Analysis
- max time kernel
97s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 23:50
Behavioral task
behavioral1
Sample
2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 889KB
- Sample260809-3vjzfa1vbs
- SHA256 c34770b00eab37e9cb8248457613592eec33d6df7f918eb9506c1a2cfdfd5b67
- MD5 99a9afe34e80e2ea37a8765469ceaa7d
- SHA1 462ddfde7b4c0c539fa7f429855433434cb36a58
- SHA512 644db07dd961315a3d322d95d3427f8938e61287106542ff08175e39d84ac459caa27f621603782fb42960a12dd8eab90c3eb563bfd60d2f9ffde3df55513807
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA251:A3kMP
- TLSH T1FC15AE13DBA004E5E61A8130A9E50616EB75BD565BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/3664-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c58a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3664-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1704-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-35.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-552.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-613.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-723.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-842.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-867.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-925.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-982.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1042.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1062.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1100.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1168.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1321.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1400.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c58a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-35.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-223.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-442.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-491.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-552.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-613.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-632.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-723.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-842.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-867.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-925.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-982.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1042.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1062.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1100.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1137.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1168.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1181.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1212.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1321.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1334.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1353.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1372.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1381.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1395.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1396.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1400.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1704 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3664 2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 1704 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_99a9afe34e80e2ea37a8765469ceaa7d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3664
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 889KB
- SHA256 c34770b00eab37e9cb8248457613592eec33d6df7f918eb9506c1a2cfdfd5b67
- MD5 99a9afe34e80e2ea37a8765469ceaa7d
- SHA1 462ddfde7b4c0c539fa7f429855433434cb36a58
- SHA512 644db07dd961315a3d322d95d3427f8938e61287106542ff08175e39d84ac459caa27f621603782fb42960a12dd8eab90c3eb563bfd60d2f9ffde3df55513807
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA251:A3kMP
- TLSH T1FC15AE13DBA004E5E61A8130A9E50616EB75BD565BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 0ad1b187546daf9958695df07f206137905ec6b372056c1d440c156a3a5c7251
- MD5 660309cccc78d2b32d447d48eaa7f433
- SHA1 7fecbfc502b5973097fa413b2b90469f01e664cd
- SHA512 e49b9840768c25cad77b316f83ef0189f58dad5eed8f8c18b557aa5100ce295dde8db4ee1e4671e06d51db3f0ca201bf673194dc48d9aa4a8b55fc4996869d04
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25x0Le5ji0hmxNrM:A3kM7Pji0Aj
- TLSH T170657C17FAB406B5E027C175C9E2569AEE7138421B70CACF1359C3282F637D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 904KB
- SHA256 03c12c6f3afe967ee79477da283acef60e9e5f274bc25409354d99101109be70
- MD5 ce6ecef6b2aaec0e207648193a09ff7d
- SHA1 e6a41b078742a4eadf7b3bbb72d35834b4e76f3e
- SHA512 41de8c218f11ae219024ef7c46ef165a9e2f5c295714381412759369c08455ba22c058387e4684d7fe7ccfd8d5b07218924d6a7dc898a65bc16c8628f54ffc0c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Ta:A3kM
- TLSH T14C15AE13DBA004E5E61A8130A9E50A16EB75BD565BA0C6DF2328C2152F717C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 913KB
- SHA256 81dcc3b3ea71b54c3af21166d461619ff714352e2afc4e30b888775de2bbdab3
- MD5 f0ca1ca3d540c6ccba1062a65448c380
- SHA1 fad34d505ebf635fea91c481be88fc8b46d95842
- SHA512 bd6b0612f39576e3acf0e6d1b20fae7340585502c4a58e6bf864da72a24f38e6f923303b0332478e9aa08270cef3b26d4e3fb87b934d47d211ea1b83e3c012df
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25S6:A3kMD
- TLSH T14715AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 913KB
- SHA256 cf1c09ab42a82ec34be518482eee2a2f962a508782dfe6d89511a8a4c50bee65
- MD5 8ff1e2c3d1da7588d021c9a558cd4b5f
- SHA1 abe992f17dfaa40678b4267d08c6f723806b8c96
- SHA512 8575a265f1ca53d25c53555e6465a42563f6f4fd43921d98835e046316a6d52e4c2373bf89043b7099dd8cbc9a0696c8b85feb9dc30c57ec201255fdd6888d60
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25KN:A3kM+
- TLSH T13E15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 913KB
- SHA256 23dbf2fdf7579ace557cbda62f9e11206556056776b640c6d506831764b3fa7a
- MD5 c09ed238644af9d33c74db78adb10265
- SHA1 bf3b00fdeb095d1d67966f6d3aa726a8a151c7fd
- SHA512 c3ae48bbb46965fd717d7ad15b4464f1eb4399a0629bfe1d2648a1ae5bbf0288d250ff8fe96b215a5794efa073463404b0053cd5a358c694aefe98ca201d892c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25wf:A3kMS
- TLSH T18815AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 913KB
- SHA256 c4cb6333e89adf6c5eb94fcb610b10568dbadf7b0b56b8764a609b4700738a6a
- MD5 5981aec0684b9df459e15a053d37fb7b
- SHA1 a38939cd8a7275fbde51d2b4fad892a2e523e377
- SHA512 2f90afcd224b4f183ca31cd0e2f6412f5806cc4d56ed1ec7aef0aee55af0d65c2da5b7fffd05aef0ef7a35c62105d013df22a3b958df82c48f87911d461a13a0
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Ko:A3kMb
- TLSH T1C215AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 913KB
- SHA256 a70251ab552ad307e7de3a9a66cbecde7a07b714ef5156b23170b1a3d9af1c28
- MD5 afd00b694d40c3c0ebcf1cde50f2d201
- SHA1 a8c00c32de4cbecc193bb01ea5bac07ecc30300e
- SHA512 587b098598836af0dcbc09f4e1c757b83a879ea7d0bd4a03b8cf9ae38e8e44be3b3951b75703afef493572e92f1b63514daa1d9b8c5e113b2e20867badef2a9d
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25eu:A3kMd
- TLSH T12A15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 913KB
- SHA256 20fef82527e9fddc3593b97f3e4f2e0eeea053895ebee79e4df43a938ce9540c
- MD5 da6d9b8b3ab774fb543bcf18da240725
- SHA1 0049a0929c20ae33dec3fd47dcb8789f907b5701
- SHA512 d785cfe2f6b7e473aae707b12add9ca99690ae48f0e9e6456c210b7379419bff94bbc139b9bc5568575a1a3f48698e32616982dc4de012938ca3ff7327d33571
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25S9:A3kMo
- TLSH T17315AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 913KB
- SHA256 2a659d07bc12d4582c1ad734b83266b1b37ffa8fa853e6147ff37495d7c4cc47
- MD5 8a2e5b415ab91a473424a695372584d3
- SHA1 7d076fcbad492a196dede206afc90aa59d282c45
- SHA512 a7bc578699d5aeea016023c65e0012f6fda36ac43d348acd51aea6029fa727dd7879d48c11a5423638df26d987096cb3fcf0c931b90e04fe22254095e4bfc7da
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Sc:A3kMp
- TLSH T15D15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 913KB
- SHA256 692deda1ede7a70af5b93508f22e807dec19690cb86de7780b297222fa368981
- MD5 c715aaa4a9f39edac9a116b1e1133189
- SHA1 a0d8f2f5db8b888cb71ac64e8e403c0dec3dd017
- SHA512 b17b071dd7ecc03775992947502a74f910f1112f57b31bea00072870f6ee9b5d7d1f001432ba7908ae3112d53bb2d6733f591336a806232344b59689070c4bcd
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25bp:A3kMH
- TLSH T15115AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 913KB
- SHA256 561b8f707415b55a8d30d70748661c3d95f9470f9620208abe87899f98ca9ff4
- MD5 811a2bb1423244db7d132f8e35ba66ac
- SHA1 4dca30e84a46f8859aae02d8e8850bc0076894c3
- SHA512 e7fc5ea3fdd806c3128fa5c5664226880841d981f320e1df698a76f8eba15579f08e1decd0daf66d1ee34b801b70ee702b256f3f972cb6d5d87eba57732fd0c1
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25sN:A3kMM
- TLSH T13A15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 913KB
- SHA256 ccc65bf5a8c61cc72e286bcd83d9fe711f18d1fc8ea7f40bdf7517e5617b2f1b
- MD5 ec0d990bb5c7792af9f9880d4519252a
- SHA1 0b21a18d1d3bf067e48a27254ba56ad6dea084bd
- SHA512 9c761d38ac39b1e20f1026a4b9f923fe7c9809ef10fe8fd027e7985606ea7da1c6594686d79948f80d7f4a47b2ebd618ae86a89eb51c1bd1b39e669296668f09
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25UF:A3kMa
- TLSH T17C15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 913KB
- SHA256 7b0d3e2f8f9962e762300dbb8d978f2741bd06004b717dc7f627794ac168a263
- MD5 0d3a4aa07e56ee46c052dda759ffd653
- SHA1 49d3421aec2fc37167be6a4caa700dc057ed26c1
- SHA512 371f3529baa045dbd07c79c72f2548e208224123e04cfb7ec7d0986483b77d2da7396d1b4f8f1997644e2d75b31343407233469966ed177fd5dfa7317627532a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25xC:A3kMu
- TLSH T11B15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 913KB
- SHA256 e581a0c30921b9f555230ab6aed9fca3f10619b7d4629e23b329f71ab142cd00
- MD5 d86da03159e2b1e998e1098f9f3e6349
- SHA1 32e7416d252d05face6fd5db3e14ec10389e6d2e
- SHA512 e2edc3e78e78a7bcfbb50b1f84538d86fd4c2e5be989504b9ad72b95795cb1eda99809f0ff5e79b658f2549ed2325c61e59e8a62d0f1c0ed134610662e2ce1d7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Sw:A3kM7
- TLSH T1D815AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 913KB
- SHA256 74991f47673b1d73620648985fe7af308b353215f34e6edbe59797d4c2483bd5
- MD5 0db593d3ef2e078534a378b08b10997e
- SHA1 37011fb771c8ad3a9dd0f30d33017e5a2c15b1ed
- SHA512 c4380dacd085520f4e47ebf00987eb8c0105f296954f0af1ec781b82b0e09ce0a2669a42cd8747c4a0dfd53f2a2d5a87fe229d011520c302d8b720da14f483c8
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25ZT:A3kMn
- TLSH T10C15AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 913KB
- SHA256 23fee5e9de48e5eb8f1740c3ed91b557ac1d2798c49d6cf74011e670cd7cc7a6
- MD5 85c723b0825e903c4565b4014176a951
- SHA1 45257ff47f21716d3b89a791dee8e535b78d546b
- SHA512 d6379cfc689017dd43257971858744ae640007bbe0113844cd506e9ea048dfa5f474af44a93dfbc21d9d0831faf6d4f2a9e62be7dfa17855396d7e3387876c60
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA253u:A3kMo
- TLSH T11D15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 913KB
- SHA256 ec97f85888149b76b3403f37698dad2de39b7c318e5cee2b8bdef899527e5c38
- MD5 294eca6913eb4f503e6e5726f644f3a6
- SHA1 c903ebc5aa779d0fbf94fdd4c3285d014b058647
- SHA512 e34cd0bea9fa9edeead9e53aaf6adb941d85603c18897d8db1d1a47ad05b28a7d1273e320708f48982fcf4a3945b3e8f78a839d1a7da7883e59e342f115d9a94
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Lb:A3kMR
- TLSH T18E15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 913KB
- SHA256 fff712feb9246afd2e8bf0d2c9296db6e0b93b21fd4911ed99fcf96a8f476120
- MD5 54a3b482d69a871e1b989cd564c043c5
- SHA1 2d2a96d8a7cb9b75dc762ae5048e1a576711299d
- SHA512 7d30f6167cdcf473b5ea356d7711323862194dd070d57612b3663f2f95abf74af9d256f960b47c6b2777829db93a1957919267110a0e1a9d58acb717cb704f5e
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25ff:A3kMR
- TLSH T1ED15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 913KB
- SHA256 901a36619343c81792d1e9e47648599ff5fc35d43d5d660e958f9c70dffc584a
- MD5 1bb4f9d2353573e5f9bd99f4cf136ff9
- SHA1 9e63acfe76c75dffc2b2444a54ae9cfe5b7bdf81
- SHA512 5fadca467c938717b8af8e69a3557f54b4cfcf3af238b19989c535b080d961fe97a817b388ab125d033c9380b8436852db09753fab73210be384926e918e78f6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25IK:A3kMp
- TLSH T16D15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 913KB
- SHA256 ab453a9284c97e609c5cfd802881598a211151490618cbb569aaed343cdcc59b
- MD5 d3241ca244f0ccba0cf12fae6b221ddb
- SHA1 e675a15e0980e5444826ba98c7aec837e7f7151a
- SHA512 16a08b8bb37378cc8a16330d17f3df4c7995615051099b9a0870afb9343721783ab672ef7d879d8cc5becf592aab7fc9f49433399cb80fff13256e5d904211f2
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA251k:A3kMg
- TLSH T14A15AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 913KB
- SHA256 bd8681cb65baa61ec6d9edbaea81c617a3831c0082d1b89e8e7e2f74b7f6de06
- MD5 4928ff615d105cd9243c4732012ed293
- SHA1 8d8ed658207c9b52da5aa93d16bc20c4936d1e25
- SHA512 5e3e7f1dacd52e291e607180397fad4455869dec51c137b71f03ef038c1badfa08b4e141609d1a7e4b4f511c49dad461b1733c153b14a6ea743d9651271902e8
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25q0:A3kMp
- TLSH T18E15AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 913KB
- SHA256 7f2c18542840ea3186161c53bd1888ea7e4456c1b9e257d87b97ef269cdf26ea
- MD5 732e123216e7245554517311124e565b
- SHA1 de85666b2e6855638c75517cb4ffc41e16d69b80
- SHA512 c0b2fa449025df7f4078323ac2fad35183955594e6b5feee724a5df624aa10a62ba786568903a2473550f07c42f5cb8353b3c1118652ce0360851a382c8ad09c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Zg:A3kM4
- TLSH T16915AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 913KB
- SHA256 ee1d8bc74e3a83d13b48f7a4c4caf9a4896236076ec04f33766c400ea052b484
- MD5 32f0da6aa5ce079bdfb1c4dcd4663775
- SHA1 df04e2a4c8887546ad217c8ed8ace0068a630bf4
- SHA512 280e3298e1a82a61ceb1a1994ba22c38c5bce03343c8d08cef25db9b3fa99a03b3a0739006fa7b13659e03a44f612b5933134a7e0d27e36262d26c26e01d8aa6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Ar:A3kMi
- TLSH T12115AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 913KB
- SHA256 cb4e16224cef7b387ca6ba8d3b670431936a39ba75b7d213c96e2e669474df06
- MD5 445e9641d54a835029b445a0019c1979
- SHA1 28d4c33448bd67832ff901448ba1ca4b069b2d71
- SHA512 4a16beab02d9e7b7326b843c2d7fa98e560d07033af352d602ae9a997d7ae212fdde28c917641a6a96669631535fa9369e1186647024fc81af8730e9c53b82ed
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25+n:A3kM0
- TLSH T1DF15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 913KB
- SHA256 999d7b847d563800242987c67ce1b7df60bdb10b92ee42d4de0d7b2c139a0696
- MD5 c8219e09e483151cae39f225c4e0f28c
- SHA1 47d3c9977dcce39854cbd32ce2b0edc13691fd42
- SHA512 652e32c0b7ef52624dacda794038dc9c3726b8ac249f91f4928880231b42d63e30e24fec7d1d6d56b5c5740d96934ba315387eb0202ae49e00a71ad4ab377af7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Ux:A3kMy
- TLSH T14415AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 913KB
- SHA256 1296a678b7476646ad90471b4780e213357276feffc9e2860048e18bdf780715
- MD5 71ff531e8942fa057e36fb551113b6c3
- SHA1 c04caef065184f35c6a2633a3963891dcc84ed72
- SHA512 2de816167a37fcb6c226c0b749e12dbffe36e2ad48f9c201d988278edab1720f383015f3339100cac6ce1d5bac09187c29488198b7c7d06570def6fc1175e3c2
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25eA:A3kMR
- TLSH T12115AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 913KB
- SHA256 90cdb9301895e0cb331e5aeb714bfb6a477089671777fced9f5a2b83a82cc074
- MD5 1cc23af96c33ca22acebd228a358e7ff
- SHA1 2abce12c427064bf3637c3f1d91c9b9ba8b91b59
- SHA512 7719deb4e4c8dbd13c2a1f3b120e3ba8788f828c9ea8cbbba1481d00536bc61548759f9a464cd7d131b681f28acf8cb0b9a95a61b822765c4d6ce9e982d2a1b7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA2539Q:A3kMo
- TLSH T1A315AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 913KB
- SHA256 455998b4369ef2ab93824dc95335775101d3528a26d88b98b7bf76c9d46526fd
- MD5 595d9e6624b695ffd783288505daac9a
- SHA1 f63f61b08166ad3ef4aa722fcfe83d8173648998
- SHA512 e94d42a59cfebadc376c9d88220d4b91a20dcea88a57b1214ca7db22f8326babc911787a3c6b8a37aa91737b38f0831f2c027c53a6606cd174f1173e5066b5ef
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25e4:A3kMT
- TLSH T12915AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 913KB
- SHA256 5b4347f2883f090787efd48a180054e72caa3ed573d4594dcc08adb6d6509f14
- MD5 a97a1277f63f83d40ca031c703215118
- SHA1 763b621138a7ad97737ee5a825f2acb701113400
- SHA512 54a7f5cfe4e78f4bc8c786ff1a74c01c8da675a60b49a509308176ca957c26e2ad747d4921a4aadac33274cdc4e4c8062d07dfc101370b8240bdd08c0ee7c73f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25du:A3kM2
- TLSH T19C15AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 913KB
- SHA256 33842dd5ad584fb70227c90b2eed55d92ee61d0a68452175e368713399bb0363
- MD5 dc4da834570821851c74f604d3c4527b
- SHA1 c49decc1c32295a51b1a0456c2b579923e05ce40
- SHA512 f317fa94387e5921e83d7638485b2913a14fc8a39b2ede0daef3ecd945e5eccfd06de5e175a0a5eced82195b144891a23cf60d0994801e171045a8bf3fa0ae3c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25wj:A3kMI
- TLSH T11015AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 913KB
- SHA256 d8acb29e34ece77bd12d20021e3361c602f48b57e2a03408d835b616b24d4bc8
- MD5 1d439c4e67d00ee297dbb1a514964b0d
- SHA1 4f428e1ea738de71cc81f37d5b58c46ad7dbdcc8
- SHA512 ba748c2e41b7d322948e3eaf6b9985a7851878972d3cec2d1930d1c56526943bbb447e4a65257a9e1ab21701f3a4ae3d82e2af4746071d282da871a8aea4eeaf
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25Bg:A3kMQ
- TLSH T1AD15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 913KB
- SHA256 f782c1781b4aee65b8d3b39a1420755182cd37f1ec650f10b92e67ee41be98fb
- MD5 b3d3f681dd2b92868cf65b002f3a46a8
- SHA1 237cd73acfb60b361d70a8b7ce1dc8377ca15856
- SHA512 c17f9859f795a49b0886f231e00315bef41fe234554adf4e7109a52fcaefd44eb3906d2a60a55c875589f7ed6689c6aa16a9cc4551ce3e73eba13be9e9a0a7c9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25YI:A3kMx
- TLSH T13D15AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7A3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 913KB
- SHA256 b892a0c323fb6731e6174425c6e2729aa3930e8342c30303a3071b1ccb0aebda
- MD5 a6581e7711973b24bd1c826211cc9a24
- SHA1 5fd12ef07e3d84b4295833e439dfa00e2b82cc6f
- SHA512 4925dd319cbc038e83764565ab3d51c8d7fe4737a2c920874a76ff71d6df5693fc1286b6f977f10b5ba40ddf72894fa1edf9d6c7ecd25706449e821710d4950a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA256o:A3kMP
- TLSH T1D915AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 913KB
- SHA256 181eb432c5ba275503fdfef0ce1dd2091faeb67b8057ace186df8b9df8c2c254
- MD5 270acd22fed57fa43ae65adba9f37f31
- SHA1 c8fa2fee92370fc2e9a1e33c3ac01bb2498855b4
- SHA512 f736aca69aec4179f4d331fb9f7288ff8f7fafbc527bfa164faa80c3aa706a5b45c91b30f32cbfd5104bbcc838c199b688e09b033fb9893dd641aab03d574b84
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25R+:A3kM6
- TLSH T18B15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 913KB
- SHA256 7edcc7bcc0d8f9c1779f8ea936c306588b555ff9299d9c3de61755275b4417a3
- MD5 11c2506ef797bed13f3af677001f3456
- SHA1 3fbd4b8d9de273f1e59093602454d16b6ffc852d
- SHA512 c74710f34cb1fa3edfbb073334f88a55cd43ad6c0b93b59285f9e9101bac301b867f111ca442a670bad1d5e73f42d8a1d8867947e91371a6ea9ff8224f9945e8
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25fQ:A3kM+
- TLSH T15315AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 913KB
- SHA256 1831cb7963a588102f136ae1548980f0ef3cc38022d3397e033cfc7a5f65dfab
- MD5 31714c6a8b4e19b0fa9d309532da2209
- SHA1 9f3f8316829731b247cc29f4673cda35708e974e
- SHA512 21dedd63a59c4c51767bfcb8994ad79344d980302b5f72d2b3bdaf5077f84a6d7d7f954cbd8d2ee506241e34d72564d5ad4d05b9904df982945db0ccc75af79e
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25kX:A3kMe
- TLSH T15815AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 913KB
- SHA256 cbef30b6a941e7d8c178aa6f259bb93796bd8ee6390b8872f09bdc12549233ce
- MD5 065d3b6c32d68b04aa9556d8d9453636
- SHA1 77d5c9ba409feb5f185cf4b4f9b4e6b27c29c0ff
- SHA512 a2eef8826c1b01936ecf595b88bc396377a96ebb85c43069ee44c78a463421be8d4dceeca1742374b94e5a75ff8b2e3b8d2dab84aee798526d7304b340c933e6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25iL:A3kMw
- TLSH T12615AE13DAA004E5E61A8230A9E50616EB75BD575BA0C6DF232CC2152F617C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 913KB
- SHA256 0fb635faab61e3d672b91705b8e17a9d652dbed2f366693ecba9ae700dcc3d70
- MD5 7e268b519bd45664761aeff28e62b925
- SHA1 c48407585315ca8a60968dbdf5c7e25f2848026e
- SHA512 f411bd5585c98522fb720ff7c718d75c4d1254576d84a63411f16061c39e8ba72c185fabf8402786db43660d229319967500771b9d3f85efdb972e8683bf5321
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25GM:A3kMh
- TLSH T14D15AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 913KB
- SHA256 c4d2febab55e9b1af0578157a0633f93341f170e55deee8f98e1395bf1d1bc54
- MD5 3d839b695ee39b8e7b04f1405a37732c
- SHA1 872b24f7e7f58216d5678775157a669216af1d9d
- SHA512 f385dfbed1fa55849975ca3b0aebd3d38ba8074d382be0fcd6e38342b6647d486359e834c2e5b772a04ce37231d3f877c8d49758fbcae507ac12caec0d3de04f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHD4CA25vh:A3kMz
- TLSH T11015AE13DAA004E5E61A8130A9E50616EB75BD575BA0C6DF232CC2152F627C0BF7E3F9
- MD5 SHA1 SHA512 SSDEEP TLSH