Analysis
- max time kernel
109s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 17:16
Behavioral task
behavioral1
Sample
2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 938KB
- Sample260629-vtmd6sb19n
- SHA256 7339cf5f39a66bb793457993e7ede560ece48af4b6d2194106153953bafe333e
- MD5 2c6b21fc5db8e3810e268c7fc6c41212
- SHA1 3db887e807fd02a8cd7ef8c7de9ac6b902da1414
- SHA512 d76e7a48a0f545d7b5853d484a63f7c0084b052a2a974e6921c454fa8e92a3c05a369fa52c4a33d165515c7abe1f9f70cb7b11c8b8128016c1cf38b8affe43cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa:A3k03kB56r
- TLSH T15A157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/6052-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c559-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6052-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1256-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e4-35.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a09-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a15-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4b-234.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-301.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-316.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-359.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-511.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-590.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-682.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-780.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-812.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-862.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-964.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1019.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1062.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1093.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1169.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1304.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1366.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001afe7-1915.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c559-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b7-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e4-35.dat aspack_v212_v242 behavioral2/files/0x0004000000018a09-202.dat aspack_v212_v242 behavioral2/files/0x0004000000018a15-209.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4b-234.dat aspack_v212_v242 behavioral2/files/0x000400000001983a-247.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-261.dat aspack_v212_v242 behavioral2/files/0x0004000000018a48-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-281.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-301.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-316.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-340.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-359.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-456.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-511.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-590.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-682.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-743.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-780.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-812.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-862.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-945.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-964.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1019.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1062.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1093.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1169.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1188.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1195.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1304.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1341.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1366.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1385.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1392.dat aspack_v212_v242 behavioral2/files/0x000800000001afe7-1915.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1256 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6052 2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1256 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_2c6b21fc5db8e3810e268c7fc6c41212_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6052
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 938KB
- SHA256 7339cf5f39a66bb793457993e7ede560ece48af4b6d2194106153953bafe333e
- MD5 2c6b21fc5db8e3810e268c7fc6c41212
- SHA1 3db887e807fd02a8cd7ef8c7de9ac6b902da1414
- SHA512 d76e7a48a0f545d7b5853d484a63f7c0084b052a2a974e6921c454fa8e92a3c05a369fa52c4a33d165515c7abe1f9f70cb7b11c8b8128016c1cf38b8affe43cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa:A3k03kB56r
- TLSH T15A157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$
- Size 1.1MB
- SHA256 ec0038e4ecfb03f965bbc3a1a1266241712c2c58b9e7f5f5f9598dd584abb22e
- MD5 d00e0752f60188a5536664978fc63f75
- SHA1 3b61f8bdce9c38235bd6689a81bd14a9a80fabca
- SHA512 216966bc4e22fc44a6f6a7d37e5612f100b518e624a6445f9353fd03228b2d2847a914d7208ba4da8608902a3415b42f4e3277ed3ce14fcd0f1e6fdd7cc8dc6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaI7lbht6Bna:A3k03kB56rflNtqna
- TLSH T17C455C13A7E40FA8F46F853099A54A22EA37BC215F2097DF13546D193F31BC0AA39767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 28d6f23c609c8deca0000e3cbea2e38c78c535b86f620ba92c3f533e70094e41
- MD5 d88cad1c14fd68b3dbf49b0f8bb7fba9
- SHA1 546b8aa8edbdff2504711e3c08a042a09b423028
- SHA512 9c68420b4310cf7c4bf1937f37cf5db2fbfdede8306e7b76aef04a5da2095f8a5e038024973e4af6186d4a511c6e7a16d31cc4eb2df946c9ca6f767e81c5f840
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaP0Le5ji0hmxNrM:A3k03kB56r2Pji0Aj
- TLSH T174655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 953KB
- SHA256 0b32e5d9f378e8abf6828147e4ee522911038693159a166064e6024268d14e34
- MD5 5e894804f3c5dd8645576a44b2a2c690
- SHA1 7d1b084518fd6b9b1f9c8ebc2088d44ff2b1d057
- SHA512 6582ca6636f306c7ff6b07b8959c5752aec40b4052fd26f666b78bc7fa3ae6f774307c03ccb5e7e2aadf9c55185c120bb6433c6874c030c2550d2b5bd3e832f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaRa:A3k03kB56r
- TLSH T1EF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 962KB
- SHA256 d05538ecb98dcb2252adcf6c391006a3d76ddcaff8776c8166b935e2735c9ec5
- MD5 598f30c73fc2919ff41db3a591b4ea29
- SHA1 15c419baa8fa23553b1da5e2a7f1823108549170
- SHA512 342913bea7634373388ae6953b86e162244c591343a4e2ce753c60cb08850b3ce53d2b147a27b5fff00e6cc1127d8f884eb1df77428a1d182e05e93676a4554e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYapZ:A3k03kB56r0
- TLSH T117257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 962KB
- SHA256 5e75933623fd3cab926e3dc47debdb0f9188618aa3ad4194877259c6304c51b4
- MD5 462d74f53a79ea434c2b9abc4824d52c
- SHA1 3be82f11fb0beecb4c659bb86326754b8db8f3d6
- SHA512 0b1f648e4c65d55bc2cd83cb44bc006ac6ec843ab5e54aa7a94940c06c117afc8dfa4f98e0019a0463349b1efb2e40b14b8cfeda5823b87ead6fb496aa8efefa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaC1:A3k03kB56rL
- TLSH T1C4257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 962KB
- SHA256 bfc1aebf1be247786f00b22f784db8a5b26e891c1957a29a41f32aa33eb90877
- MD5 f3e9bd2fe18e308603b511eec2a9bdd4
- SHA1 939eb3201f1758de1e4017bb08d13698805551e9
- SHA512 94555122a558da3488beb14e1064d26b99cdbc277d081c790d899eea0933af027cd1686f1cb3fb4497354478c8696517b111d68c6ff32a1eead65633019be70b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYao6:A3k03kB56rg
- TLSH T1DF258B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 962KB
- SHA256 d6cef2f93b796052ae05c972d5c7077d22dba14b4eb0c45f5a2272bbc4205381
- MD5 5cb02a6b54e7131ba6a7e0982a13cbd4
- SHA1 7923c0e51acc3e63b4359e4b419f8e48acabcabc
- SHA512 9115c9b99d98acf59413b02fa3a02f18ca54ab2f23baccc3dba2ce3f8fa3a0edbeb4ba063dfed48d4d71054a9ea37bade5da2bcfddcb796443e2da32ffd40811
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYasN:A3k03kB56rd
- TLSH T1B6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 962KB
- SHA256 7d4a3cae6d91d38854eeccee1e1f3541e8d4e3ddfdf0ad597e6f7999a0340299
- MD5 2bf70ef862322c23a56232031026d745
- SHA1 6b3faec8bf7f7c8f96fe3ba83baa79048c5a3334
- SHA512 01e29bc4d63c009d7cdf7d7b3f889c3afaf38eff05d77ff7eae8d5d7b26a7f421f159f6b034c0e3ca3ffab0ce56f03f81c21ecdb5fca02cafc06c3fd721ece05
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaif:A3k03kB56rV
- TLSH T16E258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 962KB
- SHA256 5ae7e54165e53754ffc9effd7bf3dd6c6a26b65bdce83466ab7d8a4caf14c850
- MD5 fa37443e39a0b0389f538dbb874d7325
- SHA1 c55f1faf5dc6bdb05602b3f3cb928d1e39fa2b58
- SHA512 85852c4e8565eabb7e3c68ba2348799147c69aa18bc79c2b16be2d311956cbd91ddd5c1ef7cdb2ef58c497e30dfc00c88bc3b2c6b11bca3dc3ff271354e8845f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa8o:A3k03kB56rg
- TLSH T1F3258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 962KB
- SHA256 172c0612b73126c479954cfc7619f1d1c8a51e4dad87091e0aaca32fe0a965fe
- MD5 de392d6d2e5b790d7e27a43b1be2e8fe
- SHA1 98e74d188f4b227322cea627cbd78684f8ebc1e2
- SHA512 9b5bb4120112552155bc2ea3020100ac01613322fcc77cd7c92e0a7a9c7f29a0e339da8ba40ea15a96fcdb68c26cfcf97748db5c3e7807cfa7d6b96e3265022b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYacu:A3k03kB56rC
- TLSH T14E258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 962KB
- SHA256 0822732efe8c0b17cdc7cead0b9eb4445f16680b666ecc0c544ce4a67c402d53
- MD5 828dc7acda38da7e3b1b6c87247ba301
- SHA1 393c1c23fc822097bacba8d2d93175ab3669c9fb
- SHA512 9c822bd2f22a44cb91debe0b45fc16543fe1577e63f8195ab957d25f470a39886ddcee5ad8d3b3d50926f5ad8b6de4ba89cbbb1d4ad3207bfcd456a3405934b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYag9:A3k03kB56rj
- TLSH T156257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 962KB
- SHA256 d3f3f9764239bf1bf09a669c0e25ab0fd6e9927027ae5e48eb762a7d74b3e8fe
- MD5 0ef4bc3c0e73716e2cb970b8df21a10c
- SHA1 2eb05d9edd38fa6f3c700287e48217e19157dae6
- SHA512 b4cff3bf01ccf17288b561ec5700274ae26ac6cdaac2d43c1a30403e39c804a9c53718f54e784387acdf2a6512ef1f7a611d68907399139aa97c0b10bcb2f533
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaoc:A3k03kB56rK
- TLSH T128257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 962KB
- SHA256 0b13925d9097d3a51ab4af1b28a7fd864148b278fae1aea1e3d1ef2c398c080b
- MD5 cd86eb421fb3dfea6b38573efa6a624d
- SHA1 84e4aff7985e0b0b5deb35f261bf622a6007c2ae
- SHA512 ca60bfd68fba2621c1b36cbd821fd4145149ba8497677588ec058cee9befd10c0f593bf2307523366c55caa4e4e7279c89b34b8e1e90bfc3ab28ae5a5f62fcbd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaBp:A3k03kB56rQ
- TLSH T1E4257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 962KB
- SHA256 a1f8c8a41776613b34caa5dafc514e868695c30096a123028044cf6bbc48973c
- MD5 29481e63ae8bacc4d72741b3cc96cd3e
- SHA1 0f24fff1de3694e8b1c4ecb90d06fe73ac521eb8
- SHA512 4124135c4eba34818325799700575344b0a4d6bb20d385c5ab37386dfa5b11b0f56a72e19e32c6c25acd98b8443757f8945b77928a91fa653006c54119cfc61f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaWN:A3k03kB56rv
- TLSH T125258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 962KB
- SHA256 188579c831d268619e6636f5e47b84c15fcd146e54e91580fe5640a8a869f32b
- MD5 25cd46200b138d077b99aab66b8e5942
- SHA1 5841503e56e0c61a62a05a10d5b5a18eaccd333f
- SHA512 382a74f14053ec4e5050d9c594da23937d85c1908d3b1a29a38a325fb17c27f7e5fa3ff1e2ca82c593070a24959e68ceb5389b92133a9e205947887a0ccb3b55
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaaF:A3k03kB56rJ
- TLSH T167257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 962KB
- SHA256 985d0008811d64dcb80378bd57481862d2326c0a55d599cd1d35aa191983521c
- MD5 c50c71587ad80cffe1734f49527852d1
- SHA1 4ae13fafb422d059393ce74cc9607e6759f972d6
- SHA512 84d876e706624a6e246ab736f4d046800f76a6d604d1d4eba671d1928067d49c8fbf767c1bb6fa81d6c8a4eb00616ecc28b676558ad409b1a420fc0df56cc6e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYavC:A3k03kB56rV
- TLSH T13B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 962KB
- SHA256 5d1d80e2d1f123193e699aa559c1f4659a3d71a0dcf0ccc4d7a52aa328fcef6e
- MD5 27c5e6e2c490f0402c1cda7e15b748b6
- SHA1 e7c461733c79727623248c5b8d422b1c0a15b4f7
- SHA512 838a4fd596c3fc2fa833df8e73e725518527927c8322577df0a50c13895c846e01ae46e899b5af3f1264dc1896ea1b06cfe39453b3dd30167e85d0bf4b51ccea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaQw:A3k03kB56r4
- TLSH T10C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 962KB
- SHA256 477c09feb7e6b7393b33a97eff310588c5659234d1ffa2594a0e510ef5ef1f82
- MD5 d836092d2550b91472a6328d087eda55
- SHA1 30baba33d153686363df3c2b521f9ddf85798b2e
- SHA512 f9ededfaa7f3e1defc9501797e66b75b77f73141aa09b6b5c1f655506cebc17209cae72d3232be4f6e3071a06f3f21273318104f43a5a0dba28c5349a9cd7f5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYavT:A3k03kB56rw
- TLSH T16F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 962KB
- SHA256 3cc25b37ab4c1ac8d0be923ac903cd39c82485b1a43267850076dd1486195bb6
- MD5 b0f0b5212213b056bd418a54adcc8003
- SHA1 09cda73f36a9614cacac0ce3dc5250685374c62c
- SHA512 0bb1e93b332ca1f8ad0a7d4002b817bfd302571a78dec51ac1f06c54e623986eed29ff456b93ca5b5bd0cf4eaafe027575da15b8cc89ab31f659c91648bd312f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYapu:A3k03kB56rv
- TLSH T109257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 962KB
- SHA256 9822c6bac1e940a6f7bbea025a557f69e6bc85a24efe25e663171b053bac8fb0
- MD5 19ff8e88ac5e8f35f39d22d600a1a61d
- SHA1 845a5586df0e6f3c161638d7f3fcf9e196c0930e
- SHA512 7d1a85e4a4b540a500fe982d40356211a1a10cef83ffb398f4fe14aba45172551f21b040e3b7304be1a9a52a094f64566f0f93ad71deb48d18c72f475613339e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYahb:A3k03kB56rW
- TLSH T14B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 962KB
- SHA256 971e485ad14d78f51d2755c0fc98dbd8858505f712418446af9007f3f8872c3a
- MD5 e2d6ec7a30453aab3199f53cfc7cfb27
- SHA1 9076387a0000c15bd499bcaaaf7e4309fcb5de55
- SHA512 f7263ac66f61b1056eb5371335ba020cb41ba1d1a3c06dcf2db3c46710585e041f4a9a3ffe77e89455c63e393cf77b37449102bf4c6030b190c4f5f6f61953ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYapf:A3k03kB56rm
- TLSH T1DF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 962KB
- SHA256 f26f0ac4f33774440705324db832116c336e6c25cfbad53babf03a8f5b78d697
- MD5 0e45563227659da42d898484dcb711eb
- SHA1 34e883d3a5b7166e1dfed81fe91957680a5a1633
- SHA512 aadfd09e66d75bd0c851c44416dbd56e8cb950242e9dd2a00daf8200a779466de7c82814b672e0cc23525ea7a6a131dfe0e878236bb6a30def51120722ad0a2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaSK:A3k03kB56rG
- TLSH T174257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 962KB
- SHA256 4b328072327739073c3f64848961ae93a875d1cfe359434d42812c5584ef6bd9
- MD5 acfaf28b63ac88bc135a0b32bd3da8bf
- SHA1 888039ed5b6c61f4db90964132ddc3ec75962d8b
- SHA512 c9492065f62deb19af582e0183b1afe62e9417c59dbe80781f146b5fbed3e436359e682b12fc4418bd67f20b1a5f65f3b7671760162af02769e86827994e0209
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa3k:A3k03kB56r7
- TLSH T1EC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 962KB
- SHA256 9984832209b161da282a469440b01ce903696ba361e444c701335edbcc2f2007
- MD5 2097055b9856cab8ec88066998f081a1
- SHA1 fef8c0d8c3e97318ef748e55c4cde1cd4dbe4768
- SHA512 87d47ac5f0e411b8878d216bb5809ed7f5ffa7110456c9d253cd1ccbed231d2a42a9c66c8aac38f001e6e301adcfac477b329e94f660cae19bb8d7059629dcd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaA0:A3k03kB56rq
- TLSH T14F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 962KB
- SHA256 8769a1c19098ed41d3036f240360252d553e4582dbd8deb594fcc5d1faea7576
- MD5 01a71d90134ba6d7fcff91bda2e6192d
- SHA1 e90eec02aa0d29625c70c690019d32051e3647a1
- SHA512 e994040e404e8c413e432452df94fef7db1c5924151509c693d7969922a6f2481fe12c8f0d83f25fbc4cd20dbbf52d401b6ffdec226b92ccec41a21659c1d7aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYabg:A3k03kB56rT
- TLSH T192257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 962KB
- SHA256 b28e2acf40bd8cfd9834c19bd0807b229f79010e04ad97cbe1c201d964f85d84
- MD5 1b374b4adf34cab200015107443bd11a
- SHA1 3e1f3b26a42d632d64e63746e9986bc716f37a79
- SHA512 ff231ee54ed69ad938a64c78c4d74734415334478d3acbe6ad5f20e7526d2d46e932083769ef847dc23133320de2a2c814b0ee5106c7be46c15cb43062601800
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaWr:A3k03kB56rl
- TLSH T157257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 962KB
- SHA256 63dd20fd85a79c5f0c2783f8bb5ac61eba0098ba759dd366468570147e2f558c
- MD5 6f3ebaefca211e194e600b6859522a1e
- SHA1 5b1922dd3c9be26d7432844055dc64624db5d8fb
- SHA512 dc08efa4510278e23071145224f966c43eeecea0878a8b48cdb030f62673f77b5f419bb90a4478e472c704cacd1a366d23149c6ac546ae244e10c81a2e374b6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa8n:A3k03kB56r3
- TLSH T1A9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 962KB
- SHA256 26dbd113f5564878641177f03088e5228e033d55e7aa99ee14ccff1dd82a164f
- MD5 abd66be05a99ec4d0ccbbc7a75f45201
- SHA1 21e010844a685641c8518deeecf5e31a76dd0fef
- SHA512 3655dbd223b73754acc7298176f7ae206bd81b8dd6e623223b75d0e8fd66581f6a3609959734b038b8e34fd178787c025df5a314831a03faabe905fb54d079ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa6x:A3k03kB56rt
- TLSH T1D6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 962KB
- SHA256 ff9686464dad671729cbb625aafa4b371be1bab0e7275bc38352572ae3ae704e
- MD5 be972c8c3b0c6ae35d06f82a3ffd69b9
- SHA1 1a8c3e241e813c56cdc710a5ab65c23322e69143
- SHA512 23f8991ae7ec30a7131313aab0a95265a2eee825b32c19b84f1e288b4afb55afe08d85809d10738ce0bde7839ef4087a8ae0bc50b65a3b4abb5959814abd110d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa8A:A3k03kB56rS
- TLSH T1FD257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 962KB
- SHA256 0ddc8b1d923fe7a531738f9393e036fcce6565b9781daef333564a91d803c9dc
- MD5 b907d814a8f4c5662e1e508255fc5356
- SHA1 11691fb99dc4c3ff7f20dc966156ba3ed752bdc4
- SHA512 2876ef93764d14f3374c165ff6451334e90832e029156e33abaf052c0ab4bcb42e4df9c91e87d9feeae3528d47fd42334184328c5a2d3c290f2bdb04c3ae1113
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYal9Q:A3k03kB56rP
- TLSH T18F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 962KB
- SHA256 c786b3b094a7e6df393c7f9600694e529a7270fd15ab02fa0946b26eee5d4d1d
- MD5 d2fd44c6a4c96a11cdd7a7efc857f8f9
- SHA1 61a5cce281811a0571ccd24c6fe83a550f04e30e
- SHA512 35171c273dce00e4bc3eccb27602d3830a6ed5e0260137e629041fcad49b787f7bcb71678f2894587827e24ca307abef8f325cc62633176445bb5e5b2439fdda
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaQ4:A3k03kB56rw
- TLSH T12C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 962KB
- SHA256 700ab339c38726a6fd5ab7013c342f0d6a1d4e7add4d0e82bc812cda33d79cd4
- MD5 100aa809f72b96a07fce4d48871c548d
- SHA1 7fac73f2a251940d970312b7f866b22d3640a378
- SHA512 0b4a4eda463c60c54377a5be182d0593bc2da8071500d95bb123f7b369dec862b3897af3041c729b518034e706361d2f845d27c33423d90567048330c7acf253
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaTu:A3k03kB56rR
- TLSH T17F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 962KB
- SHA256 b5314e87e198c35f758a6155f71e17394724fe80d08b4924ea386a25f72ad2d6
- MD5 1c2df3c9c2bd9b579754b99c286dae7f
- SHA1 3fa2e3870bb6943df8e5b6415a345dc43c3775d1
- SHA512 749502ca032ba074af7c2f9c3bac280835cacf08c165c30bba6f5666a5ffde60da6eefbc6ad269187ab28381ab750e0efcf0e08f0c37e9aca253184efe5a6d27
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaOj:A3k03kB56rb
- TLSH T17A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 962KB
- SHA256 8a9dd274846b2c60e1338eadcb481f68d0c6e751ce1ee97cb77e8a569345ee89
- MD5 ed0b36c7ad7a86f1fa5625944f61fb27
- SHA1 8f4b9f2415cc29ecbc1755174247fe7bb19e02a6
- SHA512 4e858a52b4a95f48326fe16f17e7e1863f1b0bc9e2c6a46ceef14fe3d06988d4a9afd1bbd224d4a12680f14c7007c96f0402f9c0cfcd86cff5f15f84cd567ea4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa7g:A3k03kB56rT
- TLSH T141257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 962KB
- SHA256 daddea3a1d8c02710fc0e971e60ab609c4d60f24a89f0be9423aaaa4f355489c
- MD5 44c59e7a7de702ed16124dd75f2d616f
- SHA1 49770d81df28cedfdec5a16eac39e3696245aa14
- SHA512 5d4e896fcd4570364ce8ef5a988e8d08371050c3faee67293dcb30bb681c9313e12db590b2a91509139cbb90df9d5bb8d181042494e16af78820aa7c174d425f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYamI:A3k03kB56r6
- TLSH T111257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 962KB
- SHA256 007a93e8d709843eb759429ffc402dd0ce7ccd7634545454f8878a8b05ec1073
- MD5 2cbedd5356ec1144697d5f60085b83a9
- SHA1 a96217170d5d23872636072e34a09d26d3e60def
- SHA512 a1045ad5f0784532d47f4a20f5b776b170aa39b6837d8c479df8345c49a973d2040f96ca751b739673e6292c6e66754d912d7fb308f86d4d86ace4fb2bd3ea20
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaUo:A3k03kB56rI
- TLSH T1DF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 962KB
- SHA256 f6ca4cd4b0f6bd0605c8f8cb462e95c3be1514d2cad32a0e3b5a06063300128a
- MD5 71e7de0dd89fdd22587c4705addd5700
- SHA1 ec5197c2eda1d081361c7e2196b2cff292b255a7
- SHA512 e533ff0a1fa1d0aafd73e54230d157ab6c9bd149f87bc7d3256e984a704c39285263030876fdaff6c9f312c4c36222bad5ed3d5922e6af7b73fb07fe51746026
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYa3+:A3k03kB56r1
- TLSH T1B6258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 962KB
- SHA256 5fb7000061e6ef89764f2e53896aff1e1daba3404893c4eb02223c17ea645901
- MD5 c4e07054a2d5b0fe22f588c1605a98a0
- SHA1 3cb1bf5b64e6f7d46769c4d196838a2e00f2c483
- SHA512 36eb38fc6cd5681e5e02b6445d912f26602c93409668c39a7e94712bd77c4d0b5ec80b0058b9ab2214bbaa4eca6b0c3d9cc2a231f4a59dc0f952e4d647371b99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaNQ:A3k03kB56r9
- TLSH T14A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 962KB
- SHA256 3845d6ea1411f40ead80e2e625c386cdd1c5e3600292cb02e234f56edb989af9
- MD5 688b31407243fdd69d7607fa8914509d
- SHA1 62e4b255dc5173b3a7dee1dcf2bc4a2e479cb428
- SHA512 976092c8db2f83f05a4e1532341fbe6ae7672604b61135a4275dc36b03a539408774a9ef3fb458198a17063e3aa5e0e380c490ff5c4fa5886a1ebcac50efe9cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaCX:A3k03kB56rJ
- TLSH T111257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 962KB
- SHA256 73bca72909fec817616613558916825187c3cc9ac4127ebeb922d8299aa3a3ec
- MD5 aadb4bf8b39f651ff05c24dd1a7c44e6
- SHA1 7ff70b28480f520382a0cace2373027d62d79d7c
- SHA512 56f828912f48df02374343b1142f1050ac149f278aa9b60c0926bfca4ab8f145c922a23cf64764f3bddcff718a31a6ee6fbfa8f66c2050609051222c56c5678d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYakL:A3k03kB56rD
- TLSH T1DC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 962KB
- SHA256 a6be85dfe83558a80a773ca33cb4fcdf51fdbe25f6105e2b9eac3c145ea0d0a4
- MD5 e4f8b9ec29bd8bce16c0cc7bc697916c
- SHA1 b7d5d4fe6548689ad4c04ea6a1131b04d1c666a6
- SHA512 988cd51d1f6371705f5717c3862cf71a2fc32a77a75c72c81ebebf1a2aa8e5111ed1c65eb61d3a9072559a2139333b10d4c7fb7e9f0b3849d1d1bd7100a057f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYaAM:A3k03kB56ru
- TLSH T146257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 962KB
- SHA256 885f6e93015f62fe4d64b1cf222147a8818ebe5015e16385c52b29443a57caf6
- MD5 23dd0ef93c89fd71609fe48f7aa5284c
- SHA1 6d93966f2a3446c07673b3205fb4affdd1a74ce9
- SHA512 3dcd1df49c63420b6c22c053458f0a7e85a199972ab1843d034acb2ca49f370b4cfeebf364ce1d3781957ca539856bb2dd97d8212469c7754d8100c40feca745
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2X3OacYahh:A3k03kB56rA
- TLSH T197258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH