Analysis
- max time kernel
112s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 13:45
Behavioral task
behavioral1
Sample
2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260629-q2grfaey3s
- SHA256 7e2d1db89ae4bceed8e8518253b3c5c2246775d755668f9bb8ab655fe09de536
- MD5 99d84c1447626ab09125485b9e54539f
- SHA1 c0eaafee934cc3b2942f08f2d47b0b7a097a2399
- SHA512 7e013e3518942d1f7670460030a815adc2d43a187d4a223f5f790e2732960beba0b52ac364ad8d659ed2f3b518a675088bd9fe4615f706cdd5c21840212f4c2b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1:A3k03kB56r
- TLSH T1E4157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/2872-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4eb-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b21f-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2872-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b8-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1656-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c79-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a4c-464.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-592.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-702.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-810.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1358.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4eb-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b21f-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b8-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c79-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-289.dat aspack_v212_v242 behavioral2/files/0x0004000000018a4c-464.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-592.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-702.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-810.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-858.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1054.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1091.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1171.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1198.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1326.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1339.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1358.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1377.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1384.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1401.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1403.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1656 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2872 2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1656 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_99d84c1447626ab09125485b9e54539f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2872
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 7e2d1db89ae4bceed8e8518253b3c5c2246775d755668f9bb8ab655fe09de536
- MD5 99d84c1447626ab09125485b9e54539f
- SHA1 c0eaafee934cc3b2942f08f2d47b0b7a097a2399
- SHA512 7e013e3518942d1f7670460030a815adc2d43a187d4a223f5f790e2732960beba0b52ac364ad8d659ed2f3b518a675088bd9fe4615f706cdd5c21840212f4c2b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1:A3k03kB56r
- TLSH T1E4157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 0cb1c2dae628b5f38c4b4b5e07ae8ce9af5dbc5c4258185592557e903d9788c6
- MD5 f50c431e868906df9347e120f53e10f9
- SHA1 3cd51721046852d4e05670eebda09594d3641701
- SHA512 bc9c72532582560c774e6feedaad6eb00f473077811a69d09f976d3a10aadb0ae379265e218143eb9898ee3c4d9d938dfca82fbb9baa085e16dbd43dce7ca2a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1P0Le5ji0hmxNrM:A3k03kB56r0Pji0Aj
- TLSH T116655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 939KB
- SHA256 d12f8ef656787ef5eb4beb24a9a0de5bdf88f7cfe6a10e7554f1b6aabec1503a
- MD5 7de9c7f723dfdf006751f603e45ba7bc
- SHA1 45922d0cc7fce6dae88cff4cfd509c01ae874644
- SHA512 3e5560a022a4da6d46958d18def12834525e91fd1d9b21236bedf427d72eee5fca70030fe00ceaaaa97eccefa76133ded0ecefc74192c600782a11806e6a9bfa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Ra:A3k03kB56r
- TLSH T1C4157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 8982f0f9d20e8b3be682bf664e780469f015371a688c6e425cb4b24274f7f0b0
- MD5 6183da8e180c69608a5849a5b52201b4
- SHA1 3b4464e5c7e20a038098f38d9fed9793b80d5abc
- SHA512 2c8342bedc09cc72fceb22de3f761eaee7ef08cfff516cdbd0c059e8f3d22b9bfa7514ad9cc45459ac281194bcb9dcb48fa069d49c56cd4acb4920a8dc6e3d15
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1yb:A3k03kB56rdb
- TLSH T1C1257C03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 948KB
- SHA256 f16f667f604b96c46d995d6bec7c4bce81cf9daea7c2bd38820f45f722a53792
- MD5 0e85ac3757ea8ee5a631b88e1a2e02e9
- SHA1 031f02600a047784546a11b5d1e06e642f0cd0ec
- SHA512 7807e7c8e00423eb1272f01ee6ac6bc9e0f0a97b048066ecf9a114351c3dca25055d39262a29d7e39da85e4cd543a1676187d5030b9f64440dcfa48909870006
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1o6:A3k03kB56ri
- TLSH T1C5257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 948KB
- SHA256 eb306ea8e689b50264c4866c0f50d2d5b04d9238eb22709c92b9b3fb317e339b
- MD5 536997e6be09049dda36c5e339f39fec
- SHA1 cc7970cb865b54e9ab0bdfe5e320c779b31a0d75
- SHA512 0bd8cd2b81b9c3c8213dd3dbed92a622c94f30753d829f995ff2f260d9952d21f39d664b2f9d1027c95611e5593943164aea0f686b11d88cfdd13fec5132ac68
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+18o:A3k03kB56rG
- TLSH T131257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 948KB
- SHA256 dd5b0fae759b00b2deaef74d0b4be2aac3deb0256c079a4833f066933039008d
- MD5 e69975e6dfd0740ae885106dc6f33a7d
- SHA1 eeaa33f44de43390e4f27de76f6058c837b133cd
- SHA512 79e4e22e544b98b6625954c796c56470a8655a87e4d4f79e782be31a0bd105f352bda2b5120b41b6294b1328179e36498859991ad2f7ad2b01ba175c900a96a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1cu:A3k03kB56rQ
- TLSH T10C257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 948KB
- SHA256 ee81e2f0eb4509ebf1c515768b4d65e308696401faa473ab563fde832440af56
- MD5 7aaa9f7747c3f42c200e75c0720aee95
- SHA1 6764a4a3abff3064c01c297fbfba90b15f8c6568
- SHA512 ce0926f63cc75505b6ea9970e99ab198988912e6de9e19257493658f885c7f22cc7f55f0678e04e2c529d3d07ba4ad54db37450b3e9a0c8167dcb26f93696d89
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1g9:A3k03kB56rl
- TLSH T150257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 948KB
- SHA256 67a768b57451abc91ff8170180e58d2eaa80aa88c88e0e2bf189ed8052b07e09
- MD5 6ebdc3eb2d6fceeea5f89e637aa3aa22
- SHA1 8c4edd53657880ab69ec6151aac26985f8f63600
- SHA512 0e95bc056a305911c2707ebcf93e9be038f356f36d32661086c99ccc13881ac9930927365dfa80611fb81ee702b6110e831862dcdac5c5d4ca28075109e1e652
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1oc:A3k03kB56rg
- TLSH T19C257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 948KB
- SHA256 457b82291b234d9197589cf95eae02e5408fe47f853912a7bf1bddb68b2ba6bc
- MD5 019b6168e8522c50350248732812993b
- SHA1 03ea98227facbd1768208ffef54e6f1d9a3a16e9
- SHA512 2594c289aaea33d1caa512d277ce82e97c8182915381bc886c58f2967b0e6761007568eb419aec22ccf1af0a29e2140569fe302a97b6b1f4b5e6791a98f85a91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Bp:A3k03kB56r2
- TLSH T182257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 948KB
- SHA256 23a4b0d6f1888a8817f2ccc6d34c90cc0ead70eb55bbcbfe84cacc423709584b
- MD5 b47f30fe8ae2db144bdf6271ec4e42f4
- SHA1 714a42061fe191e4147cd48e60cbb85489a3c8bb
- SHA512 677f7989748aa47b4e76bfdec7da137abe17659b3e3a695a37d0fd132b171236129c2c28d946bf49d0a76fe2512a4010dcc8b06100d969a47bc6485eacf64d8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1WN:A3k03kB56r5
- TLSH T1CE257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 948KB
- SHA256 eb398b64ede17d5cb9238a3c0a1fde1d99c705b8cb3d4cd6bd5bc9435db80390
- MD5 a7acbc56fadb6e7b646e50506ffd2fcb
- SHA1 f17937c9cb105880735f2af04047db2abde642a0
- SHA512 d0ce493d6b1b8f818d2ce5dd5e7a7ba3c548d25b52e04c9667ca6547e2281d93d44655782b96b69b94552369d52b4e12562158dd41e2b1afe5f4c526c0e8154a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1aF:A3k03kB56rr
- TLSH T1F0257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 948KB
- SHA256 bdaedc2bc61602b961ee7f54bc43210dd8421cc6196dc09beec38995f10f4b9d
- MD5 0033f15fd9d5b940e28437ced43ebcc8
- SHA1 64b69936b548a6bc1f251e01dbec36308bac84bf
- SHA512 d3a63e59c1b5da630d914d0cc076c5e2c9ef873a615f678bf8c329d110ca025c81173f4a0c3ccd100c1dbdbdeb9b7394ac29bebd40f05dd4b43a3314ae621dba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1vC:A3k03kB56rH
- TLSH T145257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 948KB
- SHA256 4d04cd4b09c3f1a3a9577b00d2b215451859a4710c21a0286bb96c58a9990e36
- MD5 4ec59a45799362c7257247b8ac884c12
- SHA1 46667e00f58547a1dfa6d9face8ed74097f622dd
- SHA512 fbb6b77ff8d23997e6efbd496cd0c172633e08c352a9f316789ac6873bff84091db88556832faebe1200436e3e8b734290c1ba7b59df68c5c84fb055d12f0a5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Qw:A3k03kB56ri
- TLSH T15B257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 948KB
- SHA256 488e921a1d4136bd3c55fb771f4158a9ddd07a7763e8658114c55b600cd81e8b
- MD5 ca230238a7ac70b99b4bcb9a03940293
- SHA1 447dd8b56f4dcfcfdaedc7ae1818f28514a9f032
- SHA512 245184ff5a3e22f6007e17f7ae8f449b56af552d2310db19d6f899ae714cec2af5ed92723b4726e6cda57926e39a4ebd501077ff567b139f32da14fe5ae0f417
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1vT:A3k03kB56rS
- TLSH T1B1257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 948KB
- SHA256 08ed72deddabfd16552928b72ed5e68e41ba10470d0a2bd8b57ff62f8aecd322
- MD5 b028973ee7eefc7de82a59e488ac4814
- SHA1 6b46b6eabbd0544092e6edcf83153cc6950aa395
- SHA512 c2f43f998614c424f7f2a7629c3df363da8c7ba029bb1ef76132bcf61cd7ed0372d636ab64c94da70e7a9f3effbf90b3ade3e75476bbdb46eca948218b135b6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1pu:A3k03kB56rd
- TLSH T152257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 948KB
- SHA256 008b8953fe6448ccd68084590a0849267a1905fd24469c8f8bc87ecf0dab14cc
- MD5 7a097201196657c3325d583a0975e556
- SHA1 a3d32ef22fb3c011fa4275251e4f7a43be85b2f1
- SHA512 15faf36bbb15e7ec47b50d17093bc1d41342bf3813739312c7bfd038906cd057e57fad8ebf723f5c0c5037954db9108f08d17f006e8a9f982e924b5043b0ce4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1hb:A3k03kB56rs
- TLSH T1DC257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 948KB
- SHA256 f50ba34a0aa4e23008d527299a559292028cf13f7a379bf42981921e0d6ede9c
- MD5 576e384bb5511c2691dc98ec4be6cab7
- SHA1 8a7c63722a2e66eb3f340ea3172e7052ff890064
- SHA512 3604b7a79d380d79530c5019bd296b7f3ddc2d0488fbdae5a9bef3933b1d879d505acd9cd876bcf5e8b4e96cfc2fb49c89855639ba8cdc323d28f2f847a25a0d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1pf:A3k03kB56rs
- TLSH T114257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 948KB
- SHA256 389c909775482eb61bbf7c220ed637261ac642754a6ab6c16bc9472b42832e13
- MD5 09a469adc6f7b26ae417cbc99a505c97
- SHA1 ad955d0048c8d6268475632bccd4e3e19c7e395c
- SHA512 745e97b45e82475195c663c518d1fa735b8391c90af6f344bf0f42b12c2a1b5c231713b0e05e2835d90c777706411a44b7a06e4b6551967107e8017ea1f0bbdc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1SK:A3k03kB56rc
- TLSH T1CF257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 948KB
- SHA256 3bb2be75d5ed3b62c79e80b89f37c789d0eb3f26248e26b4e5c05acfaf87e45e
- MD5 5315c83b4e1175b52200a977b3f9cf40
- SHA1 559912862be0895a8bcfef4de3a2bd22539471e7
- SHA512 439aaae28e47b44e6991a9a2cf2ab287fefe7ab2978ec3827ab1d1bf4ae9002c2e7578853b0f77a45237d7c9031c0102c6d3cebe590084a099bdb2efc46bcb07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+13k:A3k03kB56rl
- TLSH T164257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 948KB
- SHA256 1333f9e8e7ca399e44fdb17559dbf3a50085bd8ea371fea5e9ab70a4a0000849
- MD5 7f31ec90fbd9b07566b278369a73e577
- SHA1 046bebefa5c76e22578d6ca8ae84bd1f5cb7e208
- SHA512 3e5406ad56628ebc1d246cf1f16cd710098b4524e841110567b94dfcd8f52b3140736447fe4476bb99720c4214bfa3fbbc316ea9a717f4a9d12b4a84465d4421
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1A0:A3k03kB56rY
- TLSH T1FA257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 948KB
- SHA256 107fbba5b00e7b962e1271ad4a04b345ecbfbb779242287acc46e87ccbacee3a
- MD5 76d56c7eac52f271aef1ddd458b96133
- SHA1 e94d6de71ddc3c2c01517cdb8aa8baef2347c892
- SHA512 04791a46042fcda5aa8c4a39d7457c814adc6ca41e0c39c954d68c0f9bc5e74f551966338c4addc6ee12bff4782120422066f3000556ba9416196f2ff0f8d907
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1bg:A3k03kB56r9
- TLSH T194257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 948KB
- SHA256 8c9cc2f81ff88d5c9638c5d5644448313dfcf2e55c0546ce7b9e642c138b14c4
- MD5 8578d6a0abb2e9d925b5b840982529c8
- SHA1 8710385b46771105483412160812bba59f2105f2
- SHA512 0339bfaaf72c5c4daad7ab0bfb33cdff2713477a8e7a74a8147b1b681e9974951307eaa2c95e2e41a3410732dffbf5662cb6f199e6751d51aac6397323552d1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Wr:A3k03kB56r/
- TLSH T172257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 948KB
- SHA256 e5bb79db87c14d9bfcc25ef830461a36bd00443ab07eb5b6e3b2ff3559aa476f
- MD5 74541846ab2ce5c30766346f9e9519f3
- SHA1 f75fe75b301c5cb92914f1409977a9f522983c8d
- SHA512 ab5b76bb5081660d193ee4927bc08518faf22fda179743f9e672a2dd7811c0de9bad1b1daf9f4670ad9dce4f0a23baa19ccbefab9e43994f1ee8cf8868ebc438
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+18n:A3k03kB56r5
- TLSH T121257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 948KB
- SHA256 4358b1e820a8ec6ec3641e998bfb65f12a2509f40e045b6ad784257f165e88f0
- MD5 80bd5941a1340386d1ba9dcc02fea496
- SHA1 238d295449aab906c53336e38cc63fd2772888f4
- SHA512 bb0ab0539c3b58068a3db274512dc3cd89d66ae51b55bc84e2647689c82b09253bb2f4cc713a42bc1eeefb6b25d15eab40e32ce2939b6f5060f3296c7b61b8d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+16x:A3k03kB56rX
- TLSH T1BD257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 948KB
- SHA256 890be6168430f74598c7c2f6e7ceb0ce22b59cfd0dea52fff07bc6111c6300bd
- MD5 f675c6f2ba586c6c18c3ced1ea4771f2
- SHA1 474b8bb8d6eac647759999edfaa272b91ea04854
- SHA512 7f871ca4fa3d5106a3a24422efc86477ad642a033b6c6ad2197cbcf168608cca966dd6276f633b79d110d42a5228c1c2091990a80de6177a2c328a63278d0555
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+18A:A3k03kB56rY
- TLSH T11C257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 948KB
- SHA256 6efcbc0d7879fa25a3ca2d2c10832cd1389cf68ee6a9298dc4122c4514f24ccd
- MD5 9eca086fbd6b6d41f87f1415affe289e
- SHA1 f1e9a6c1654b063048fdc2fdd7c5fcf63bb11f09
- SHA512 d0ea11e489cbda6e3660253d7d029c21be0ce4811ae3edd22c230d5b0b36ffa92b6cf05981226102006836a8ac5ec18616aac3029b5c205baac97bd516126bf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1l9Q:A3k03kB56rB
- TLSH T105257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 948KB
- SHA256 83b7574cd6ec0236de5e6db291f888e53b2a130775372730838a3eb078d79b51
- MD5 caab26617de6259cfe567ffa6cd87f38
- SHA1 d68a542d18ad5df85ed0c019b28e712d35c24aef
- SHA512 ccbcb69cfa081f7471b93cb2120b2a53f63de0238b39c06a3617a6d7741c9f880d20774b3be382b5b4347d33121dd0613ef93e902da619b5f7f7df5aa3245661
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Q4:A3k03kB56rm
- TLSH T1FC257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 948KB
- SHA256 7a8b179bddc813e94a0405a66216caa579444ae3ad0e8677e53cce263a14b38c
- MD5 b25639f710cfa6f9ee5846ab58be11f0
- SHA1 87c4ebcb9e746d3dd829f18a51d5e34e107d6ed1
- SHA512 632632fd6feb7b23f58c5c01cd26ee00a2a6c76aab4500f3f714402ee1d4ddc8edd6db49d125fbe0935f7fc9ddb5de92e178ffeb1e4e2e0d6c4adc2645bb52dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Tu:A3k03kB56r3
- TLSH T1B5257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 948KB
- SHA256 2dda8f4b70fb19d9b14ba26d430362d132b51ced65ee3f63574be4b5b3ed3391
- MD5 f5865ae2048a80d0a0f1fa6dcf043412
- SHA1 29d1c9a5ddb49744c2fd5bbf469de2135ab59cea
- SHA512 f6750b4f31d20825cfec98d9fab8630a98b3636b3bff8f3709819fdbd4f3fc959587a22553e035638169e5d3efc620eadaa0d6d081e50c2aae311a8a02d6a49b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Oj:A3k03kB56r5
- TLSH T1B6257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 948KB
- SHA256 0340fbe245898c6891bc2a7179acd704bff89f1c4b46913672d7ffb1d8a5510c
- MD5 9cd2ec561d79b30911f0a9913df58569
- SHA1 5c1910a2197fcb7486ab770f0c8e70007140a4ca
- SHA512 f9b7a45b7eedf95d8c234d070e88a3cee4051f941402960fd9aca84694bcc5f6fecc11d665139cbb4f4deb5b13fcd23c2f94d635c43c82ea8797f3fc5ec51199
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+17g:A3k03kB56rN
- TLSH T170257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 948KB
- SHA256 fff26e761de158b18f513defa6c1f5d7033e886b699219593541f1b2ecf4217e
- MD5 449b77461767559a2a088d7248f04a8f
- SHA1 9b74585593bb7a3be33e7f6acbe7f491d3fefc04
- SHA512 dc461334e70aad4338e110eda7e4c41731edc0542f52e67e5eb77797b817426ee5ecf50ef17e15c98d57a547c181aec45ec67b3fb967b6541045aeea26b82c14
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1mI:A3k03kB56rE
- TLSH T141257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 948KB
- SHA256 2a0528bc080ba03d6cd74527d75f68ab00a9d9191bbacee521096ef10c834481
- MD5 d3aade018ebdaea6ba4093db8dc1124c
- SHA1 7edc37b391b88fdb87ebe21b0798a27ee1191583
- SHA512 546d5b16e079457144f86dbe376714fbec78ee0aa988f855d8de628d64dd5252b3a79bd9033bda7c9255a27582f8662ebf0d4bd93c2315b25a25564ac6ba411a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1Uo:A3k03kB56r2
- TLSH T107257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 948KB
- SHA256 28fd3dede180c975b5fe89b6523406934f4eaa7209c06fed75f678bf7e6b66dc
- MD5 941c3b86278599a2281f8247573ef929
- SHA1 3f4e05e2d7bdd0485056f6d71f1e9988dd4392f7
- SHA512 9bc66d1e198334b00708175be87671966c0df0ab2e0f8c40edb81b9a539174bfb8c72e4a5e9414dd895952ace9539b2713fabe8cf040d4fbed2d6dfc5dbaddb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+13+:A3k03kB56rj
- TLSH T17D257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 948KB
- SHA256 ac2a637f79e63a69821456f4d858b482f8b1c2adcc68da8b5602ca021a6d9d5d
- MD5 8f90baecb246b91dc8c73fd0cf296152
- SHA1 2b5854773b193c4c4b1c34026904e64d3389e985
- SHA512 8e89f8c116627afe1c30603010f90d8b55f95135dc90c5cb356d943553addeb96305bc7e883ab7d323d7383a55992806884efeed02075ae77e2484eaf8747665
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1NQ:A3k03kB56r3
- TLSH T145257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 948KB
- SHA256 d33b026ab881a1a4cb50d240ab97e0bea72055ebe36eaa707fbbc6498e8c5f29
- MD5 b20b38134ca1cda36120985b16a1e4be
- SHA1 cd21d14c5907f35bf64bbcc500d4c52453bbf5bf
- SHA512 823ae7ae47c334bccc986df0bce278efdadde947ee68ed139957065cb8107094a1fe765a1a1f81df25f76ed2216c4078d12d45cfe6e8ceaf7110eae3d8280544
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1CX:A3k03kB56rr
- TLSH T1F5257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 948KB
- SHA256 45931fa8528b53f2f7b8836b4c7131609fb0138eaf2d4f65f60ff685d46874c0
- MD5 ce5b5f46bc9f34bc7f5cbff2dbe3c851
- SHA1 87a665f44a765201d1f77fdbe16a4deb85dc89be
- SHA512 cf53810daa2b76d771f01337215e01424866fb5a72e6dc97132902f83cbb9fb7edcee2d2def0af704365768bf2a2313bf7d396ad91e361767e68b9d7c419dee4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1kL:A3k03kB56rl
- TLSH T181257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 948KB
- SHA256 e12f5d09ecd9c158551e668d112061357f5c0234777ebac865768630e49c6495
- MD5 9990296ea099680109c616457d33b001
- SHA1 c6fa8710778c9ea326935ce8b902dd325dc35b62
- SHA512 90397dc97d9bc0d21932c818e9b3cad7f786365c79b926f5217d42ac8638c55a7c9480547c58d6909bef839d9fe547fec07791269cd001ff42d886cba7e57d1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1AM:A3k03kB56rc
- TLSH T153257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 948KB
- SHA256 ba6bfeef871c2539c902faf9635425cecd1c831802bbd765304deb100482cc56
- MD5 3344e0319796f3bb4bb95e514afc7332
- SHA1 88a7ea021a1cc2807f970b11693986c5566612f3
- SHA512 69974c1af2693178791abc9918f745be12b44ba6a65ca597167d690bdfde0ceb58bd96e94a0a3fb4953449fdbefebc2d894e58ee20655517cd45a505c0b8a5ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcR+1hh:A3k03kB56rW
- TLSH T106257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH