Analysis
- max time kernel
119s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 20:06
Behavioral task
behavioral1
Sample
2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 906KB
- Sample260701-yvm9msd13q
- SHA256 4bab7d24aebee51ea799526bb5a874bb7b5695b7e01a6114292b7006840c522f
- MD5 03c499e22fe4f9e4a751e84e16573588
- SHA1 29d54de846d88db4e034ba749ead7b81a85a47f5
- SHA512 9ed8dad0431724da61d2aeccb5fc132b16f385af09445241eab6cb57587e944a3cbfa2a0e86ff3a5219f65d1049cbd3a16896350a18d87c09dfeb30a1bc8a9e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOu:A3k03kB56ri
- TLSH T104157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral2/memory/4956-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c5c3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4956-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1704-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e4-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c74-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4b-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-241.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-280.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-300.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-314.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-352.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-457.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-506.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-531.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-610.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-696.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-760.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-810.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-923.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-969.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1025.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1062.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1069.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1106.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1125.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac45-1231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d62-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018903-1496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018909-1540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018918-1577.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000065ed-1937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000006545-1939.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c5c3-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b7-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e4-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c74-60.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4b-227.dat aspack_v212_v242 behavioral2/files/0x000400000001983a-228.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-241.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-248.dat aspack_v212_v242 behavioral2/files/0x0004000000018a48-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-280.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-300.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-314.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-333.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-352.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-371.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-390.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-457.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-506.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-531.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-610.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-641.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-696.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-760.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-803.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-810.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-910.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-923.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-949.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-969.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1025.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1062.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1069.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1106.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1125.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1156.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1181.dat aspack_v212_v242 behavioral2/files/0x000300000001ac45-1231.dat aspack_v212_v242 behavioral2/files/0x0003000000019d62-1341.dat aspack_v212_v242 behavioral2/files/0x0008000000018903-1496.dat aspack_v212_v242 behavioral2/files/0x0008000000018909-1540.dat aspack_v212_v242 behavioral2/files/0x0008000000018918-1577.dat aspack_v212_v242 behavioral2/files/0x00020000000065ed-1937.dat aspack_v212_v242 behavioral2/files/0x0003000000006545-1939.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1704 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4956 2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1704 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_03c499e22fe4f9e4a751e84e16573588_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4956
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 906KB
- SHA256 4bab7d24aebee51ea799526bb5a874bb7b5695b7e01a6114292b7006840c522f
- MD5 03c499e22fe4f9e4a751e84e16573588
- SHA1 29d54de846d88db4e034ba749ead7b81a85a47f5
- SHA512 9ed8dad0431724da61d2aeccb5fc132b16f385af09445241eab6cb57587e944a3cbfa2a0e86ff3a5219f65d1049cbd3a16896350a18d87c09dfeb30a1bc8a9e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOu:A3k03kB56ri
- TLSH T104157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 935KB
- SHA256 2a994a819e8eedbf1df3a439c15eebc864d55c49b56aff10b3d3b4a8a2785337
- MD5 735d1ff2b6b67b5f84220999cf15be62
- SHA1 986c34e3877de7ab05032354718b1c77b8eb65e4
- SHA512 5cf6b5aeb81d91bbb8a8eec684c8796f9eaa943d1d6f759e5ff75f311a0752b41edc386819b2292ecc14df2d2d43c271476ee37a310a5f7b714c7737650a4093
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOoP:A3k03kB56rS
- TLSH T17A157B03E6840FA5D10F81749AA68672EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 953KB
- SHA256 fd95a4e3a5324374cce777fdac321f19cb43acbfeabbac7cd9155b8badd88bad
- MD5 b663835a42a93de7fed656147efdaa75
- SHA1 b86ab35724ea7351e05a279396200a9bc2f3bbe2
- SHA512 591dd531f52806f15942839169b9b21d4abbb874cfb5ff7e6d2ad2034cc9a787a03da0e3e44f4e64702ea01ffdad0b7da330900e11212c9b0f78797a2e4e3286
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOP0:A3k03kB56rT0
- TLSH T1F2257C03E6940FA4D10FC1749AA58662EA777C125F2097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 959KB
- SHA256 108051ec13737cb036dc1fb0a294f0e423053d4423c1d0b1e9afc97ee0ad5a22
- MD5 02c1d968e861e230420c10f63e129e48
- SHA1 d10597da02c4c59a4e2326a7b6b45b04487e10e0
- SHA512 5f410bbd4cf630ae9adbc7f186ac527b9ec9fb309eab3c1f6af29f878a7f7e59502fb4cf18289fcf903a9323c248f91a594333c81b54d30dd63b393dc4e0d765
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYORfj:A3k03kB56rlj
- TLSH T1FF257B03E6840FA5D10F81749AA64672EA77BC125F2097DF1354AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe
- Size 1.7MB
- SHA256 43ef8a541212e8bd5393b0944a07b1e1cfb0ce479e872d34d713cde02e8de724
- MD5 8c5ee86b8b4e12ec017740833a46c748
- SHA1 5c228a41b17bde703114f4cbd31332c675904bcd
- SHA512 c4e321e39b1848275de198cc57a9f98421fd58318c6ea4c149014824525abdbd59a66ea6c78a1f4b99aee9b836a63e4a57e1d6d2435fe02f4e33172f7700239e
- SSDEEP 49152:A3k03kB56rIPMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMR:A3k03kCreMMHMMMvMMZMMMlmMMMiMMM4
- TLSH T1FF857B03F7844EA5E06F81309A6686629673BC115F2087DF2354BF1D3F327C16A3AA5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$
- Size 1.7MB
- SHA256 b46baedc35a95543f7812229b839fd2d907749a38c536a7ca86e328f0b708577
- MD5 2488286c4b31de478853aa84d15ea19c
- SHA1 1a3aa048db2e2c91defdc960af5dd58443b2184a
- SHA512 c7e820f576237f26093fd6374697a7505e218b38972e58e075ff98ccf2d17ea7a30f97a3a721c7f7a0f43e02b5c75e592bcf8f8c09ed70ba58e80a0d020a30c0
- SSDEEP 49152:A3k03kB56rPmWDTMMHMMMvMMZMMMllMMHMMMvMMZMMMle:A3k03kCrPmWTMMHMMMvMMZMMMllMMHMT
- TLSH T171859C02E6940EE4D05F81748A968662EA737C560F20A7DF1394BE293F337D06B3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 dce6077283ad20761f8dfea0d9a331562c3901f77ad02e95d69ce1344ced36db
- MD5 76caf8ff0b2604f64e5e10056c1c6bcc
- SHA1 26480489fe93e4f5cbaba2f50fbe2ced7ee2ecb9
- SHA512 e87c222d79367676d4adf9c17ebd3491717af7da91dd376098348c37772d2bab2a7e03f7d4d128a442a0adae931120c2f1523b924c2d0c4e21223d501c47a7db
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOe0Le5ji0hmxNrM:A3k03kB56riPji0Aj
- TLSH T1D0654A16F6A44B65D02FC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 921KB
- SHA256 8ebf5d8e7ee490cbf28544a1f476d93682f2503a7ef512d0f61387c8f60d2dfc
- MD5 8788d5840f9181d9d7f4baafbcd0bc3d
- SHA1 bebc1e1cf8c58bd17a94ef11da13e6e9f04760ba
- SHA512 4de62f71c532027cb437cfd3bc3979f0f1720efca0c237b1181fbb57350794f3034ec66cdbfd18b67a19e100b994675a6f81252ca6376343b9788507df7deb3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOYa:A3k03kB56r
- TLSH T1C1157B03E6940FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 954KB
- SHA256 87fca0f3df8b55cb2cbbea28938ff152c2d5b35b280bd3fe5d6f14467675096f
- MD5 d9a28927edb7226200589db43e065f37
- SHA1 408ce98d436e247bd4244561608c4529ef474a2c
- SHA512 139df6afb8b7fafa83636e15bf96baeac29d0fb35249bd5e637160927b7758238a04a690843c4d0b3a72013045d3eefdb566d0d0bf6cdf715060c20b536bac1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOTb:A3k03kB56rHb
- TLSH T192258C03E6940FA5D10F81749AA58672EA777C421F2097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 930KB
- SHA256 d558e48a98c525b8f07450a7542fa80716246bc3c309f7b3c15750030a1fecbd
- MD5 8cb63cf19c541ac15040be7fa91383a8
- SHA1 5d63cc295bb9b1ea4f36dff268b55d1bd31449c4
- SHA512 481915ab80bc1ae121cc2068fca7b31089374e123dcf5b18c33cca08f1a203c4fbeb9f9e5d5b1593d8465eee297f498e9912bf689f344a21deea64a26236fa2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOx6:A3k03kB56rM
- TLSH T150157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 930KB
- SHA256 07d7a39ea9f6a5c229f01282ed4d1c465cb0d982777b36b7412265cd3d7b99be
- MD5 20521a67da759e8ea8d7c5b690970770
- SHA1 46876e6088319cfc93255d0a574bc396f62260e8
- SHA512 15860ebfc6d13a7a92f5d284e0609047556fdf6cb56715ccbcca9a679e12d96f8dd9bed0a33741d9e7d1be45a0636815b894ca3344d6ae67900da9fc9f0d2803
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOvN:A3k03kB56rx
- TLSH T129157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 930KB
- SHA256 5b1e0aaee5b10b1baa5001281dec7ce7e4a36cd438038c290aa0a556260fd67f
- MD5 f13754a738255c999c297fe148a65603
- SHA1 aa019cb1e23b32d5c616810315516207b043c374
- SHA512 cb69275d76c0c6cbbc10b233affcf713b706dbb54d098a9cd2753bb35d7aa85851e455fba576dea9da5bfd426a35fbda87bedb2d662ba0a4dee364f5959df704
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOVf:A3k03kB56rx
- TLSH T1E8157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 930KB
- SHA256 c448c96604cce6b9dcde99432588c0b242945c468a1ca9271499d35b1fbf4c48
- MD5 5b32b10e948002107df74f42c9a9f1de
- SHA1 3d7653acef0ca65e55444145f9ca209b4d42e01e
- SHA512 7f824d94ed01dff225b3e08bb6bba4c00ea180e83cba945a9357adafa959b9f5064e5870ba058f4a7310653cc9af789ff2bcd914c1aadc97c7d8204a293ae518
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOXo:A3k03kB56rE
- TLSH T1D0157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 930KB
- SHA256 7e9e76d6563b6ac0b39601f364599ba98ef5bf2b72c6cf601deb0c2184a0a3de
- MD5 24e482d2f0beb7e1b8fda9443ed0ec39
- SHA1 54e312cbe31f39aa09e5e6108647f4cb4e6a801a
- SHA512 b146d403b78f2cf6330b1984ebb9f29a3cbf0dd50da95f5cba942945af9e174c31ba0e56707944e400fe6df5fc7257dc7c55167acb3252a456a84ecb9b5a10a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYObu:A3k03kB56r2
- TLSH T1AE157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 930KB
- SHA256 63e3d9b7a20a670ec5083147b2f89e06d50d1d79512e8a0aa07c1f274e2ae72c
- MD5 f6ad28954cfa09e6a0b8b3773497d280
- SHA1 51b550d4055e21c52c656fa6e5b4a7bd876dd943
- SHA512 9d6bf1db466b5e5a5f465e1e4c0c7e899cb2815195bec9e1735685ff4943fb731263ac25794c9571dfa9a2b2aac0458c453335847ed452db26604f20404c1451
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOJ9:A3k03kB56rX
- TLSH T15E157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 930KB
- SHA256 80e05579316f7de5d43cb8b5a5f8fce8dad5e808b5a9cecbbb41725730c0ccbf
- MD5 ca1dfd936dd5f80f9fee4d375fa0e0f9
- SHA1 b6b2b1b7c30b26a506bbdb1ca0f164375360f459
- SHA512 3303724c9b0df56ed566ad7b269258e50968ce2bad74d55bd9afacedb525563a2a54cfb1f18006ac6b4b941ac419b0a8406e4572b97a9aa8253115930d8bb2e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOlc:A3k03kB56rm
- TLSH T1F2157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 930KB
- SHA256 97f76e0e3ea65b95433fd18f5c7625e3c4a579d4b13dba2350d3337a98d994f6
- MD5 3139613b57cf52ce4128cabaa5ab47fc
- SHA1 68ca1a17d9d147ed0b3411b8e279144f4006495b
- SHA512 1d8680975eadcf68c720cfe741d340e5d7c90ec052b4aba777d62a8b198cb248c8bb7c4f17f871b77d6111e07581e004e752679b9701c414b17e846c11df02df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOep:A3k03kB56r0
- TLSH T16E157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 930KB
- SHA256 dc347462e3479886a0803a9407253dff9a003372b23b9bb2f2da0fa6e090026a
- MD5 4632f85470fc09c4ded6eb2d267e10f8
- SHA1 d241c6b522626fd20e690387db67eb8f07cf3117
- SHA512 9cada7c2c0292f780a65721e750a94278ea05352f58e82546317abe5bfa1d82e205de8cf144f5c900781bf1bcd49e47687f31f87f5fa8e45690033f5d5c32be0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYORN:A3k03kB56rD
- TLSH T1F5157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 930KB
- SHA256 ca9442fa17250f794386754f223968826cc00cd06158e6b14337837f9fd9ea60
- MD5 62cf29afa00d0050f59d82cf3c4b8ecc
- SHA1 7cb98b07da9597622cd4b7e54729b5741cfb24ba
- SHA512 ae118f9c7bc0487471c0491a461b4f31bd5a15377f05918b18a7be7abec4d4527493e1d48948241322515fa213bf98b53ea29c543832653a33c04cd781295757
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOzF:A3k03kB56rV
- TLSH T1F3157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 930KB
- SHA256 015e8e23229a355f01baa7a0a1f3e93010d92203fb5fb31cce657cea7b3fa3ca
- MD5 6a55856aa4155b4362e88715f89ec026
- SHA1 5aa73a5aaf8668b589b138de254d44f97b000695
- SHA512 7afd64e1006cf36cca133140be8dc5b1b2282e94a864d2727900e25d1791e8a9094024be49210a69edd701f75ab670440ec0a8f1976bc11889bc7fc2b5fac3c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcC:A3k03kB56r5
- TLSH T196157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 930KB
- SHA256 e9fa303a3ea825d9d0e3defd1bcf07431d2246b5f9ffd0bd3dcccbe4cb22d3d9
- MD5 8a7c6a8d41ee7107b22d8f06043dbf4a
- SHA1 54b95b93540cc6bff4ac3ceac8e9758a62e575b1
- SHA512 751d7725e8cb17130bab5167fb7431e5f68e75fe82d0db25376a7a271ff69c03a11eb4b78d5887f891b17bc2fc21831f73237ef4e407f43689ea139eba67ab3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYO3w:A3k03kB56rk
- TLSH T12D157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 930KB
- SHA256 4657b496edebc9a3296d4e70285d414b550b6750b249120fe87e3fa6485908f0
- MD5 befac377bb821c1b8d6cdc1e71ca12a5
- SHA1 a46d0f2f46c5a7ef52fe72895f13ee0a5ae07d6e
- SHA512 e262ade1f4c7cdeeb9ddb0a3ed9b652e040f7bd0f5d311f93a57f52fda05d83b86bc4bcd688385c225898db4c7e29bad3d09d16a54de5cb1b6b398e9afaf92ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOmT:A3k03kB56rM
- TLSH T12C157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 930KB
- SHA256 554bd879bc23c2969045b2ed73fc51a5b2049e57ec42249acc99c91a284a57ab
- MD5 8b922044fc2467c08d4366f11bc77627
- SHA1 937379477a7fb343354750716c98082fa909179f
- SHA512 cbb5dcf33c89fd888abd4fb017b090228961f4e005ba292dca298705427a9d3a9b16c78f61273d2fa56f6f5d9e51bed89ccaef2d715826803952f7d7d691f146
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOeu:A3k03kB56rr
- TLSH T16D157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 930KB
- SHA256 60e5a1f99935d6a19a6e1e5312b66061a003b9d313598ffc2033894b21854347
- MD5 0e9d28cf8796983427e4b51e0bf75325
- SHA1 a7ac9fbb9b5d74d77723ca3d9b12b9a1e4ac627e
- SHA512 3f5b0623cdeeca56681e85a034c54cba2cd545245f9840ab94d7799fe854eed32c63d9b1664739bb9ad5de65edf1225250b540254ac8a3b51e0274953a8b4288
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOYb:A3k03kB56rC
- TLSH T12E157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 930KB
- SHA256 bee28e93788efc6da33bc7fa6d971dbc9e234e2cd6bf016e029338829052bebe
- MD5 c000b9631ffcb3bdd39735b1583d558d
- SHA1 dbace3f26b4143906ab861b51004ca0f6261a778
- SHA512 3123249a78000bf4ca42fe54250cb744bd370a30ce6e6fc6fe24099cda65a5a35e8a019faa7e97b06390b7610c98f48f4e988f34f66addc1f4d6ab48e1ebc87a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOGf:A3k03kB56ri
- TLSH T13B157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 930KB
- SHA256 7cf21ff01c163abb8d943e3035e4c7893ebe3128bc58fe0e7946e4dcbd3ec800
- MD5 7d506539d2cd544efa95bbf06b280d99
- SHA1 8ef2f3666dbcc79f5766e28478755fdc250f1ace
- SHA512 e7ceed3bf5bee283dd916f1bf667cde0c12d4ebc8c749bede4832178084e3a24f4155d99d9265a14497c80426bce37be864da1f006673185b6cb6c65eab4efa1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYODK:A3k03kB56rC
- TLSH T186157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 930KB
- SHA256 d9eca4a65e93cb1c3946377271ed441157bfe786e9972b7758ddb1ba7b9e147b
- MD5 05692e713865a71caaea4c0ff404cab5
- SHA1 ff561d4018de2839b9d84b6cfefcfab35856651e
- SHA512 d9bed911733f0b52097ac907f4c71ac3a65bd27f015471eb117623d7554e320907334ff975eddbe2bfa28f200664020aac8c7713b79f11f88fbafdff4922fad9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOkk:A3k03kB56rX
- TLSH T154157B03E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 930KB
- SHA256 7860959c6c84db84ab518e78da83224ed512d2bf9b0f1a11012d0ac30cba9ea4
- MD5 7325b2bd3556e8c2ced6ea057df5a020
- SHA1 d23ccd8e5f0d9f94d2cdd4b710e6e4f5ec9d752a
- SHA512 3c12051ad153b4e89e90f6e0c0a8d67a718d22249bd706f613d6c26dfddbb81c9c721f2f3917653402c21628c63a7d86af1574180c346c634398380d8962ed5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOt0:A3k03kB56r2
- TLSH T10D157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 930KB
- SHA256 d535457b01c83b4828dba4d1bcd27e9f90af5fe697fe9994c89bc1b0d38d592d
- MD5 3703908903751e78d943de05f73749e5
- SHA1 a085a33e431e33aad71c08375cc801bc006f7b6e
- SHA512 8dada668b0e9eeae1d3b1c41693d51afcd086554b44dc3e5fce8eed6b6f2671a0b93902734adaf325c752f88fe1f5ec7d3b0ab466e078d0c211e25f997b1eb59
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOwg:A3k03kB56rP
- TLSH T107157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 930KB
- SHA256 738d21b124b1479672e0ee45022f12cdaaae901b7a19f712aac09ed8ba67be0c
- MD5 7b5af5b8297be567556a3337eef7c14d
- SHA1 cc1fcff385b631f42852c59fe0e3f8157ce57fc4
- SHA512 b7acc55a5420fd4f645906d397d30f45c716ada131a1bde463804546bbf57c230b88d73df64cba8f84d27de940331b5eb96b9c926a7ea109320a7ad0f9d0410c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOFr:A3k03kB56rp
- TLSH T180157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 930KB
- SHA256 8b9b1f9320e98003471215d43611af6c521e217f02283d54d6c6eac14b6de6f7
- MD5 cbb93c58258465eefc120bfbb23d44b1
- SHA1 f475fc7c5a52afc942bc4ccffb41f6d56f4ff54b
- SHA512 d15bdcfe79ed6b125972bb15482cd4fd503ec5a25224273342654bb4fb943ba2011e793b8ee442c1f89b2d1213dff6c5cb7cc5a1e88f53ad5921832fa711dea6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOPn:A3k03kB56rD
- TLSH T124157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 930KB
- SHA256 f18e9b5d0315e959293948dfed8a8d5ffb139e598241d4acb26955d72442f7b5
- MD5 b4d2bd3cf02348665473e0c51c98a42d
- SHA1 566e4de98b5bc050c5426bfa5865e34f925f7dac
- SHA512 de5974c6620e2bc7a9eac19de6609d05f168ff5e16b54f8144f11ce44a55d533724c1b8637c63f80d299ced76b6236d4957f293f758e2208ff792bf2b6e1a3a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYO7x:A3k03kB56rh
- TLSH T196157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 930KB
- SHA256 dc0e0e9bd86709cf079e242929a05c1747da4b148a792c496cf558fa58a24fb0
- MD5 a68566474c62752c49a64bc77f7a0b5e
- SHA1 d80ab9a8f8c5ac1f119d226d2277557283ce296d
- SHA512 f11b2932b33988026770be0884c418077d82464e7c6c3c7ae4cb71a3dc940d02a8ea5e0fd0bd75b8a9d825bbf33d34c2464f91dab62f3dadff2d20bc76f06034
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOpA:A3k03kB56rO
- TLSH T1DD157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 930KB
- SHA256 c254b815eb8cc58d9075337a7e22d192af74025024de5b2479149be48e78dfc2
- MD5 2aa84a6bc03119041932941f5b85846f
- SHA1 4ed77f90c058a977945f29205bdf831c35e17c12
- SHA512 5e408ed897b6bb63f79ba2a1dff39d926d0fe475ab9697fcbbb9a16908bb3032651c7bb1b3468e9d5e6131acb0a3eb59801b4878c2868abe5b9ebbe8aceeb77e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOi9Q:A3k03kB56rT
- TLSH T17B157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 930KB
- SHA256 309b1098ca5568b96c3a026253b39899df93de80c6cf2b917b4d3e5c73e21154
- MD5 b1da5e4021ff25b3500edd29459647b6
- SHA1 60bd050c0a12cc14e5ab6f90828398cab3e8460f
- SHA512 9ae567f0e4a79cee321c7cd70e26a129ad5d1788ac0273ef7878e8b835c290f9070d76448eba0c141937d9604b752efb42ad442797f8b0592285cf78cfa97154
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOH4:A3k03kB56rU
- TLSH T1B8157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 930KB
- SHA256 89cedec0be11c9a974c69792b224693c6d707253ba65f3ecb37e97da964fbc65
- MD5 35d04f19c57a16bdc6eefcf01fe8e8bf
- SHA1 d085551ce1e34a4105a49af2b6ff0e2b970ee203
- SHA512 27e031b0960317fc3b370966d6ba92853a21a3f80ccbcd7fb043f9e43dc8b9d0cf2cbc93dcc899b4fbfe9ccf6a5c64531de330d8d6f8eb94c8f456bad82889ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOmu:A3k03kB56rF
- TLSH T1DB157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 930KB
- SHA256 f1d214620d1b3553e3704c8efe534707d5a9bdaea177b69ff4900fd2a47d7a7a
- MD5 990e57985bee48d3bda5cf835f6e492d
- SHA1 f43d3ea797680044e399cc1d3281efcc995d9903
- SHA512 151f6a5b3f216b649bb2abc431d74102476294c8cda755740c269c385e701be416eac25e042c3323e96c3c1548e8b9c2ebac8066cae4a6c3156a1f34b971bad3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOXj:A3k03kB56rH
- TLSH T163157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 930KB
- SHA256 8f447fdc6fccf809d1193fc7efd7dd4af6960f1a5d516b6f9335d07292abf71d
- MD5 f10bcd880f55aab97ef0852c604e8528
- SHA1 87101f83560045653bfa6d99ba10323800eaed18
- SHA512 6d44d41b9687b8205532ae4e9fd0ed90a1929428e38636e74170612f3f6330f561ce4ab406158be966d4ff8c8075bd8c51d09030421e8c1c7d34b94b386112c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOCg:A3k03kB56rv
- TLSH T16C157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 930KB
- SHA256 7346bd02698fb7a3f4dc3c7c470f23ab7f73d0dc3ed025d1484a0fe0e81cbc9a
- MD5 fa944b0475dcc034df195a7c1fa12872
- SHA1 244a55829ae8dca26c149de42dd74638c371ccb4
- SHA512 080204e42a60695a70c8e53c38618c692fc21cadc0863e38a3292068ab58fda1382a856d482c9339de6ffedb606363827d9ce7a184d0a2e8d9413ca59352c526
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYO9I:A3k03kB56r+
- TLSH T135157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 930KB
- SHA256 23607d3a4658db882628c4465604eedd9380d7e42f999d9648f14eff94e3f803
- MD5 8f0be2495afba661960ae702334d04b6
- SHA1 189bd1435fd3cbc21a2bd232ec9ddfac268a98e2
- SHA512 a29643cb3e416fd9852db914ef1aacde69d5c9662e282244576e0172c768b2f846f1f11a7f4f9a2264beb07d139a5fee5b55ac695548c68bb50c3c4d23e02764
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOvo:A3k03kB56r8
- TLSH T130157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 930KB
- SHA256 307de84942c8acab8dbda9826fe7c4485c2898c7b2365453a8308b6fdb7da629
- MD5 8b854e11cbbe2b391a6c79d23b8ebab6
- SHA1 142e5fa55604a94ab5a4c6fe17fd8226e9a7f4cd
- SHA512 7aed367c9eb084685dc45187c13b5144dfbfc8d6f3fb705b8c65b822fbbc30cdd1b05c5e453afcc202f2a3c67d72f8ebbc17989d18ec96a71037dcabb224bb89
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYO0+:A3k03kB56rx
- TLSH T12F157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 930KB
- SHA256 353a4bf836ce16bf6a469d57a982d87d417b3c8cce18a6583feea795010c7f89
- MD5 b11bc2ec521bf024cadb338492bb4b79
- SHA1 8c2ad47da020df2122d344776b0859ea42bbc8f3
- SHA512 4e6214c87c9aabe6053c9f9365bf8d7dc23d79d1b273beff73ca559b3223451efe3dc8531f888f7803c68825a39fabc8c126fdf0291903b5f232bc72bec2d76b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYO8Q:A3k03kB56rx
- TLSH T1E0157B03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 930KB
- SHA256 0964464958483767a3f5e09fa584e78bada02f6cadbe8a7e5aa14107e885a903
- MD5 6725d64070298babdb751628585a85e7
- SHA1 291339c24c5ffd4a318627d93550e78bbaeb9879
- SHA512 064916d33ce6fad6cd76ea3ae1c5af5d67b5800e67423c598d1aa18e8c6f2e93ba21433467d2fdf17746f98cc434608f09c8f83b3226c7fa12bf03a4227bbdb4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOlX:A3k03kB56r9
- TLSH T128157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 930KB
- SHA256 1dc91458ec71840907d800126549bf603a3e03b559352a23a4b048ee13127548
- MD5 34ec147a9a90ecd47e5c45642baddf4d
- SHA1 7352253a742c5657850be3a7ae7f14eae4dfb3a3
- SHA512 59a513dee9a4146d8cfc43316e95b8d3f268483d2ada8447d15b38b3907d8c29accca0a020d22cb9facb2def46ecbd44ecf9d213d2eda0eea971bc1546eebc0e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOHL:A3k03kB56r/
- TLSH T12A157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 930KB
- SHA256 b41b11df6a48b510fa46d25e41edd2fea4920ab6e29c1263f66b0c5da069de01
- MD5 98854e11e8bacee3964eb0347f7b66e6
- SHA1 6a0b12efc6a2e10d0cdc9d6d89d390ca2662212e
- SHA512 f27425966291e838eac23af7d1163cfbe8432d3bc18088340bee3759d6a12296e2b7f0adf0a36ce19fa4380fbc86d10b589071d9c3f6299665ba14d38ab403c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYO9M:A3k03kB56rK
- TLSH T1CE157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 930KB
- SHA256 9a0dc0fb983425a85daa31b00bbb5c9b49f9e0fd417cf23284bc62052fe8d909
- MD5 3b87d39d6c329c6f04c6ad4040cd90e4
- SHA1 f91199dfc01af59947106d4bb8ff58c2be4707e9
- SHA512 2ec812abe162b32994fe73e458baf981bf269ea6636eb763f487582e0b069987ad5612ddecc589ee32d725c88efef1fd54d5ac8bc238d3f8154cbe663874f6f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOuh:A3k03kB56rE
- TLSH T13E157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
- Size 961KB
- SHA256 9e3fc16ddd6a92de133473cf585cddc3b332903f4e8ba5da7a67276c886a71a3
- MD5 b230871b4bc8eac592131066dd6d5975
- SHA1 15297358c1eed90585dd87418ae2b3bdc13e5d35
- SHA512 cb49491e0728efed3dbbc95744d0fb47d7ecaa829ac3d300e691aef55be1e203e940ee653f81ef928fb07836bd7e3bf34734a01351706a4b9cc1479bae33c802
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc2+:A3k03kB56rl+
- TLSH T1B3257B03E6940FA5D10F81749A958A72EA777C421F2097DF1354AE253F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 967KB
- SHA256 8c96fd48117179b68464e5ff4d32b71f997ff656e254dbc5ef56b5fc7dc80647
- MD5 84a923f1118be77c9c58056a8c666942
- SHA1 30198a9204142370c786d1fa8ef0a08c2fb81b92
- SHA512 b120345a32469905ce65331f881439fc0afb34adad42957b7921b2bad09639e189e37d2bb57c687fd7d815665f36fda11fb7a895df57cbc88f02c73cd7f47ec4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOj:A3k03kB56r/
- TLSH T1C0253913E6440FA4D10F913096994662E673BC0A1F6093DB177CAE253F36BB07A3D66B
- MD5 SHA1 SHA512 SSDEEP TLSH