Analysis
- max time kernel
121s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 15:01
Behavioral task
behavioral1
Sample
2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 904KB
- Sample260809-sd24kstsfw
- SHA256 19cb8d01ab1178f63b34325bd720c42a5d2d2eb2fb7c3e639163652bcfa9b42c
- MD5 028500c8a9bdd6a7da99d65589d0b25d
- SHA1 5a5ee4657e347b7a4eade06594bcd75cd8b52acb
- SHA512 d22d5689f52513e7193c65c39f8fbbf9c70e1e0fc334662dbb4b908663a36c17f30272a718e14ce41d089171d03d1d28b62ea2f04ed37951e54442d262a1e073
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Do:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Do
- TLSH T15D15AE17E79014F9E8178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4348-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c51a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4348-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3064-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-275.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019908-439.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-483.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-679.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-734.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-805.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-848.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-927.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1058.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1095.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1145.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1166.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893e-1489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1532.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018953-1570.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000064b2-1933.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c51a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-275.dat aspack_v212_v242 behavioral2/files/0x0004000000019908-439.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-483.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-503.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-599.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-624.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-679.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-734.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-748.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-792.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-805.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-848.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-873.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-892.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-899.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-912.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-927.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-940.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-959.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1014.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1051.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1058.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1095.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1114.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1145.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1166.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1192.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1229.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-1332.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1345.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1364.dat aspack_v212_v242 behavioral2/files/0x000800000001893e-1489.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1532.dat aspack_v212_v242 behavioral2/files/0x0008000000018953-1570.dat aspack_v212_v242 behavioral2/files/0x00020000000064b2-1933.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3064 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4348 2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 3064 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_028500c8a9bdd6a7da99d65589d0b25d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4348
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 904KB
- SHA256 19cb8d01ab1178f63b34325bd720c42a5d2d2eb2fb7c3e639163652bcfa9b42c
- MD5 028500c8a9bdd6a7da99d65589d0b25d
- SHA1 5a5ee4657e347b7a4eade06594bcd75cd8b52acb
- SHA512 d22d5689f52513e7193c65c39f8fbbf9c70e1e0fc334662dbb4b908663a36c17f30272a718e14ce41d089171d03d1d28b62ea2f04ed37951e54442d262a1e073
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Do:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Do
- TLSH T15D15AE17E79014F9E8178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 933KB
- SHA256 7a0a739e2340fd3b6df030210a0598efb7df2e0283b69c6f0748173a546e921a
- MD5 06c9f6d3feed74bbab6751c4c81103ca
- SHA1 efad8fda1f6accf1cf64b59945e3ac376eacf431
- SHA512 0cfd4fd689677eb4523b59e81e5a68ba8fef8a10ed432e03c174ed18bc52fc8579ae7f9d0e3ec4c59a43a973bd4921608d84731a540e9701b65dc5516460e246
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DaP:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DaP
- TLSH T1B815AE17E79014F5E8278138C9A54A22E7B1BC661770C7DF136892262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 950KB
- SHA256 4a893ab82366b6dd4c93c0b89a465f15eca87561fd933c12651d7a8249f6e7b5
- MD5 494ded5e281af4cbc1b49c7751b5dafd
- SHA1 2fcca85cccf686000eb5d2f593c8d74baf4601f9
- SHA512 9409c2bcabd28aad2b552ea57e249363f52a463db23e49dc9bd7b8df59c3de906fed7f51e6c2df8d4e3b4b4aa5ee16f13d80edb52d0075743659ce0acc078695
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DV0:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DV0
- TLSH T1FA25AE13E7A004F5D8578238C9A54A22E7B1BC661770C7DF136896262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 956KB
- SHA256 14e74fc584f8c4bad08423d022cf0484ef04145fa8bfe21ed5ee83446058a2a9
- MD5 6ffbaf59d583d31d303797c359cffd91
- SHA1 6d2c26fce47171065b2db4b88153d72438cc5b71
- SHA512 6ff3832f8c5945ebff91cf8ade20839784aecefd9c9dbe4a99a5069326aea50aa4c2b703515a198f4b4d932fbf1bffa495e812be32a4fe2ba0f7ff7cd6e16259
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DVFfj:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Djfj
- TLSH T11C25AE13F79014F5E817813889A54A22E7B1BC661B70C7DF136852262F737D06E3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$
- Size 1021KB
- SHA256 5f3848cd7257af38e9277b3e632cbae9583d5a4a82126b0f40b38e03d8744040
- MD5 eff9b72901406702cfaaaf5055f40fe0
- SHA1 96b02461b4b583875469d4843ca86b21b41059c5
- SHA512 13c9bcb83d6fd9967cb3d0d55e0b6d5b29179320f314a61766ed43c61125eec84d9d3d6afa44fe88aa7e830c6f34022c4316f83b20492716d41100d2dbb5f624
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DQv7MFi:A3kMhT1LljM7gi
- TLSH T1AE25AE17E7A014F9E4678238C9A54A12E7B2BC660770C7DF136452262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 025b6c5d3a6575f2c799cd189cc98e19fec363a00d756a84064a61325b7567f6
- MD5 771768309a27f91e33b7e8fc9e363840
- SHA1 d777964dd4fc10aa59a4b33bc2e7adaa29c603ee
- SHA512 42f7cd99176183891a4ab62e6a3073eb03d3dcb1946f0e4a17fc38448fddd0a26d7eb72df710fff2057c455b4baf19980c09749e1d569732b7f4ea68379b2e6e
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dw0Le5ji0hmxNrM:A3kMhT1LljAPji0Aj
- TLSH T1C4658D16F6A406B5D073C179C9E2965AEA7238460B30CACF1394D7292F337E19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 918KB
- SHA256 c43f9ee9b483f98befbea2bb31ab83acfb99294b39724e8f758ee7a5f4273d96
- MD5 ee86f5f71158a4575b4f5a60895cdd59
- SHA1 8e0c950cd9a0f25e456b1ed9179781640140ba2e
- SHA512 566040e83050447c79647e236fa5983b308950433169b7268da20d4aa90d159aa528652f4cab4e8858d0a56bc95d7b4df69865d7da7d10e4623c0827875a4a3d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DKa:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DKa
- TLSH T1C615AE17E79014F5E8278138C9A64A22E7B1BC660770C7DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 951KB
- SHA256 854c9fc32092f1d998352de1e5994d0be05a6fe4664657139c37d4aadb99519f
- MD5 294b0fc2662828a006c5f36ad1cdf301
- SHA1 137b47da299b57f63475e7feedf6ba3774834085
- SHA512 4ec0b04a126270678fe9232338e5ce5337aa64dbe4514efff0603dc277782683356b9c2fed6be83f1abb8f9442d70d6133a4ff5054c5bbde957be220f944e8cb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DZb:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DZb
- TLSH T19B25AE13E79004F5E8678238D9A54A12E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 927KB
- SHA256 8578c09feb5ba01a1b65f4a13e222631e4fb5d74856832f4a8326585acf067cd
- MD5 d796b34537afd9a14e9dea9233d950bd
- SHA1 ac75dcee2ac3a5514611b77644b6f6bf217acc80
- SHA512 82492d371cc38a061b564b47b18f882d50b6d40ed75a7e4aeb513d5facd0c9efca09c64d2bdef43816ee9ff623bab172afaa38c32fe6ffb04d13a6159320c94e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Dr9:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dr9
- TLSH T10715AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 927KB
- SHA256 01d1f3d4278180578eac2c26df149e0ee7bb0ef60e398227bcdea055a696579d
- MD5 8064bf249d7ba413f09f4582716ec8c1
- SHA1 eb19985f48f85db737790019b77d5c50202958ba
- SHA512 0ec0d493b0de24a18a5a9151ca89cd7eaea8771956787ca02b520dcde791457ea885dcbfdd95c719420fca3890a3625b304682de2c8293aeb0170c5330590b9a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7D3c:A3mnXoZjzyUTWaLl3z0zDMCpxDS7D3c
- TLSH T18215AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 927KB
- SHA256 318490b89afedc36a63518a82f0a7eaf5eee22b77fc30b8f2ac674f490523de4
- MD5 ead8564743db464a94cd57f075932cd1
- SHA1 70c390501765e4f8fa732e50b3dea1fa1475b4e9
- SHA512 a8fccecf219afb7a313ad3d44facabc1bf8f9707270d4085456bd4817d1de1c7de905145ceb93a5273ca1dd2f50e4d25889b0d1529cdaf3ebd40421f64d9e19c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DAp:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DAp
- TLSH T15F15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 927KB
- SHA256 ed6156f20aca85fc75a595e97841cbc744353f961ed35a0a70f7c5bc24b1e360
- MD5 084a079695ab9b2a460355316788f834
- SHA1 c339df89561616a03033c5b44ff14f196b9858f5
- SHA512 e4ecfd0d7832f14cbbe280ba38df209bb4df1f35b72044b2451d21ce4ad03e8c4154b05861fdaf4486704055ef7c6ad6295c42dce91952cac71b5a584267d5cf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DH0a:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DHN
- TLSH T11415AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 927KB
- SHA256 e06fbac7a9a6314090b89518b354b2542d60a4acf1e0a3cf47f1e5dcd7139182
- MD5 ce0c9a6f1d1e7f4454f4d0c35b145b8d
- SHA1 e94625d8c1119e2453aca363df5c589dda60167f
- SHA512 a728a39e47d7cab64b83602a360d481181d51a46073da4d5fdac9e276fd147933fc053485c1bbef951546bb502bb06d85d63c82a993a6be80b11a2113f72f295
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DlF:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DlF
- TLSH T1F415AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 927KB
- SHA256 fda8d7895e17af611593fefc39d69d472fb27ca5fd8e0988db3fa838a846c77a
- MD5 9ac7f39e6e063d2dc5414c56b4dd40fb
- SHA1 8699a8f05e3eb463b2b9f24f4ebe1a4c96ed20f2
- SHA512 ea00eae0f0f02b6e74803c2dc7c44fcfe80ea4cfd457b9523434e3ee6ca1533942799c101a555fdf3b21299b72e9f728f592a7819018a37d1c61a984fd8d20d5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DGC:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DGC
- TLSH T1B715AE17E79014F9E8178138C9A54A22E7B1BC661770C7DF136892262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 927KB
- SHA256 e7bcc24d52af8a2360e33a40d453046359f6a503bcbc197fc4a9ad42687a97e3
- MD5 899e653fb9a32a87c8e0e2e653c2ec09
- SHA1 b898a85b78396b788b7489a9b52de750e41b89fd
- SHA512 fb0a06cc4c0ab1bc001dc46a045bdd67b2b34addce3fef13325c5ef3cf521f41aa89d6a1c52753709d62a6fa8cb7f306b16caf55144408f707fba6c5ded02e1f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DJw:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DJw
- TLSH T18515AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 927KB
- SHA256 5014b9c2557fe1359599764d3682ad521363c18e5798509607f99101851a8f78
- MD5 518b1c61d4a31a756eebe24edf2b0d3d
- SHA1 6f2432dbb4d5d14a1146f1f0efaebe47bce70c84
- SHA512 0b9c8941a579e4b0bba0ab6d3edd5019d80920f2adc42599cff0820fc8694f5078f7392c2c5b023d85a4e7cbcefc197665327b43c4e6fdd927fe0336a873db06
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DQT:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DQT
- TLSH T10515AE17E79014F9E8178138C9A54A22E7B1BC661770C7DF136892262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 927KB
- SHA256 8b41473b0d144ef44848336509cde2ec3e5377ce963b5ef6bc99179d4f77f8fc
- MD5 af585d64b9bdf9595a102d179e6e53ab
- SHA1 54f99c908bcf8485c10d6cc3a9c6750683d72fee
- SHA512 8609ce728d961594cddc2c2ff511791c4253e04a710ea8e5f0c557d364497d0528b99818c5ac6e60d0890ba520db8ed00e6e019d875f4f4c119b658173944477
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7D8u:A3mnXoZjzyUTWaLl3z0zDMCpxDS7D8u
- TLSH T11415AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 927KB
- SHA256 135f77a0ee93ab4a36804028bd0f844de91c33bf1795e72dfe80dee492cb7704
- MD5 ddb8edb4777139981208364813116d26
- SHA1 d423c4c4f6940b1cdff853c22c8e4111794410b4
- SHA512 9fed6c7818a419a01a1f0b3240031b54535bda4f065220f62b7166194f9cffef41a31eb8600697b83318b5af146effdc546d7e516f6507365aeaf52eddbd2ee2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Dab:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dab
- TLSH T10415AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 927KB
- SHA256 ec034701f8368ef11b4c02eff1da019fa33ae97f23c5294fdb0b5244a23e736b
- MD5 ddcea2019f096c9ea88344c286093deb
- SHA1 a21c278015ec0c6f1d47f011ec4b9a5c690a0526
- SHA512 259015bc2c9f3641cfab0c6b0291ccaf96c923b7f14316e6b26ef7c305fa4663e27ef771cd20f1765310fcdf3db0ca4c8bd4e04b730ed2e344380af792c6b785
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Dcf:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dcf
- TLSH T10315AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 927KB
- SHA256 c6695a8b49024a66fafcc557e2c33df280020948e3342879014794e1bd299366
- MD5 40093de68534921678e303c7a32f5976
- SHA1 b1724d04af7680818b3811ddf568edb57c68497d
- SHA512 781ee26dfef4c60b69f07478de42dc23ccf749fc12fa503e1fed351cf4d8093d5f8187a2276f2942acd6d69423c05edb3ca55af5f97596313f08e093ba27258e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7D5K:A3mnXoZjzyUTWaLl3z0zDMCpxDS7D5K
- TLSH T15915AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 927KB
- SHA256 be91fe16946fafd0e1877120d481452ecc94ed849ed0fe5719e57f0f16309043
- MD5 e7dea282beee04e93c0a440e9300a0d7
- SHA1 47b29a6573dcf5f8dc93103bbf5f739473067cc3
- SHA512 b04bc57b317066cf0b3d898a534a13c59fab514f4e86b1ab1c4a96bc03448cc3f83697468adcc9113bf6e1548ffeaa13bee865e5d34ff13749a4d091f9111c91
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Dik:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dik
- TLSH T10615AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 927KB
- SHA256 83d744c58b5fa6986830aa23bcb3359b379b87ec52758ba369aee21617fc83c4
- MD5 93bee1a717e5abdbf39a0d13db490353
- SHA1 2f897b66e74f75f0d2acc346471d5fa035d4855b
- SHA512 d39707fee0c4be0d3157e4f6ed89dcd45a023f907616e6eb6f67d47d1c6659d996562ecc7be1156b87e172bd827fafa8b9d48473e80107eabb37fa7242b4576b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7D30:A3mnXoZjzyUTWaLl3z0zDMCpxDS7D30
- TLSH T10B15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 927KB
- SHA256 744032b2916e04b880dec89781fa5a9b22db0e407290d288b6063d03abe63fb1
- MD5 4dff61fc39417a1f9bb7207bdf258bff
- SHA1 23abbbc2b87ee9fbe0c8ceabf05bfb92b4e7abbf
- SHA512 5bdcc4f1edacb3b10bef09ef4fad718a92641a812e50999548263e0a8bb42819cf247d74aa5715d7dab3feede85c6ccaf05baf7f77cffe62438ed59e45aa0668
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Dm70:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dmg
- TLSH T17615AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 927KB
- SHA256 d7fee973c3d1712c8eeb7d4997056742684f6d3ef806f38497e981975e32d7c5
- MD5 319a81a9967c2a7e0321d8ca9b2b2ca5
- SHA1 941c2a4fb863abfd14d286ef100fa92bc36e4fe0
- SHA512 cdab4ba314fd13eb96d46fa4dfe43519a822493ec714a2bfea036cc6438bc762611102252bc6154e8d6b2e598ae90bc1bf945a0bbef189dd297df50e278f6346
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Dvr:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dvr
- TLSH T15D15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 927KB
- SHA256 9b21544056d2d6294b64abe73e9936b4370f8d968accbaaa320325b3024612a9
- MD5 889417dc4eb100ddfe24253bdaef608c
- SHA1 c217b264a337f5cf701316e3a711e0e4f1493406
- SHA512 6e79d5c34637f726725fd22107bbfaf46afe8eadfde122890f685e66f720030514674b63ac9da97920dee42eb970fd82ef4360c3259f28574383296c5797327c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7D5n:A3mnXoZjzyUTWaLl3z0zDMCpxDS7D5n
- TLSH T19215AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 927KB
- SHA256 dcdfc09f76c78f617572f194e04008fb59e51c4a1546844c5e12f48e32a86400
- MD5 bbc45935c8674deeca53da8912bbe326
- SHA1 5e60e34156b3b403db54463257a6cc26a34c6e42
- SHA512 26b615e19ddfc8ed54ab7832dbe89da2074bb922b830ca5d7eea556b309f51e2f9b2fd5a48f8b0191be2ce6ba1e01c6e72a6fcf407fca2e2e9b90d2f1c79a109
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DVx:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DVx
- TLSH T11B15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 927KB
- SHA256 e9ff5779f24bd12bb9ef4d03232f86ca759a3c390e4d77fe11ca5db6abfa04d9
- MD5 e1b19e4ceaa975e044fda946f08f3b6b
- SHA1 167cf2283548abbb74f7cbf1197748b883b220b3
- SHA512 dadf3245b91bfba0d4975da1f970070b321e61ba7dbef2d5349981a4e71f9455865aa7a0ff3b8c2b38ace9254af77e5f00fce3e86f90f0aafc6a944cf45e5767
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DLA:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DLA
- TLSH T13A15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 927KB
- SHA256 c7f18514a32fdd499ca0f183d35f9e02bbcb6b2256cc2ce1a9c0310a19ff9985
- MD5 8dc80600715c6517bb05f32e3cb6ba48
- SHA1 dc4e09ca9e8caf8c45f9d836992af9fc5f28709c
- SHA512 a802ff2eac8359abf0cfd70797c9f2ad1a94d6340846f50eb3db3a3f27be5cb26e83e440ff548835bfbd75cfa448e09c242fff6b73b8a2fb3ab704cac59258fe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Dc9Q:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Dc9Q
- TLSH T14515AE17E79014F9E8178138C9A54A22E7B1BC661770C7DF136892262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 927KB
- SHA256 8df12996f4607192f5811e05d4e61b43a72f80dae154c9c0ed8666a0350d5fd2
- MD5 53f9b7e2b41b111651fd799abbeea79b
- SHA1 975e5212b6f9d3fabffca3f174d7d45f2af8880d
- SHA512 45680c87741f9f02e7e99b4182bf2ca8c94b8c371f923a93ab5ee6b5542f6e885dbb2c2bf4cffa97dc1bdf0946e07f6ff674c9fa6d22394c421c10896bcb164e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DF4:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DF4
- TLSH T1F815AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 927KB
- SHA256 3a3993ae49edde88381e443ac959c9c68fd0c7e6adbe891ecd59a5e3c6feef46
- MD5 a1003c96247bf4fed06e38fae7c0d82a
- SHA1 a67442565a2d1170293adb797b6a892025ba7650
- SHA512 08635dc495e1bcd6e369c78e0cb0be5903c6b0ce500a46aa7fe7d59d388af42fbd0f6c022582fe359dfa64bf7bb77755379ee0188a8af5c8b6535b585d10380e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DQu:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DQu
- TLSH T13B15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 927KB
- SHA256 181be39f7f849e3893feb0d8205cfc7d13fea5a6cd70293fc197f2944361a66f
- MD5 a65b8fe092f40f3e16b40063800b157b
- SHA1 b5c308dadb4235146b8dd5c17cdb5b30d7c07ce9
- SHA512 5c0b36dc45a0b2b7c1c4146cbb0d88b43dfb42d831f0f794f68c6011eb3701f75c13e6855b0597cbd87d51b151b61c9b5e43beda18a091b77560fd06cfad9fd9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DRj:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DRj
- TLSH T1DE15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 927KB
- SHA256 2ec06778ed0fc89ed6e5ec172434f2e13486e9e68f30f101d58442d8118e3076
- MD5 7897b348720893592d7fb6acada236a7
- SHA1 4ac1648883599a57e8a588f811a88d34b4c52b62
- SHA512 5f659884b5f53b194c8f8692fcaa05116bed1f8b4cd07a2d470fc4f03471a62ccb0c30588333b6fbbc655973a7e7739f2a9daaeb844fda9170abacd81f3a35ec
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7D4g:A3mnXoZjzyUTWaLl3z0zDMCpxDS7D4g
- TLSH T1BD15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 927KB
- SHA256 ff5dcec37ad8531d2e871717e703d989a17b08718633f2833515bfe6283a49fa
- MD5 29a0ef81000be88fc959c66b8a0ad7cb
- SHA1 12ac7e0af837f803db1ddeae6d02c5d3f6e5d487
- SHA512 dec28277c7e62cf48aca95427d393f5df88f993cd6eaa4fe2fc8499937a97c66c40c287bb1fce71bfc434f0930b1bf7f87ac5e86939193661d2243606a864055
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DXI:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DXI
- TLSH T13715AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 927KB
- SHA256 04b10e304b98d7891b42ee264244df8baf4df525269e7ce96414398cdedf166f
- MD5 434c944b19f22d216b597e1b825ba9d5
- SHA1 5ecb0312b3a0d6a309d4c86c742ba83f29e87d6e
- SHA512 f67f6aec22c4102ac99f4b297b6766c229d636711a7a13f61740ce173bfa72bfe41380b5d3aa3135b4b8e07ed2c003c452f1886cac17492a6a48dac548693c04
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7Ddo:A3mnXoZjzyUTWaLl3z0zDMCpxDS7Ddo
- TLSH T17D15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 927KB
- SHA256 15c16e048c11378f7448d02b7f22cea8e936a352ca837287e36c48645c509144
- MD5 12e53220d1bb436026ec7f4382846915
- SHA1 80461e990d6e0407885d8b3f9dcded24656f0eaf
- SHA512 af9ea89eb6c70379af9dd44cebe61d930a94f4285064ece8a7ee88562e01c48ad9ae2f0f12569a76581b2affbd198b5762a6ac648dc771ec2381595b5b8bd969
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DO+:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DO+
- TLSH T1D315AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 927KB
- SHA256 4b5cae29f99d29aa9ac4fa0a96792c87239ec9ef478564a913afda9bb20be2c6
- MD5 327851a12c52675dbc299121c7616ef5
- SHA1 7de6f1c75334e12e0aaf8b6c50cf0c5529860919
- SHA512 10a03cda110e785d90f9be49fbe08987669f1af1f3b5ebbf7648a1cc3b244b4d4518dbe44985f2aafd9c5807da4935222651dac440d0783ebfe849c4fe53fd04
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DOQ:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DOQ
- TLSH T19815AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 927KB
- SHA256 113880b230ea46de1ed2fcb5a3b266da0db9ebbe341ff2a9e4fd8675e2b4affc
- MD5 73cfa5c1ce4c3801834f7875f3f8bcdd
- SHA1 886a05a52a52cae3b5931752f8b3082dba319c41
- SHA512 11b828841158f90bb7f1f8714771b673f7cd7d5ecab5a719112527c768c5f2e5e771c6bdf91e9747dc11201b26f42a8d9d2af6ad4e04d0b87450916feb7eabce
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DvX:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DvX
- TLSH T1B815AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 927KB
- SHA256 5616332ff1e2ae3098710653f7971dafa9b587314c8cb1d8bd2b3fb830f547a3
- MD5 e85da2673c1f4b70ecd830b3468a02b6
- SHA1 0839d9ba28b4cff41769f014cfafaf674e81cb6c
- SHA512 3696ee3636fa3c5091da6c705ab9db8be3edd23aa552d2d71781459f007b1b4f2a5b73e75e32492b412f1f909f19c0cd286e6475177f609ef3d7118e56f918d7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DlL:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DlL
- TLSH T14415AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 927KB
- SHA256 3352d4edd20da5dc7861b78f40b23eda428923b67fb38c8a16576069dc90cc65
- MD5 f87b50b85fa28986b3fed99f820b5551
- SHA1 6dccf71e03674620ffb468b4933d7664f2cd892f
- SHA512 7a890c3faa121f92712fa96747339e94d9b68dbaa654651db0f44640611ff491e51356025efd99bd3e62836899bed330e1bee8ff31c377fcaedb69093ae1c851
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DDFC:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DDM
- TLSH T17A15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 927KB
- SHA256 0405fe552a3b0b181636a7787c35a377969beb4cb538b4365c1c8be5700bd7fd
- MD5 1a1e07c9230f9622d66c3b0bda5cbe70
- SHA1 e386966632aa0fb0cec8ac7a04815553cff5fb4d
- SHA512 c422e0cc56dcabc2073510678ba475e4e03f0c4ae27cba4c0447b7acc9023c6ca3ba22223133228e765dd447e0e5bd559a2942d846f6419bd067b25670abe7c2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMS7DEh:A3mnXoZjzyUTWaLl3z0zDMCpxDS7DEh
- TLSH T13C15AE17E79014F5E8178138C9A64A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH