Analysis
- max time kernel
104s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 15:53
Behavioral task
behavioral1
Sample
2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 872KB
- Sample260809-tbvr6a1dkf
- SHA256 0bc6f05d1ab4d16a91b0c564a7c1a80ff8e48edaf03bcc6dfafba47652830324
- MD5 dbeae6afce3bf987c0c40a356635e2a6
- SHA1 d65c54311987f4f12363407cbb6e5bcd43fe320e
- SHA512 b97c519b2c268cf3a648034a6c4e3721336f115b9176549b35ecbe8f43ea5fe63315d951b2ff26660401c3bdd7fa8b9196074e03d4fc06c95ed5e668c6caacc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/:A3k03kHRJi56r
- TLSH T14D155A07A6890FE8C11FC1788A968662E7737C151F2097DF1354AE253F72AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral1/memory/4448-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245f8-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4448-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2128-28-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022be9-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215f5-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235e7-128.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124a-280.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124c-449.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001c00000001f282-498.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124f-517.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002124e-603.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021250-629.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021251-648.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021254-733.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021252-752.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021255-795.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021256-802.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021257-833.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021259-864.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125a-883.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021258-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125b-905.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125d-918.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002125c-937.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125e-962.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021260-963.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021261-1018.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021262-1061.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021263-1075.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021264-1100.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021265-1132.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-1151.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1176.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1189.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021269-1196.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126c-1233.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-1336.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126f-1343.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002029c-1511.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024613-1596.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024625-1739.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023125-1873.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000072b-1923.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245f8-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-11.dat aspack_v212_v242 behavioral1/files/0x0003000000022be9-41.dat aspack_v212_v242 behavioral1/files/0x00020000000215f5-60.dat aspack_v212_v242 behavioral1/files/0x00020000000235e7-128.dat aspack_v212_v242 behavioral1/files/0x000200000002124a-280.dat aspack_v212_v242 behavioral1/files/0x000200000002124c-449.dat aspack_v212_v242 behavioral1/files/0x001c00000001f282-498.dat aspack_v212_v242 behavioral1/files/0x000200000002124f-517.dat aspack_v212_v242 behavioral1/files/0x000300000002124e-603.dat aspack_v212_v242 behavioral1/files/0x0002000000021250-629.dat aspack_v212_v242 behavioral1/files/0x0002000000021251-648.dat aspack_v212_v242 behavioral1/files/0x0002000000021254-733.dat aspack_v212_v242 behavioral1/files/0x0003000000021252-752.dat aspack_v212_v242 behavioral1/files/0x0002000000021255-795.dat aspack_v212_v242 behavioral1/files/0x0002000000021256-802.dat aspack_v212_v242 behavioral1/files/0x0002000000021257-833.dat aspack_v212_v242 behavioral1/files/0x0002000000021259-864.dat aspack_v212_v242 behavioral1/files/0x000200000002125a-883.dat aspack_v212_v242 behavioral1/files/0x0004000000021258-898.dat aspack_v212_v242 behavioral1/files/0x000200000002125b-905.dat aspack_v212_v242 behavioral1/files/0x000200000002125d-918.dat aspack_v212_v242 behavioral1/files/0x000300000002125c-937.dat aspack_v212_v242 behavioral1/files/0x000200000002125e-962.dat aspack_v212_v242 behavioral1/files/0x0002000000021260-963.dat aspack_v212_v242 behavioral1/files/0x0002000000021261-1018.dat aspack_v212_v242 behavioral1/files/0x0002000000021262-1061.dat aspack_v212_v242 behavioral1/files/0x0002000000021263-1075.dat aspack_v212_v242 behavioral1/files/0x0002000000021264-1100.dat aspack_v212_v242 behavioral1/files/0x0002000000021265-1132.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-1151.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-1176.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-1189.dat aspack_v212_v242 behavioral1/files/0x0002000000021269-1196.dat aspack_v212_v242 behavioral1/files/0x000200000002126c-1233.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-1336.dat aspack_v212_v242 behavioral1/files/0x000300000002126f-1343.dat aspack_v212_v242 behavioral1/files/0x000700000002029c-1511.dat aspack_v212_v242 behavioral1/files/0x0007000000024613-1596.dat aspack_v212_v242 behavioral1/files/0x0007000000024625-1739.dat aspack_v212_v242 behavioral1/files/0x0003000000023125-1873.dat aspack_v212_v242 behavioral1/files/0x000300000000072b-1923.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2128 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4448 2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2128 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4448
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 872KB
- SHA256 0bc6f05d1ab4d16a91b0c564a7c1a80ff8e48edaf03bcc6dfafba47652830324
- MD5 dbeae6afce3bf987c0c40a356635e2a6
- SHA1 d65c54311987f4f12363407cbb6e5bcd43fe320e
- SHA512 b97c519b2c268cf3a648034a6c4e3721336f115b9176549b35ecbe8f43ea5fe63315d951b2ff26660401c3bdd7fa8b9196074e03d4fc06c95ed5e668c6caacc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/:A3k03kHRJi56r
- TLSH T14D155A07A6890FE8C11FC1788A968662E7737C151F2097DF1354AE253F72AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 925KB
- SHA256 a60ca941cd6e555c2473c4d27b3109e313e3176e6e1406174d5b1329182185af
- MD5 24414d8f7eef20f6a0ef5a5a6ccbad0b
- SHA1 ab4a9b29911855fa8bf7b498840798cc38d64fcb
- SHA512 4c824df636be9d55522f44e66fea60d5452fb0094c5babaed830d3690c5db1f5410afef9e93651907679f15ffb5e9744a85334c2b8928cee407b2e702eddd7ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/6fj:A3k03kHRJi56r1j
- TLSH T1A6156B07A6890FA8C11FC1748A968A62E7777C111F2097DF1354AE263F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$
- Size 993KB
- SHA256 43b16a00ee44766bee55cc1c5486227f85ca8669d6c0edd4a9af2bcf59ae5b02
- MD5 24422052baa3a59902020ade5210b433
- SHA1 599b0473e0d9c7ddd7cf7fcecd3a10110ceefde2
- SHA512 c9a9dce0a5142958035b1725fc9f6f6b073f77207016cdec02df43c70dd833dff93b8971d49545205130f6642a89b587003392638ce65367b8750ac216523586
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/qGen:A3k03kHRJi56rkI
- TLSH T1EC255A07A6990FE8D11FC1788A968A62E7737C110F2097DF1354AE153F72AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe
- Size 971KB
- SHA256 ea66b88712b82b60ab1fcf0cc2fb1a7f916d6a4c24b04edc922b16cda9def0ca
- MD5 700953b3411b21c9740d86ff16a876f2
- SHA1 563c49aeafa26e67439860a3c77745a74eea7d2f
- SHA512 da16566bc99a8e4d69a2704f7eb444f28a78b832c00c32abdfc9bc8769099fdc497957ad9d4f5d0b5f55b2c8cf0046272223355334b26e63075f039bc88ee41a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/LUwjBXG:A3k03kHRJi56rRwFXG
- TLSH T149256A07B6890FA8D15FC1348A968962E7777C110F2097DF1394AE253F32AD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
- Size 971KB
- SHA256 69edde80a9878fef9359f9d3eef1e94ffa31f9a1f99c79862f71619013ecb671
- MD5 f0a8f1b558ae52cadf510e5933ca0a24
- SHA1 16704b58a9e7d97df5a45eb7450b53e69f710acf
- SHA512 c808f2da945f8dfd905d81402bd60b3ed8285aa0783e542b0e8bb889b1835b545590f6d0c4f8128124699ed462c1b44a676bd6d1aecccd09f62371dcafe99546
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/lbBPzBAU:A3k03kHRJi56r2BPVAU
- TLSH T149256A07A6880FA8D15FC1748A968A62E7777C110F2097DF1354AE253F32BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 987KB
- SHA256 b1b64fb519c66831739e532f4ed536e06c1e8d89bf7f5165c777b078187d8f7a
- MD5 33ca15695296b0d5d6a00d9348a083fe
- SHA1 e12f9065d7ea4fd04ac746387946da0ce1bf6a74
- SHA512 81b5bbef68ec52ddbd803435aac8bfb07133887688ff25ddbcd322cce73d03ae322c429f9a2cac00ab9b588221542887fc9aa28270c98708c8e66b00d9d7cf5a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/hTjE:A3k03kHRJi56rww
- TLSH T138255A07A6990FE8D11FC1788A968A62E7737C110F2097DF1354AE153F72AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 ecdf832ae4a605342711a233b3ceefe82d908a55ace91d7398e8c88f9b82cd67
- MD5 18693080f114cf3fd072678f987aa350
- SHA1 08f7e35e8747802ba916cf3e85223ebf6e57a883
- SHA512 c3c3e5027c074ec9fb211d02b2b25ccb3621cae77f000b992f1fd1e4b9a1d8b615f4432573a758ba9f0d2ffc338ea5128c65dfab666c3a940832bdf67b9151df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/P0Le5ji0hmxNrM:A3k03kHRJi56ryPji0Aj
- TLSH T129654B16F6A44BA5D06FC078C5D29666EA733C410F3097CB0354EE293F67BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 887KB
- SHA256 855d736a6d178d479b1092955697c575a2f5b5370d023e8fc9203d330b510621
- MD5 3cee9a87fa65279c2d39179a43774406
- SHA1 e379b481fc662d409dc2c63d3b2e7a7cbfc4c104
- SHA512 9a97df8fd909e85930b7236456a105be69a47bd42c94109808b65ed34410ddeda0ed84ec22905a0c0b86b98ce164c05fb9b2d1406a230faac9621a6d40056275
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Ra:A3k03kHRJi56r
- TLSH T1C3155A07A6890FE8D15FC1788A968662E7737C110F2097DF1354AE253F72AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 920KB
- SHA256 1ec55b33616db2e1c6e119ad88545de067388946f4964d02cc61bfcbe3e891f5
- MD5 56f234e9fe8cca3e24ea676ceefe67eb
- SHA1 7a8329658561e0eadb180eb956ea9ad2bffb0744
- SHA512 25bd025f4d78dac24da5a3b4a3f846f746aa1e084191208afe00b46b1e3876997e7830bde1c958abc357c5220bcc3b2f176c28b4e2574ed875ddb75214f6fd2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/yb:A3k03kHRJi56rXb
- TLSH T16F156A03A6880FA8D11FC1788A968622E7777C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1016KB
- SHA256 e0c8d362f1b29402477455ba4411cc8d9f1c94caacffd6d9eda1dcd7519e160e
- MD5 1576dfae83348214c254082caf95d7cb
- SHA1 26b76c27637c223b1a9fd68ec09fa4b7fccc143d
- SHA512 1fb419cea3c869342e12e6a6a374073303c0852cb082e6ff6030377cd2ece25c0a73fa2f8d8f33fd0435b756e0949dadac601da8812610f15769f8d9bfc9a966
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/kD:A3k03kHRJi56rv
- TLSH T19525F506E2980AA8C15F8174C7968662F6737C154FE097CB13D0EE3D3F72A906AF9653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 896KB
- SHA256 5c092172918f4412e583f597d2b3091c576ab609d23ec7a15eba910b619a4517
- MD5 72579f3b6bc8c2584b8306329a78df17
- SHA1 023b4d1ca525e41b818822cffab3d698778b688d
- SHA512 527ba724032067d49047837a4eebfea2d00a43208ae6fc58b686212e8c21bbf902c459988ae573adfe9e95022ef0f6a9c4d2b4de9d61d5690d7ac2893d9ed0c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/g9:A3k03kHRJi56rH
- TLSH T1FF155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 896KB
- SHA256 57feb35755f9a8e90d17fcd967b42402290c54fb6bc069d542ec14fed87738a2
- MD5 01cf2901d4200cae3f40f05883343ba3
- SHA1 5dafe5bd2f13697a82b01988c40f53ff5e8014fd
- SHA512 38f9d4dbe32c19fd2d780c1c68e820ed1ae79fec49fd73b499686ee8ff266cc10c8a41a1892d980702c68d6f6ae5126f7c80394a172f68016d5039ebf15aa50d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/oc:A3k03kHRJi56rW
- TLSH T1C3155A07A6890FE8D11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 896KB
- SHA256 79e6f7404d83bae215a499eb358fd9ae01751aa2e5822378428d2b6c297786d1
- MD5 c50cff51963fc79e2fdee1dcbee27f66
- SHA1 56f8a517b453f1571bcca743ac3460fa27ffc88a
- SHA512 0d0a7f261b99804c087ff8fe005d2608e37c7167c33d6da59de973989775cc71756279842859e29a0157edcf465ae8cb823b0cb72345fa905e5a45fb3825c825
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Bp:A3k03kHRJi56rE
- TLSH T1FB155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 896KB
- SHA256 725d5d2c66dd8294fac6fa72bdcd9193e9e1f17c8bb83bb971f09eab347f0fed
- MD5 649ebd7c68586b1eb67f3c8e131f9dcb
- SHA1 9fb1350c0caa762be358a57dd75354ae802920f1
- SHA512 66e73d38a3385b37d10aad0c0fa791e2f5bc2cc1d279a880a8eff5fc0477891d34bb72c6272b1db1d4a2820c78bddd122e16b4f54e63c7bb4d05f598bc649e7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/WN:A3k03kHRJi56rz
- TLSH T162155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 896KB
- SHA256 3ae1a92b4e15a8e1c390b743516a6e2b69bfc0c7fc3db65a020dcb6c90b0d40d
- MD5 35deccd0c3047d653bbe4618898ff2bb
- SHA1 303c8af06fc45ed9e25009d2151c6d9f4786be53
- SHA512 c152ee59b7bc8db07293500911853e27ba900b33bcd70b869aeeda836799735a2f29617bcc762333048fafecfef43c8f098a702e02e27a4b093dae4fbd3d8060
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/aF:A3k03kHRJi56rF
- TLSH T15A155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 896KB
- SHA256 0c4ac9c1206769b57b93bbe9dd3ace85903cc8f20197fb67abed140fada33723
- MD5 c852e82b12f1699df5a072eb3a703afd
- SHA1 d5db8e5714a43406d7c28c901ae6746ab5dc3048
- SHA512 f0b67e2f301aa0450de1d54a8725455fb57f69061d975120847d74fdf684ddfd75325786647324ce330abd5cf0e1e4c16ee8ca5ba88bcfe577e0c86712416770
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/vC:A3k03kHRJi56rp
- TLSH T190155A07A6890FE8C11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 896KB
- SHA256 360cda1fd893a922fe43759c5921b1ded4dcbaec5513576af087a67ebdbc91d5
- MD5 3fac635ec045a6b7792b01bb8899defd
- SHA1 4d3529f2ab93af68337db32d2e56d411dfb7a8cf
- SHA512 cacb59712975fbf0bf67699b57ed2dff252a3a4d4d800aee8823d010250ddbb9750f74c987b840927a4231690a522b22caa8b28a77c1c9f56c68e83d3c89156f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Qw:A3k03kHRJi56rU
- TLSH T179155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 896KB
- SHA256 e7523647a1438e9caff510641ae216a16375be7d7269f1f9b23d0cf73ca5d70c
- MD5 d0f792ca20a1693eb4e17bd56609f7a1
- SHA1 de05cd3fe9e3c63feaedd3684458e852972abad7
- SHA512 4b7543f67e112fc5c04fe29d8e789134f158a59e60e5ca66baf11644609cd05f433634f333d062a73f5cf3a2fa6b905c707d4e5d1a70ecaeca4feccc171f0d0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/vT:A3k03kHRJi56r8
- TLSH T1B3155A07A6890FE8C11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 896KB
- SHA256 e0dd7492ac58b4d15c0fa41fd9b6271fdeea09568869451bf148456cd8207560
- MD5 52ac7fe0caeaa61ffb8559c790e7d971
- SHA1 e1e1440c0d819d5a1da1872201f4d7994045577b
- SHA512 77ae69654a18a0fda4d7cfc16e417b4e6990076e63f0a5d8262d3e770f3053d10a0e93fd2e7d2fc31cf242cf2d147c46d80a559cc30feb06f8d0f4e593e50920
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/pu:A3k03kHRJi56rb
- TLSH T1DE155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 896KB
- SHA256 7ccbd1454de2d693b4949fa1f3be3c1087910b20f659d119a8d17f92aa3f2ef0
- MD5 93afac4d8c32d5dff87e32cfcc86bed6
- SHA1 6a1906de8c13a4a4b7a09da9b0b15df3b2740fca
- SHA512 46a9953075f491b5f23f802af02660dfa03c2af3a03e764c71260791ce5fa7e994a300bc6e155296d26135202aa7636cd86c19681d4bc3a286593a5e7cc66ac4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/hb:A3k03kHRJi56ry
- TLSH T180155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 896KB
- SHA256 aae33fe75a10a0ce07ecaf7629e9f621cf8ac0891b406e0be666df8be32e419b
- MD5 736cfc7c9871b8bd486da9927ca521dd
- SHA1 9919f7b0fcd6d73534947245e5d66ab8425a88a8
- SHA512 b7f02e17c477a3b42e8ce32237068022a2f0b4f249b79954771271d643e9f94c1874f06885eaa741d6ede6b4e9f5ec3e78c01e8639f4f47c4d5aa8b101c39c6d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/pf:A3k03kHRJi56rS
- TLSH T1E8155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 896KB
- SHA256 9588152f8035c0c203b37a8c922d6658b171f7c9c1087afd450b43ab411cb65b
- MD5 28c95ad7e592d3ce81eee51f7d1042be
- SHA1 ed70bc17850718141134e80508b107ef8649dff7
- SHA512 f996768c2c26b157ed04cbd797b7d8719bb309f7265b6dbb3d57d08a5846359ab2dd64c78295f456f4838818935ce6a385dcfbdc3ee2eaeb41fefda0192e5c90
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/SK:A3k03kHRJi56ry
- TLSH T125155A07A6890FE8C11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 896KB
- SHA256 4bf7c898deca940f03bdb536d9e09e405956fd5f5b8835d6e7270a187ccc56e1
- MD5 4b7af17b895e9dec2cfd4c84e53f4095
- SHA1 fcee936038079ca5768bc22102159ceebca33a08
- SHA512 c51f791d589e669253c5abd43699495e5bac543c48e45a716264f69a430376b452d8c4fbcd27fabb2fce8cdcb5135dabeec3cc6a52259aa39536ed9e8398bdfd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/3k:A3k03kHRJi56rH
- TLSH T101155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 896KB
- SHA256 4cb5e79b80cc853c96c268e159acab9bac67ad599bc3f8f1918c734dff1e40ed
- MD5 cb7a2df2a60be9029806a93e607855d6
- SHA1 ef98ed6008719585b953b894aad88bbee392861c
- SHA512 7a7cded176eb83f2da36f1ada01959c774e4e594c30ce3ee46f96cd857a4cc74a4001b3b7fb4c5780ddfc63b09b509b36b72baca6a43f5007063e9612275ff03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/A0:A3k03kHRJi56rG
- TLSH T1EB155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 896KB
- SHA256 240b78f4ca983b962f90efe3749aad07787024bbf293780d70513baf083dc9d1
- MD5 9f224820f33020ad5cefbe298d954030
- SHA1 a85592af26e30fcd6acab6cdb4a36732d5acf5ae
- SHA512 70acc9e66d8380af599dc5c6199eb12f224a24eaefc136d76bdcbb02d124266b590757ea70b5ecbf27d78c5c1fae17903b6d7bea4ae4684ae3154de94f035c61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/bg:A3k03kHRJi56r/
- TLSH T198155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 896KB
- SHA256 6ab952dc08c52a65d1ac63a2c359888eeb85138baa426a08729c029197ace6a6
- MD5 3b29e24b2efdc312a83d5214c891020a
- SHA1 bb0497d782162c65e8334460df6d631e83e6f6fc
- SHA512 fa286173f3397168ebfb727557bef31c7bd8f6ac6746d1d3e5154a8ac1e3454a30b6fb1cb4010ac70c018c42f915187e54d8ddb69f617802d8c69a3ba713b3dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Wr:A3k03kHRJi56rZ
- TLSH T179155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 896KB
- SHA256 c028dc328057aeaec5043277f2f7ff645414650bfae46d73927d3152426e3e97
- MD5 4c0e0ec50db7cc58c755abc9cf8e00e3
- SHA1 b88dd94f2bb19294b41740300ccc63803a237577
- SHA512 454baf038d409606037d28db02af24ca1a58ed6faea5505b3a413da695e6904c95473fd69a295997963fc2f3ad4768a25271c7b787e63ede1291a77374ea7c86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/8n:A3k03kHRJi56rT
- TLSH T15E155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 896KB
- SHA256 3d7ec8e7ceb0ade58f888eae9a81d1de96eb48fb9c655f599ed0e596298c4968
- MD5 ee6f84ccf790b75cad1e709e38d2628b
- SHA1 6f557e49d6c40f2dbee02d7fd7495fb85db30538
- SHA512 5a1da8a91822e6ef625664f14e49313beaca1eec9643cb0fbd2388a44c5df6eaeeab0c1035a387c9d2d9be54400ae31bc600d1c3e82990a7a5516c32ac779766
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/6x:A3k03kHRJi56rR
- TLSH T119155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 896KB
- SHA256 ea66fdcb64e1775d4b39b713c0f16667404770dbfb1932b915bdec632d3e998e
- MD5 4f21b939344bb488ca8dfe8632c721ca
- SHA1 b1916cd8867f612f03b4bb9c28f151af8d9831c6
- SHA512 b245f57aeab9234c8eee6d54ca9628afafd1c89476f79f727646363ebba62d059177271c135c5b2b41d55bbf602fd6b896d1bf7b32ca4fad79e0b331822702b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/8A:A3k03kHRJi56r+
- TLSH T162155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 896KB
- SHA256 10fe30934b4c6c7bfd2c295fabfd5acb38576a862625dfe2522077e1e197a41c
- MD5 6e572a3aa32a5706cdeece52fe284d06
- SHA1 c6e8a21dddfdbdfae37ce25b3dabf145b46f2887
- SHA512 0dbc845c0b76d8743df45579e497b8adf53b72e4b275e4286bfbb46daf323f4ad6f9c1378613ecc3987e57dec6785a82dee28479b6f41d69c2c79ffed28a53df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/l9Q:A3k03kHRJi56rj
- TLSH T14B155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 896KB
- SHA256 c4b90a72f7e2d4695e70c3787b2828080a5b5c504bf7e2cf0afbf3374195b207
- MD5 91a3ba27799a5f075ee9fcddbbbe40a1
- SHA1 e61ed4df4cbe0c806a3d3ca816ce9c0c1a2633b1
- SHA512 c963747f2e71058740ef3b29bf5c080bf062fb464ca07ff94d843b3cfd3e6a351db69694e9d42f68147ac7e8f6dc11d02076e1e93900c45848f2e61b90ce3168
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Q4:A3k03kHRJi56rE
- TLSH T14D155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 896KB
- SHA256 db4b6370a5bd235c8c74aab848677b4814e547554fb7c7bf8e09469747fdea15
- MD5 9796fb36d54197fb4cf41f789339a887
- SHA1 c8a17f14a60b89f3d6f5760c8b3ac852bc3db675
- SHA512 51a4a6247a26e29fdcb4dd5ffa83623238995755230991c274b2a3002c45ef2ace355fdc3bce93f11782a6f5ad74b6b505aafe9caa44d1390ab8e52dc641e5f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Tu:A3k03kHRJi56r1
- TLSH T192155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 896KB
- SHA256 923d9aca341ec7962bbf038b8ce13a16025968c3490254368ffded3c229666f5
- MD5 f84878a8867689d54d9a66bdb1eb51ae
- SHA1 7f64e18a26382d73e9538f7c061d092d56b66f8b
- SHA512 8a90181e1a39642e6c3dcc4e9f3bc2159d96a0b0c8e6d0a52dcad68035adeb53193def67130db29470bd12f2b22d1c5044843e5a2ba95d84ccc33ec369db7661
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Oj:A3k03kHRJi56rX
- TLSH T149155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 896KB
- SHA256 19c506331c81699f0d7606fc18739706adb35370dd9082a6af3a6e961ffb8f4e
- MD5 3b6fb868aba0b4e7c971c42c6ba0066e
- SHA1 644d4900f9deb8ee2db48300c783a5757e32c673
- SHA512 2a02fdd1cd7e9ad5b536da27832affe1aa169ea8f9d757d3b3d84b24ac64977901b88af773e3fb86762a8157d8f596caeaccb5f3dca163a940efd409aa3cbbb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/7g:A3k03kHRJi56r/
- TLSH T159155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 896KB
- SHA256 161cb5596aec924ee2e5f92f08106b9eb1a3ae925f8fc370490b6e3772bb3d9a
- MD5 75c2a48461d62bf7b467dbb6cb3c5f3a
- SHA1 8950104a0e009420281497f4ea88c6d8d7a39662
- SHA512 ce26e57ca993b32b1423522741c2d46db071eb7ce844fea41531da09cddf5fd5eedaf2d50c7a9756f9b5bcc765c43b85ccf8c260c514dd8a019d672c6ff21880
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/mI:A3k03kHRJi56ru
- TLSH T1A1155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 896KB
- SHA256 de1cffdeac7fa5a2f6bd5676bec6f7fbb28fc650ed52693d05e75b232fc7b750
- MD5 04d68ff048fb9f0273d9c18932e2a715
- SHA1 e63d428235c04fddbc7e8bd1747b8d319ced510a
- SHA512 d9cce5a1a8c34709a2c95cfdb888538522bd0e9385c8ccc63b5e4151b8ee912f3d33863df81602a31731794ba3e6e02b675085a6c27e02858547b0346c360aa4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Uo:A3k03kHRJi56rs
- TLSH T1BB155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 896KB
- SHA256 9d0b52d534b63f89cb5237999792eba494cf5edd268864d9d227db96d3503d54
- MD5 ba8ab4d3bd594b635d867224654cdab9
- SHA1 de3604cc38b70b4df2c2ddb3df8eff1531c49d1b
- SHA512 cac2d19671fadfae2fd9d3014d2cd1c25f2728266920aaca23c3c3f6edbbd137689a3d3bae506deac50acdef4a7dd5d4824e10644c8bdbc1fbf479cae6f1f961
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/3+:A3k03kHRJi56rB
- TLSH T1BE155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 896KB
- SHA256 d6b7e1d63383cb32937d8f6f96bac4e9efdc17a5767111faf28c40e6e79e902a
- MD5 071df19fdd3083923573e2e2b4ff5fe3
- SHA1 6977436f7bd3c883dfcd1f2e7fbf5eaa9cc92f96
- SHA512 9627826499a7982411caab4f4127f45ddee9e49342dfbd79bb1fea043d2690ee1e0e4d4f302506ae2137edb78bcc2aef2c167769b256c13ec0c253627b9bffb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/NQ:A3k03kHRJi56rB
- TLSH T1F8155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 896KB
- SHA256 736df094bb30102001e11445ccf62bfcae4ff29111d9292590c2720a05b210cf
- MD5 458257e65efa5a5f780cbcdd9eac7107
- SHA1 76c8d730bfa50fe7e217bd5fd756f361763986fb
- SHA512 b86738257b7d6e0c3bf97f791fde4b40ac2b09a66fb63d50e631898c9eb465cff46671f9b6bba9eea4ad681b52c992e0acebcb90732d2aa91d637f966e3b3066
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/CX:A3k03kHRJi56rt
- TLSH T17F155A07A6890FE8D11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 896KB
- SHA256 cd4a54b7b5b05649817419078c5199f7e265e1544e56a38412a3432047e38523
- MD5 06bf39fefb64f742d8df1998f48e282e
- SHA1 324a47618969e189c344c1f912529b05b84e89ba
- SHA512 7dafd236d63a65f997acee41b2186856aed5cd46b5e3250a93aa320f18ecd5cd82cb30fb00833b91432c1397905a40074c70cf255179a1e6a24303bc72e0a405
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/kL:A3k03kHRJi56rv
- TLSH T1C7155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 896KB
- SHA256 da2906e25c619eb711aad936ed45c92a48e0b57c9c55f326a6ba8a9e275aab9a
- MD5 78c669841dd91631da0bddb838eab7fb
- SHA1 6da24ae45a10f9b0a778f9dbd4eb15594d999faa
- SHA512 fb0148080a8bf0d8a662c50ad2af12b530903e58ea1148441943c80d99f4298a3e06fb3869c44f13f3be0b3ede86134be97e87b2d396d106d2cfb2baff6a783f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/AM:A3k03kHRJi56ra
- TLSH T1BC155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 896KB
- SHA256 28e4aa733e4a73d20ec565ffb50832ffd5aeb6fa2105f7dfa29da3ceb64a5312
- MD5 ed32ac1884cc54d2f553e02770a7964b
- SHA1 0f3c9a0a6d338aa84fd8fc6a3d040e4da1f3ec19
- SHA512 17f4a45e03af09d60ea5bfc852d53d48c9f5f0b44da352e66c500cd896189b54a93db57b0ea47beed56d03cf5e98e2fb38877def1a36339f3f4e8249e2caef47
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/hh:A3k03kHRJi56rU
- TLSH T1F8155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH