- SHA512 aeeb03ba2369a2344101b5ab5e388690735c1386351f5af6123e9fd0dd85844cb3bbab14af740c3ce1fd55035911553604d58e3eccfe6855674e08efd0ba062b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaL93:A3k03kHRJARJp
- TLSH T100259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 960KB
- SHA256 c712772a9c95340d37532beb7da11d215e6640a1328016f1f2dd50e155316ab0
- MD5 3b268f59b62cb64b63458342980511a5
- SHA1 19339c790cdbeebb264479bccaa09535d7474282
- SHA512 5100b280733702be7e057701eed13afce91d01a1584762ec13c3e3dab18e5f10ecc4810a1da466441bb11bc59ad21abe29f30599f4f031904264f031946b5c75
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaZ/:A3k03kHRJARJp
- TLSH T19B259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 960KB
- SHA256 0b3d5dae597a6c682d742ac02e420b19cae1cf72aaa2965d7e2983d09a8f1370
- MD5 6a92bb1f00867a8ff5a45d7c13e80346
- SHA1 2ecd7db143330b7464aa7b4ffea96ce2bd780262
- SHA512 3ca9d062042c7bf2dfb9d8f26f2f99845000d516aea2ca21803e06c1bf438d5472f663a34e78acafef734aba74904472badf97146c10566ec893e65d53336fdd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqafa:A3k03kHRJARJm
- TLSH T187259D03E79800E8D25AC1789AA69A23FB757C52073097DF1364D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 960KB
- SHA256 03d3c758e4f7cddbd6d970234c0323a54cbb6cae4bf74e7ffd618dea349eef9b
- MD5 ae737950deeab84d8248399c5212f3bb
- SHA1 8d4345ed9c7f6664be0abaac28e5e4ddb48e8600
- SHA512 1dd55843d8d9b3d2389c70c602a05be85971ca187c8aa32ed878cd4574e12cd64ad5bea9c1ff90718575ef9ee8bf6adfa866caf0a36834744efbf1fa41739d89
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqazj:A3k03kHRJARJz
- TLSH T17B259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 960KB
- SHA256 ab0900cf57a3f782ca8cf52dd7040e055669508a53b644319c0bf39a527fcebd
- MD5 49180723d4c6eb9e3660004e714b1b34
- SHA1 e7e30272415ec20e042057aeccbf24829a8dcce5
- SHA512 cdee8799ee3980b35adfc318ac2d5752bd40161298070f3a931a35570b2b4bcd47c4bfca31835732aba443ab46fd91e2c8bd5f308d9abb6997a9d394bd7672d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaEQ:A3k03kHRJARJz
- TLSH T137259D03E79800E8D25AC1789AA69A23FB757C52073097DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 960KB
- SHA256 6f2224807ddddfdf7bb17873429a15be2e7996e5ebc39e0d8867be9a82f1fdeb
- MD5 ee75ebb0022b0aef5c0042cf47e0aab0
- SHA1 8b49b230e41ee4be140797cd3050cdb7ca4389d5
- SHA512 116f76968e13ec9fa6f4a616a6a0d0f4923b4fc73ac15ed119ef938126f6529ea2d9fed45d570cf31c854166b65bec6c7d4ce6278ebe943b0fb76bc5dcbeaf61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaLi:A3k03kHRJARJy
- TLSH T159259D03E79800E8D25AC1789AA69A23FB757C52073097DF1364D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 960KB
- SHA256 d29d8c4793a4e987e59f717a9b1dc36c54fc6046efe94621bbdf3fc8ea049f85
- MD5 9f2a266da542599c3033e7d731e4c210
- SHA1 9080d36f6ff57f675ac9e8ed1659e03e1b091c93
- SHA512 0b16fcdadb044828f4ef43989b74d8f49c18fd509d4cf97a6f64ea66e11b1a87499445a07a74774d65e012d473fb4a1f6c2c5337eb7a62cc574c30ed90e3bc64
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaL9:A3k03kHRJARJt
- TLSH T171259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 960KB
- SHA256 8b298ca71dc1dad03e9a84e8d49a4081b3b2eb0a444f37645eacd258b00ac821
- MD5 239efd5c9b6c4b21bb3f86051108d846
- SHA1 afd8df94ef2478a91246df1b959484538acb9aab
- SHA512 39e76d1189f6d5b8456071312b8ffbe2c0e5c8a5ee05fa9bc407814f4f2e0fef0bb34570b10eafbe11782881ed2d7ebdd4c4ccd012f554bc9ba631db459ba7a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaLQ:A3k03kHRJARJw
- TLSH T10D259D03E79800E8D25AC1789AA69A23FB767C52073097DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 960KB
- SHA256 c7b1b12d36274ffdda729bd3a443d18f841509c2a76e1b6057625c1b8c30f6db
- MD5 9ab8a6574053825e4098571ef383ca4a
- SHA1 e9c5854ccd9fa9d327272d44eeea6029f294a569
- SHA512 5abfaec0f88e85ccd8a9a5bcd85de00ec7d96c039d537a2bc8ea129684a5b41bc29af0cb29d0a4a6373140ebe0effb570cafdfc8fecb3567fd1c0ecd9d84f34e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaVt:A3k03kHRJARJz
- TLSH T155259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 960KB
- SHA256 26587d448bb35a7099147f91a90bd0dcb5deeceb5bf1314f0939eef3a7c3e0c0
- MD5 42f3b1ff15946ef9714cb908a165b9fb
- SHA1 c3b1caccb7ec3b6a6874a5b317b4454ccbbac63f
- SHA512 8f738912fab771b2f74ca6f6f6815728b7184ed4ff2e888df3c217de1f3e5d5dd7746bbdeb8b7be4d8954abcfaf642a09418c6316be609de4a9ee677a122468e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaQQ:A3k03kHRJARJD
- TLSH T1FF259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 960KB
- SHA256 720c174c9ef9908ada0926b15ea2cda4122f0bd484cc04fc81e8e21884ecaddd
- MD5 d87d2df6851c86395ea20cd295f813ac
- SHA1 816ac71d2a6d5ec54debc482faba2ff016e21145
- SHA512 fefce09ba764148ad75f004e2d8748044041a1deef4f530e4654c5d41af69c29e55e6af27e77cc5a15a175b45b03116b2536b04e8676ecc1476bb7f1ce7f5699
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaBV:A3k03kHRJARJz
- TLSH T1BF259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
- Size 960KB
- SHA256 8c5d18b5e180912297aec960f43c294bebe90a0693489407ab8aaa1dab42ec3a
- MD5 19b6b519aebd128002fca2876ae71213
- SHA1 d300a892ff5c4491d4a17841f84724313451750a
- SHA512 cf418f870c4bc6ed09fe1dc6416d1f1c29e0712320e12fb15d48c3f9a37238874fccc0f919f593ac4036580eeab48d5434bc9651f311df7cd1886575b05cca72
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqau9O:A3k03kHRJARJN
- TLSH T1D1259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 960KB
- SHA256 ac6dd1de93c40ac7e88f060ab30d73e2924ee774fb0bb89d3a2482f2b3e7613a
- MD5 e5c946d065b69730f27e531e05259422
- SHA1 d35d51b46badb26cdaa350e6668150181afa5be2
- SHA512 bfc84a3cebcf0b782c501efc224986157d167eda2de145af659ba86e185715db6e06796ccc6b083520ba1905a788eac263518a20d8ee4c81883f6829503fb971
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqap5/:A3k03kHRJARJj/
- TLSH T1A4259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 960KB
- SHA256 44bebe956ab437df1b13c3c60b41556fd3c7aae694d62451aee802e88052c27f
- MD5 890a39f6f569bfd8cdd39ef06f944090
- SHA1 d32d3c696490ccf10f73c8550fd81edd78cd3325
- SHA512 c4cd334fe155a4d8d8c0cfda1d6b2fb7d093cbdd7edbbab0f8b8f666dbfb4b1759a5138fb71ab1552cf2a9edf0d0c991c613f582c47c17e518f890bd53947dad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqahT:A3k03kHRJARJJ
- TLSH T1DC259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
- Size 960KB
- SHA256 d9905a7257a9e2360d5e6d4f86af43861f8431be555d95471a4055abde9bdd41
- MD5 bf8f34de0e2e762526196d3f1fbb9d41
- SHA1 1c5f128c97aef549b4045a7f98805a4c7248d2f0
- SHA512 46a568dd553bb691a3df7a414c8ebb64f626f89a9c31c93d58e2a03eaba932c7af1bfe155fe83d6c38ad92cc077e558f408503726a3d8c6bd9156c7242a9d106
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaHs:A3k03kHRJARJo
- TLSH T11B259D03E79800E8D25AC1789AA69A23FB757C560730A7DF1354D6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 960KB
- SHA256 34a9b3787b445220fe92a1babd47ec9b0f60b4005967a4e9a7776cc6626085eb
- MD5 914a591160d27dcc8ae49e09a94ba6b7
- SHA1 4b714a7faa37dabbdaf147cce2bccf58da3785de
- SHA512 abebb3d0a6c604174694771abdfa2120027f3c01bee9ef97d7df937ec53a8f1379012a802553849f6609537247edac5a86bc9247ab06b454f076ee1d8712a756
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqayC:A3k03kHRJARJr
- TLSH T1BE259D03E79800E8D25AC1789AA69A23FB767C52073097DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 960KB
- SHA256 9020a7dc2d5c9c16ba485b6f7e52987c7cab85a03e724c42a2c8708cac232f58
- MD5 4ced14823223e4357d75130f47d864e4
- SHA1 f969c0936efe9b0dd268ecb76ab47511b402ad9e
- SHA512 d23ee4e7b11620d8cd2901a770ec21394716c80a74f54b813e8457028d9d25bfc5581da99b62048bb8ebfa5858dba468ebf7b9f0d3c576a864b7565320630382
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqawI:A3k03kHRJARJN
- TLSH T163259D03E79800E8D25AC1789AA69A23FB767C52073097DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 960KB
- SHA256 bdb013d17a77dad54eb6472e2fb842121bfac37da1fef390bb7f2fc8559792df
- MD5 08aa05b7fcd3de58ee3e9b6b2840d92a
- SHA1 4862ec45c0b933d459b5d4eb6406b12d0ce0c881
- SHA512 96a39f1b88a2d1fb8bc729df7273a6ea10c517ae128fa13e1e361748c5064215aad09be030d390970cd3cd8a6dcdce6e21ce326557071a21d0213c6864425650
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqahv:A3k03kHRJARJB
- TLSH T1DE259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 970KB
- SHA256 0344af2503c15c8170a06ac6c5c38f7253a74f9af4a937dc936d037e0422d684
- MD5 a0b58ffa84d71c84b4e44e2100d906c1
- SHA1 b5023c26ce1ef7c081bcd53b97766daf5299cd54
- SHA512 d5a85961a30d3db39ef2bfedc4ac5760300ccff4c2fe72ce64f3ee7d0c5098c58e03835f5f5bb6edb466b22abdfd62982a50a74fb5cbd039e2f277f7bf68c2c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaO1:A3k03kHRJARJS1
- TLSH T14A258C03E79800E8D25AC1749AA69A23FB767C520730A7DF1364D6162F73BD0AF3A355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 1016KB
- SHA256 d1fb5a06af00fe547de44fdfdd43857c15c99f60e1bdfe660ffca3517fe8581e
- MD5 2d13c24da8b350fbcc93f8f82b5a954e
- SHA1 efaede5a9d5cc475051dac2cf56f6e55beb0b481
- SHA512 03fd009763dfdd096c545468d31fed8e7149f94b5ea67d832813d2fa464a6b56c1f6965d2ad0e65ec31855dcc16c9364045946e182ac182abfccfc38e3e702e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEheqaLF:A3k03kHRJARJN
- TLSH T1F2258D03E7D500E4D69A81349E9A8A22FB35BD9107209BEF1364B7262F727D0BF39754
- MD5 SHA1 SHA512 SSDEEP TLSH