Analysis
- max time kernel
108s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:27
Behavioral task
behavioral1
Sample
2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 904KB
- Sample260809-pm1qbsad64
- SHA256 6ee08dd829aba81425fe52e59780632d4d7fdf20cbe15f2452ed50d5ea4bd50e
- MD5 bc5bd2a4450eb7f56fffa1be2052f77d
- SHA1 a7ffe54ffcf79f6e40aadbf9d9de4c2903260f71
- SHA512 092b133fdadca1c0fa40eec99ddf763f55cbc951164252c689fdfbd3f12aada20067c32d53a4055a89752ce185eb78abea12f47d4f73fbdfaa15edb725f448cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vf:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vf
- TLSH T1B015AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/1228-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c469-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1228-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5624-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198f1-431.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-511.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-591.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-654.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-845.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1068.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1094.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1362.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1487.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892d-1531.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893c-1568.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c469-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-274.dat aspack_v212_v242 behavioral2/files/0x00040000000198f1-431.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-480.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-511.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-591.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-654.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-845.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-891.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-898.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-911.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-924.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-937.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-956.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1011.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1048.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1068.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1094.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1114.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1144.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1170.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1182.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1189.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1226.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1329.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1342.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1362.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1487.dat aspack_v212_v242 behavioral2/files/0x000800000001892d-1531.dat aspack_v212_v242 behavioral2/files/0x000800000001893c-1568.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5624 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1228 2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5624 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bc5bd2a4450eb7f56fffa1be2052f77d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1228
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5624
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 904KB
- SHA256 6ee08dd829aba81425fe52e59780632d4d7fdf20cbe15f2452ed50d5ea4bd50e
- MD5 bc5bd2a4450eb7f56fffa1be2052f77d
- SHA1 a7ffe54ffcf79f6e40aadbf9d9de4c2903260f71
- SHA512 092b133fdadca1c0fa40eec99ddf763f55cbc951164252c689fdfbd3f12aada20067c32d53a4055a89752ce185eb78abea12f47d4f73fbdfaa15edb725f448cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vf:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vf
- TLSH T1B015AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 933KB
- SHA256 946cfcd1f18865cf6fc638d261d0466628d6f59661ec1df8e47c18bc7f511546
- MD5 1c53a37a728afa3ac48268e9eb8ab319
- SHA1 4579df987a66a539d9a192811b998a12428bd53e
- SHA512 21b1ccd68dc064a9ce7f242e14ad8ca25a665ca046c23d77c89b6cb855f004841dfc5e99887b91be9a26fd66e24c4ba70ce35c754ed6db1b259b803f6490e57e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V1P:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V1P
- TLSH T1C015AE17E79014F5E8278238C9A54A22E7B1BC661770C7DF136852262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 950KB
- SHA256 4e8d36facf7e1d2dd927a90140ba64a6c88377605080d4753d796c62d0450956
- MD5 f66d585a42515d5e7f8372c451dd7971
- SHA1 af7d69960cf09153de7952e46d340433d9797a40
- SHA512 e932d39eb554d20313e74641517dab6048f52a146d1990ea5355572754b7fe05f3363072cb7292a0c68c41fdf374d895a6de1774d6aef545c56d49621090cb02
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V20:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V20
- TLSH T1A325AE13E7A004F5D8578238C9A54A22E7B1BC661770C7DF136896262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 956KB
- SHA256 aa16503b775957b8a62a41890c6a6f9811a2c65562ffe18b74339b16b8e76d46
- MD5 32ee20f99acef433af5cee373e15a115
- SHA1 2e23156d7c4e0a4cb1ac4803152aa2fdc1e84ca9
- SHA512 a107a34060c9d58421d1275e09d68a792969a140fa2ebecab59e415cf077c9d916a7102731916d0d8b3281090e2eaa352546227798578236829f964adb0ce053
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VIFfj:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vmfj
- TLSH T10325AE13F79014F5E817813889A54A22E7B1BC661B70C7DF136852262F737D06E3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f5d99476f61a67f9694dc4be6d9cd5d2caef1c5196fe163276c81d596ce3fdbf
- MD5 9017a5d8a09eec3bd44cff9eb0bbb1e2
- SHA1 783f184ca6a811b7c0711d79de7ebc4b92f0a7bd
- SHA512 c36030bbc7938819895646c16644200972d1f18232ed3cb64bbce59e5c4f257564e32f67ffa01916bad10ac8be015618612d64d525e079fdc89763ceea77369f
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VL0Le5ji0hmxNrM:A3kMhT1LljzPji0Aj
- TLSH T1E1658D16F6A406B5D073C179C9D2965AEB7238421B30CACF139497292F337E19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 918KB
- SHA256 4f88dc8dd21e425384a3077730b3cd69f58b8549b7b612311864b4fb5d5189e8
- MD5 c070a27c5e097bfe4fdd0bc6e8b8f80e
- SHA1 31814986a0e3df91b85a0086279da57bcdf4d502
- SHA512 8daabb5f0222473ea26ed96fe5378c7cb431a0e8b77a157d3f267c41ff28e722e18332a9f1e77d860808b94f06e17627c3c917760de6e8734069f631e9051e35
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VNa:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VNa
- TLSH T15915AE13E79014F9E8178138C9A64A22E7B1BC661770C7DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 951KB
- SHA256 e1d7222f7b3829e4f3a178d558676cdba335e262f88ab198835d5eaad84a10fc
- MD5 1782663d1ad7279b5f0526f83abd809a
- SHA1 10438f66d24b5111dd0d75ad3b94789ac2218458
- SHA512 89f0bdf45f6d707c9706d8341abf594bcd262aac1cfbb1989882b98cb51d455de43aa4705e94a786d787ec1d598ab3aa646e57979100af59b21be7bfbc4aeb24
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vub:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vub
- TLSH T1D025AE13E79004F9E8678238D9A54A12E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 927KB
- SHA256 8931fb1ea9cfdd0c585edced0163f24eed82fa6d7ed334b16e1a658a1fc355e2
- MD5 fc1e4f7a85a1a043fdafcfdfa539f76b
- SHA1 0b93ef5c5453b2b98f57f7efaf45e084d923a0fc
- SHA512 069bd18776f5a7f72c6ab000c9cfc726c4bb089b569a55cc208f40cd095fe51c090243a88d6b31d1d8cb7978e124ec9fab1c0ae4c945ad751199c15db4475811
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vc9:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vc9
- TLSH T11615AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 927KB
- SHA256 4ddd2b2aa6c63449335a3935d57f6b80ad630d82c989d288cdb1ae690e8bbc29
- MD5 a77aacdf57ab5766d174b201f209e5c9
- SHA1 5232fe5fc403086c97114a635783022a3991a1f2
- SHA512 1b7450c69e71cd6a54e9c28ee9eb64c47d5be9946083d402b9d5792ad243a860cb6fff057b74480bead5d0a2ce1e4a4970d811c001212c3586ca8173264d2cc8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VEc:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VEc
- TLSH T13C15AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 927KB
- SHA256 371357da2518ec5df488c838c398242478b8258131ada807af4122664dc761fd
- MD5 b60b0fbd895b2975a837a475f1acab6e
- SHA1 fdb14c05231a1ee976a7672d12f368878a0b111c
- SHA512 271fcb5f06eaec859e5185a61522bf0852f114cd6d50c20ca5b39d7dd85b905b44ffc6ce7a49057dde7dac6e3772e667f3efacf23ec452fee3dda912c31ae59f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vdp:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vdp
- TLSH T1E015AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 927KB
- SHA256 9a2f73262af8f40fa63362753ae5a0a9fc7bf6c4a6925aea33d64c84647ff70d
- MD5 4b3f37df16533d881c3b7b08192d57d4
- SHA1 5076bdc17c079d6877051dd4858daafe5e9e77e5
- SHA512 0f28c5f999606dc0f356ac21c8a12d28101f346f6b8963323d6c025bdd95ed951287d23a76cba73a98afd0571218cb484996ea08f052f663730cbacd875e4846
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vi0a:A3mnXoZjzyUTWaLl3z0zDMCpxDS1ViN
- TLSH T1CA15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 927KB
- SHA256 f74f7163e6b84a57887ba50bdf61c485072bc1bc513d22aad3291cc2b5da22ca
- MD5 00536bd62c8a6dc591aa58d3ce6b13ab
- SHA1 66cd600729a0c7c4a6c785d0f7fed0e369306ea5
- SHA512 7286e1ff9ecf331be4f2319df54845db5597a250ef5177107bf1998196bbf626b14a19e7495ee50e9ef917c94706dfbc994391da26591b313ab03e444b8fa4d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VGF:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VGF
- TLSH T14915AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 927KB
- SHA256 591321d7ad4238192400ec38c44e62d372a757e651bf37b7ec7109b4f0591ad0
- MD5 3c5ffc1227ce45fbd352295bf3226efe
- SHA1 bc93c4b42cf62d6e33f606e0d96b2fdc2bea24c2
- SHA512 dca266588887c85c7d2c5d7c6582bc4e3c08b2ace25472fe3b2063ea6c5ca52698ee4dc25695e9737deefd68367755fec012636f0a9bb4aab22dec24c31585e2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VTC:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VTC
- TLSH T19815AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 927KB
- SHA256 c0da4845a0a9df941275773d9511fedba2509d3ffd7fc139fcfe211ab0444ad0
- MD5 bfee7d5de0352248d3f4068ab803f5f1
- SHA1 2479169facbb92ecad26bacd154170d6aa9d9a3e
- SHA512 00cdce7b4af6d8089dc33bb18c719aa97696b51f005ca263990b31b5129ce9ff1a51dd7166d4de9d1a6b67cac7f6f0e9d98b1b7012deed856273bb674f84ff0c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vcw:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vcw
- TLSH T1F415AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 927KB
- SHA256 5db757d5bb1dc969a9ddea26ee81eb1c74619c653411cf61cce0222d8df7a08b
- MD5 8003b90f441648e214bdb069e379a4ce
- SHA1 e742cc52a8bf954de08a03af9fd9e5f810ef61c9
- SHA512 b9ebd6358a71921e08d5e6dd047424c6b762c67cbf4054152ee642a841d1287c3bb0e818141838b32f596067f4783b7fdce0ea55606e7cbbc83cf1cae36d6fd9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VTT:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VTT
- TLSH T1B515AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 927KB
- SHA256 6a5ee2f2de1033bb0c7765ac4f408d69f933dd105131fee1139477d7a42dc338
- MD5 cd8c380e453e2abcfc3a772213bd718a
- SHA1 40b6bee7efbb17c66a05a8b23e302508a0c58774
- SHA512 ffacb8f1c3873fceb55147f34af4be975743c4ea4aa03923f0907298fe4727c3273a43c35fbc421da89fd6a1673faa4a3be18405e573c61e552d4b40de2abcfd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vlu:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vlu
- TLSH T19215AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 927KB
- SHA256 34567a977cb7772f85fa0f03a2a1db00726ddb96b9bc9e96c00e2510f7a36109
- MD5 c351ad295319d5807f0b9d27c836eb6d
- SHA1 383cba107605efbdc9b2338fdad0bdf9067b8a91
- SHA512 450f6da641d2c9144b480c488affbe1e087b189eda999ea1ca5039a4f3bb1d34f1824c3746442cba45c99c11495611bf12fc5aa489aefb2d062a9f8cea568ec9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vtb:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vtb
- TLSH T19E15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 927KB
- SHA256 a995a651fb2912b3bc0dc5d59c35919c6f40ed17c3f05ae5f5c92f5a6969b7d9
- MD5 8f7b3f1edfa5d1035a138fb35417b11c
- SHA1 2010a7e9fcfb6774448d320f4a70c790ea9061e5
- SHA512 e5cdb437b13fccdc5053584b753ba3a93a730ed9e08c7971b7a8da48ed6fc0be55d8d5ec2062a2515b9af4a1c30385e360fd04a14d25cd49e287f8aa2d342083
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vdf:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vdf
- TLSH T1D015AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 927KB
- SHA256 c524cd135954be36e14c674cf08039cad212cf620f906f152532fb8c491cebf6
- MD5 8aea1d1c276c093cb89fecad6fdd7740
- SHA1 7d6c8fc84048edea5414ad63094b16f5ef505423
- SHA512 814ea3f9a45919a9372ba803bb7f344fa7b3d46240f70c55b36a90d9d793d79dc5dfd88299442d982d920578e03fbf19004d001695201130937723551ba4ef6b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VGK:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VGK
- TLSH T11915AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 927KB
- SHA256 3041299e5325bca193e531060b6bdfa7d0c528e21ae3217d2c3982ea2419fd9b
- MD5 e6d7ff459fdcac83b87b96aac8ea46f4
- SHA1 2cd1065f4b933d2ba9bfb750213f2026770328fd
- SHA512 f0b6c941f62110b335de6e9dbf557ce63e91926e011f2ef22813cdf1e8d80e3b9e5364f67049537fa7e44686f444d2eb227032caa3abef4e385e50c31880716a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vzk:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vzk
- TLSH T13F15AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 927KB
- SHA256 0015beb57ef401f917390dc7b202a85d80d9ab547399dbfc737b42919a390282
- MD5 d630f6c954c65ffb35745f1fbaf13aee
- SHA1 d70d9ff7776c71536882e8b196c319959b08793b
- SHA512 506c140132ad32d452fc485e3e6e56491dd49d08e817aed80e8a4daacfb1d09ac9a4b3a4dc877f1bef66cdb130865bbe851de7a66e1da4d9c0d16810017a3a2a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VE0:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VE0
- TLSH T1C815AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 927KB
- SHA256 3b085463766480431126b7075e672e124ff8f184b01359032c05184b95403229
- MD5 e1ef622d82aaffc6612f78eb6e6b4df2
- SHA1 1e811390b6cf6b36d6335cac859ef1a2878e9572
- SHA512 24b4ccdc81247efe5070958b7f7e59d41521353fba837cd3bfd4197ce6da93cefb38423b18070abba5dea224ab6987ba8721438da5195fd24d883c8830118c96
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V/70:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V/g
- TLSH T12415AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 927KB
- SHA256 6e4b47a94b6e82337017c534ba727eb1c8f525e7da107a1afcde2f598e5d62e5
- MD5 ff5acd9fe0317a473bd810748ce490f8
- SHA1 1459656570bfbd4bf39103f2747fab430c735559
- SHA512 e38b92288aa7f11ae074c879fe6288b0e5e11502eca7e958796ad1a43e71eb2bb79910b947291336bf506eaaef72a6afbbca910e07fc03331804a1d6b0a64a93
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VSr:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VSr
- TLSH T1FE15AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 927KB
- SHA256 5dd1352d8eb82b63f22dd04304469c1b896d069d386033fad4cacf72d3e97b09
- MD5 53a4429c916795131b37917bb46d9626
- SHA1 7654ce149df669264637d2f223f98f2435909db2
- SHA512 0524d0449c934c4861e2e0462099cdf30bffb28cf03fafbd5d34e52217871352c14ba80cc38b911c727b8ee7293507806013cf099d13c83a35a70717a45233eb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vwn:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vwn
- TLSH T12315AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 927KB
- SHA256 67c29447f289dc8528fb168c743adbb174741269ef7743d78c15fb69df5ea466
- MD5 772f4755de864f2ed04e2aa559dc585a
- SHA1 9c85a89a3626b20b3bf553b2a279f256b3cb8b91
- SHA512 860e7020e48423235c171e5ae6aa1c114ee83bafd59668f40afd0c6815075986f35c593fd83d32d562487c1ae1f29199ebff5cf7a3a7a6d602da548c002a0506
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VOx:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VOx
- TLSH T1E115AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 927KB
- SHA256 dae17f20c465d66edd617ca69f388dea4a520441d32d5d2acf2dc3d0611ef726
- MD5 3f2af5b5186f3b83a45ace3f18ba9a80
- SHA1 3bfe74ab4dfcf7ae8a1fc5d692ca7c0450037b95
- SHA512 d1aa206e55390d4d191ef61046b1e00e68ad9465a00dab20b2cec1fb89ed78c630b82bb05b819d8bde6eee95af9c1f8e75e8013edb8e854c8d43e20b4917b9a0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VoA:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VoA
- TLSH T18215AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 927KB
- SHA256 ed7689afa8ff6b0e4d68ac472d67a11028cad0e3e261e247f3853aa9ef3b0169
- MD5 ccfaa5abc05db52246f7b0a75af80377
- SHA1 e6c0ed43f48818cbbc38c3ead2754da9ea1d022c
- SHA512 6d5b98991170e55f95aef91f071ff349e1aebd759cbac92d33d46dada16028a1de03abd2ae472bb766badedd1e8b2272cf46f35606fce35bd211f31aa5ded6e8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VB9Q:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VB9Q
- TLSH T15C15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 927KB
- SHA256 3f642f27c001fb6e4d6983e8a552b8d3ffd67c169e95e7ee7c55d055126ff554
- MD5 aa084de68209e5d2c1382c3c04d073a8
- SHA1 f0027759ee97b0f9dc977cf7cf74dd27ad422240
- SHA512 3012cca69d4e101c59fd7c222ed4506d31dd2735ac2508c83fb0b945eee81605295222950a8d2dfaee7d6e80ea376895ec01bd618a8bdc2d1e9fc3a01abae5f6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V04:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V04
- TLSH T1DF15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 927KB
- SHA256 8d15f5ce28fc8b0300d29f5b5c507c78b8500504a93cac07121feeed4eaff1bb
- MD5 c9d3b00651a5c42c6cc38b58e355cb86
- SHA1 95f42bca10f4b9672bba09ce419d19c83aa02916
- SHA512 f3a528e5f4dae033abbb4c89df428af7534432fea693c732aabda63cfdd657033384e5ba1cc7ce03fd9b9fcd4bf8575f19a3f2ef3e89a86dbc84cf42d3f2bcf1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vfu:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vfu
- TLSH T18415AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 927KB
- SHA256 2a20ff737558973509d013e51107c423e9a5fddafd0c96e59af4134f777b5189
- MD5 a4bc17835757f8fff26b30394a841d6c
- SHA1 61824f42fa6efc03381a883aa6c5c31ac5884036
- SHA512 9b213ea785318fb1d771f3e0278cfc21a209c9317f337b31c3ea67d42e99162472a8d5debbcee557884a9be448e2d83d1c1527d4ffe4a3a62fe7f90b5362be07
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V6j:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V6j
- TLSH T19C15AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 927KB
- SHA256 335f3f357d74825aa4c25d746a1811c99387f5a483487e4c86180f060b57dcbb
- MD5 eb438e2cbbef4d2b8f25eb1a276da409
- SHA1 3d8dfd748f68fed2dd2854ae73ede74a0a1da4ee
- SHA512 1faa0e451feba819924eff1dc541639142691529b488c3829fe0f390ea1fcc7e99cc2dff6b1ac0ac7956bdd6ec2424e01712abd9a56e0e1f5d0895d3fc92d9f2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1Vng:A3mnXoZjzyUTWaLl3z0zDMCpxDS1Vng
- TLSH T11615AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 927KB
- SHA256 06cf9add9a3e25c0a6d6e0c5c203386df4dc493dc5c28bbe7ba45125142692c6
- MD5 f6eacea4d0e42cfc61a23383983aad28
- SHA1 684dae434bb77cf5de465faaeab68258dd989ba2
- SHA512 c4d902078ab24aab0824110093dbe7c4486e28392b7bd9f6b03a1c9874cb55ef432da2994452f26339a79f73b7c702d2e53f927449e1acdc4445b23136ce673f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V6I:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V6I
- TLSH T14715AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 927KB
- SHA256 e4872f572c78beabbe71cb4dbb7f168192587898545a87dd8c1298284f3ad8c6
- MD5 993c8af259a1e0a81ce41f765886b80a
- SHA1 7e9d67efd926a2690700e5dfaa9664755bbae526
- SHA512 6edde62c197af0387c0b56015862eb013da00e3f67d2593f56518241bb00d40377912ef864269234e52ad5af98885693ae4cd5ed076efbd8d8f07092fff53504
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V4o:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V4o
- TLSH T1AA15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 927KB
- SHA256 8f78e7153e031bdfcf05aec187fc21a20246f2e8e0217652290e501bdb51d2b3
- MD5 b22ea177b7d93a34a68e38508d9854a2
- SHA1 cef7ffd53ebdf7064b2cb2c386b6125ab2401d6b
- SHA512 86836c20402ce335c4ea48064e808f1e651097bafa0610410427aa64e072d4a87225520bd6af55699d12331e99161f754aee40467ea8f4a0fb3eb109358aa3b2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VL+:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VL+
- TLSH T1E615AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 927KB
- SHA256 dd5d93c52fa93fc7b9e52e5f2bbfa1f51c61e1ecea23170c92e091c5ded0f49e
- MD5 53534bfcd9b93004e032cae26e1d233e
- SHA1 19dbbe93d46cec26227dfd30472ff5b27b85cacf
- SHA512 b3832de0fc01f018a15a146f4fe806c9e7764083fdb22690296f1a428dcf814e0558b0b07a80d7c41c879ea4724d421faf104c91785103e1df18402f80eb45b9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VBQ:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VBQ
- TLSH T19315AE17E79014F9E8178238C9A54A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 927KB
- SHA256 959321522a71d044d4024420c967963c0ba58d05979913a95805fdf859630cfd
- MD5 e53299303bde0499a6042ddf4fb1e1b2
- SHA1 1452b76c3c67c2d1a43cfd517501bb7678cdfb33
- SHA512 3c94d79ec55bb9bec3cfe82798908e3841309c31c30ec25d64a2120b74ad9f5d4ba924be99a19323e49062aad70e575d8d8d01830b11a8ee3f2d820090854fc9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VGX:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VGX
- TLSH T16215AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 927KB
- SHA256 9acae7d17a84288ca9b508eb023613f29c1c7f63fb4eebb656f387fc6cc37aed
- MD5 322db09a892179b1e2c3d19134cee4a3
- SHA1 1a94189cae9640828f7fb9a30b6c55bde07363af
- SHA512 09e365fcb5c57857d45bac636715e7bc41dc4abf1708316ba7468445de49c96c80f8d6f2582d0fc1e33bee6b2118f5994d83953191877b239f8bfc846968311d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VAL:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VAL
- TLSH T18F15AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 927KB
- SHA256 17849ac6e1c4eb6de290700975e5a44834e639821934733d83a1c3a0aea44e44
- MD5 82c175bca9145760a3242c16837c3647
- SHA1 0e0412d8b35266abaecc33cbc5057b77d8624d98
- SHA512 4d0007a4cbf0025c321311937a906b3f2a503638deccd6e7fcafd4271f0a1c7a97d60eca22ddbaf2ec3e4cb2f99e59df4a4248094b92c4f4aa34bcd1ad869387
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1VsFC:A3mnXoZjzyUTWaLl3z0zDMCpxDS1VsM
- TLSH T15915AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 927KB
- SHA256 e44289f32221a75e1bde1490bfb50b15e3f33865ec1d89b455527f5e0a9d07a7
- MD5 cc733f783a84b0ee4ba4a05656d8074a
- SHA1 5665b5432db32812c45ac6969b6aa284e919026f
- SHA512 9157797f9f2c5d730698e5a1d8bb385553f591901b290d0ea33f4d2ad16657ac488b13265199ac2fc3e1fe737cc04805e757e310bfe3a95176efa4be6599e318
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS1V1h:A3mnXoZjzyUTWaLl3z0zDMCpxDS1V1h
- TLSH T1EC15AE17E79014F9E8178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH