Analysis
- max time kernel
95s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 16:27
Behavioral task
behavioral1
Sample
2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 827KB
- Sample260810-tyf8aasgrc
- SHA256 8eb469f9a2020af46ce701df5ac3ade2595ab861b4eb6f9bbced33341b2376b6
- MD5 48f41557ed00ba61548f73f2abe348d3
- SHA1 09957039829fbd7167289b5c55bffdfaf3391cdd
- SHA512 a8987861d3fb79369b300c9e3d244bcdb1792d270ccb17b04d84bb19acc211b2239e97162db483f7c6328eca8b0c4c88dec07e9d6bab154733c37157e98be915
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4j9:A3mnXoZjzyacNVOE/ELaEh5zyp4j9
- TLSH T13805AF13E7A114F9E116823499E60A12FB75BC661B60C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4836-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c566-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4836-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2332-203-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-457.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-653.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-726.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-839.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1042.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1135.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1166.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1393.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c566-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-270.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-457.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-573.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-616.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-653.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-726.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-739.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-839.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-890.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-903.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-916.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-929.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-948.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1005.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1042.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1061.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1110.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1135.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1166.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1179.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1204.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1320.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1334.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1353.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1372.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1379.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1392.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1393.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2332 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe - Drops file in Windows directory 61 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4836 2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2332 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_48f41557ed00ba61548f73f2abe348d3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4836
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 827KB
- SHA256 8eb469f9a2020af46ce701df5ac3ade2595ab861b4eb6f9bbced33341b2376b6
- MD5 48f41557ed00ba61548f73f2abe348d3
- SHA1 09957039829fbd7167289b5c55bffdfaf3391cdd
- SHA512 a8987861d3fb79369b300c9e3d244bcdb1792d270ccb17b04d84bb19acc211b2239e97162db483f7c6328eca8b0c4c88dec07e9d6bab154733c37157e98be915
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4j9:A3mnXoZjzyacNVOE/ELaEh5zyp4j9
- TLSH T13805AF13E7A114F9E116823499E60A12FB75BC661B60C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 e616fb8941526d39d5927e8e6dba78fa519570b2e1f3bdf2c5d08cc30519ff0a
- MD5 79d181bf6ab839e34e955a60d27d3a85
- SHA1 2a044925279aea0236dc31d1168fdd6e73ff5aa2
- SHA512 6e4071c08cca479c698675504121709f6e8ad8dc36530b9cf72fe83bb4a2bd8e4478cf9bb1c5d4c34a4c6c794548bf0484ec70857eda0253eecaf9b764cf475d
- SSDEEP 24576:A3mnXoZjzyacNVOE/ELaEh5zyp4jJ0Le5ji0hmxNrM:A3kMZTPji0Aj
- TLSH T16C656B17F6A442B5D033C179C9E29A5AEB7134521B308ACF1399C7282F27BD19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 842KB
- SHA256 d09a956a8619df0a1c2b70afda941ab7f8790627b5a104521b254921311c09a0
- MD5 660a3e2c05363b736971e16e8ce23749
- SHA1 00485208d479524fbf649a8df88fed7dd9691f6f
- SHA512 2c55b7ea9457d27f9594aac75cc6db462921874c09a9b3b2f97a580bc80dc4526a0637640c4b99dd06e3d15bd9ad84c72969c414bb90cb61268e2226c3411852
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jba:A3mnXoZjzyacNVOE/ELaEh5zyp4jba
- TLSH T15A05AF13E7A114F9E516813499E61A12FB75BC621B60C6DF236883252F227D0BF3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 851KB
- SHA256 43de2cd35da02254d772f54ad8352219cb4d1c0c8e905f877062962abbbe1575
- MD5 aa495451ab1cef32a0718c9cd2c40eee
- SHA1 1e3256440b7539b854087ff7f5c768982d2adce5
- SHA512 213cb86141500ac88ba3aa952193724b32a4a425a3f262f8098712da11d4c53536a3340e89815cd49b5f710068902bbc19e4bb7b762b10d09cd3d92a69afbc88
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jq9:A3mnXoZjzyacNVOE/ELaEh5zyp4jq9
- TLSH T1AF05AF13E7A114F9E516823499E60A12FB75BC671B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 851KB
- SHA256 b475bfc32245b06bc5121c992e69584530285bd98ba4afa71ee41402ea69a503
- MD5 d726c8900c359f624b51f3bd19a3acaa
- SHA1 254fe85e7fd040191c46b174847e1d5075e6514e
- SHA512 573b98da34e4f36f7103677c96331eff62319485f24b7fba5ce53900dd0be3d6f470b44ea84ab9f1bbfddd2aaf9c0d709ef1abd93863d2910fad346b5abd1725
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jqc:A3mnXoZjzyacNVOE/ELaEh5zyp4jqc
- TLSH T18D05AF13E7A114F9E51A813499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 851KB
- SHA256 1d764137dc959b37e5d393edad2c01652cf8afcce9c2330f76d0f07ef4db197c
- MD5 5bef70710f58e67b5a1c055ec50192f2
- SHA1 e8870ba3090436811fb624f66ddb6841d8087921
- SHA512 b34d364932defa43d30c8d34a2c4007f4b40792665f4d2285b8fba73c9129e3cdc7429b53966f45393c56f0ecf24acdc26430f73a2661a09e2bf1eea4b42592d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jjp:A3mnXoZjzyacNVOE/ELaEh5zyp4jjp
- TLSH T12805AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 851KB
- SHA256 63a0bd5bbcabb8f890e0017e5cc6ea0a6e84f820ad9270043bc4ffaa2555daca
- MD5 a1862539a37d6fb312492b1330ddf770
- SHA1 cea7461edb4d03fb713cbcf25bbda8a53aa8c942
- SHA512 72607080a9250562171b25518bbb8b22376033230179f78008ff89fa3f99f30588584b9545e1f2e4d008582c06b9bf99ba5357562e29c0a6df6a97aeaf079edd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jE0a:A3mnXoZjzyacNVOE/ELaEh5zyp4jEN
- TLSH T1CF05AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 851KB
- SHA256 2ba1221056f1b0816ef4258ea56ea7fa851dded5de319361356f60f211284e57
- MD5 b10fc1d143d6829afbd6e3dbf5c9d0c7
- SHA1 1c16c4f209dbc6ea3bd10402e2203193d66ff64c
- SHA512 e76518f11b821602426cd276893c07c2e2a7c2a4c5159da3e5db4f06744f8b5abeec46a0e6f69706ae3dc01cafc6f58cc2b0d7486f4d5ce2824c1ee7c459d93a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jsF:A3mnXoZjzyacNVOE/ELaEh5zyp4jsF
- TLSH T16E05AF13E7A114F9E516823499E60A12FB75BC671B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 851KB
- SHA256 ac8ebb90ccf53a11443e624db15cd68fe19a42cbe191d2876b839c209f99999b
- MD5 72a5026a540af84804e7dfd0e3d953e7
- SHA1 c0b30fab1941cfa12a64b0c20b49150ab849f585
- SHA512 3d5bb1247274fbb28b95f4ed15bdd172427d0f1ba43a28e9a1663e14fe00aef8227307a09996ace784e76405066578b837a784e83a88b309abc983214d8e2dea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jZC:A3mnXoZjzyacNVOE/ELaEh5zyp4jZC
- TLSH T11D05AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 851KB
- SHA256 dac9caf4aa52eecd059641481b26c1d628a0021004120a022ca7bab611b18e56
- MD5 d8c97f0b19b02d4b46a0c852d26f3ddb
- SHA1 24c62eb0d0beeb58f036606e9ca73eea2f15bddf
- SHA512 4936ebd279c7eb470698828399e9348fbc80daffa031f6727096e86e9a7e914d2466dc01ef68b63c3adcbdeacb58e444025523094a7e98f703c488e7cbabc995
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jaw:A3mnXoZjzyacNVOE/ELaEh5zyp4jaw
- TLSH T16905AF13E7A114F9E516823499E60A12FB75BC671B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 851KB
- SHA256 860f95c9ac1222ae0d84296d78ae351aaabb7455f45a3b53259f99ec423cf786
- MD5 db3f1559f35b29be74822ef55e3a6d7a
- SHA1 bf1dd75e852eb2397632ac8ca99b821fbb644d19
- SHA512 362ab28840fb1eb3f53c7a455156e4799acb2faa4f2d4a51501e2adfe851c05d1c4b6a281921c1375c234335eb498c907beb6615ba37ab35d43e0d9ba27f5e07
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jhT:A3mnXoZjzyacNVOE/ELaEh5zyp4jhT
- TLSH T18405AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 851KB
- SHA256 97be06df15285acd5000950fddf03125b1e3f635d5f609f4599d03cd76bfb05f
- MD5 00fbe09c13ad1cfa1a55466c89d66d00
- SHA1 621348c526c8b4216fe1c181f038826b5b595ccb
- SHA512 90ee0638b52eb7dff62276acb2440bdbb8edeff957ace4bd44bda51da057938b57101ccc6ad145e1a74b10cc2bed4cfd55b736d0822c84a2ee6f7e9d71d075ec
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jPu:A3mnXoZjzyacNVOE/ELaEh5zyp4jPu
- TLSH T17105AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 851KB
- SHA256 714a56f5e8c49351ff93e085519b6aed463b7916c438e85229a0b8906b536eb1
- MD5 da903a1eb9576de48bf0a428c63de0d6
- SHA1 99538dfaad0cb36c73cc03adbe386e1e14500efa
- SHA512 b0a9c3a0824ec127ef1635754dd9893fcd637ce18f78c4c1eaaae7ac3f3f625416b119c2e86acbe346426d73a33a3a006da7876e13b25f89213b7cb58d292fb4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jzb:A3mnXoZjzyacNVOE/ELaEh5zyp4jzb
- TLSH T1FD05AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 851KB
- SHA256 329594e4d2c8d048c676e5356ee19d10c1329d93ad3ff52611285ade5984041f
- MD5 5eb07945bc66508119834109bd80e818
- SHA1 b9af6dd5a572bdfc5de709fc2c25801f59903ab7
- SHA512 860c00f402ba760544755b938eff4f8b8c9975e1243cbf261c58c84101287e5ae532de4f65685b0bc3cda34e661a7a1228499619b731b34c2eca45fb73acf9c7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jHf:A3mnXoZjzyacNVOE/ELaEh5zyp4jHf
- TLSH T18905AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 851KB
- SHA256 20757c330711f66530ad5beebf3e95b412a72d70ff68bcf8d15997d7102e8878
- MD5 1cbf0186997fb5e1fc75d91297e8ca08
- SHA1 c285aae2b92a1b56796819c7c66d5c6ac7fcc8fc
- SHA512 6f3d5480266e64459421474d46c339b0446d7f1829c2f742495e9f3053b10113c3e78512e4dcfc4a24b0fcd8e508cc43acbb3361c8d4c8da0666c60205fae917
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jwK:A3mnXoZjzyacNVOE/ELaEh5zyp4jwK
- TLSH T14305AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 851KB
- SHA256 ca17b20c16450042fe04732648bb259e8976480941e0bb57100c3ce2b0ca727b
- MD5 5cefca0024d103c4cc0dcffdb439479b
- SHA1 21e37d2d70157da85bb3e6b0c290e5297f5974e2
- SHA512 195515e51a1ddcb2b194a968afe8bba008ba34294d9ad36801031b0a65def05b3f2fc61f0bcddc1ed6b92384549bbc168d83aec225c7c523e8c1b814f1e2a1cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jtk:A3mnXoZjzyacNVOE/ELaEh5zyp4jtk
- TLSH T10D05AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 851KB
- SHA256 89b7a3375737ea37b544862ace2ac6babb90b9a5080960adae1cf73bbfde814a
- MD5 75e50a72b554b63271ee0ae1f23928fb
- SHA1 cdac34c49f482a13e052165248d046a540eb5a99
- SHA512 20e99420caaede51922342f8f2aeafcb06f0d60ae3673710abebd80fe4b2a333f8e18cec609ce3f9c632bd7c7dc1731217ad6201dba814d79af4e9e56cf1f5e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jy0:A3mnXoZjzyacNVOE/ELaEh5zyp4jy0
- TLSH T16705AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 851KB
- SHA256 b8f062955dd969e432887bf549c177f53e607214039387e814a7045ff1910b86
- MD5 790f0ee70d993b3842ea2dcc599603fb
- SHA1 393bd4b0da030b2d99c9db3bc273e58daeba13a4
- SHA512 36abaf2dc9002659c9da6af5ac6f228470da845d30c071eb79f6fb467cf8aa294895532873ff10326f06b29395943e1b71d1e1838af86c9f5b5ee0c46cb98c73
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jB70:A3mnXoZjzyacNVOE/ELaEh5zyp4jBg
- TLSH T19005AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 851KB
- SHA256 f7949d035c031e73e9e427d31b8412732e02d2c98fc8dfc6281cf5d74016cc02
- MD5 8be402e91ce20f8808e270dc0ba25910
- SHA1 934368a8620702cfb8e02aea0edc5b84d1eddb26
- SHA512 e3531595cc77d77aeacf13477173893a299c151652a2defe871138f2f25d3287bddb84f0cbe71010f29c90ce9d00992db687097354125611c9dc470adb1b1bf9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jor:A3mnXoZjzyacNVOE/ELaEh5zyp4jor
- TLSH T1E405AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 851KB
- SHA256 11203e4db1715cb96b64788113a141823f1296b149d20dcd60d85ecb29246c74
- MD5 bac2973714e560658157d97063e9a504
- SHA1 d65a31e50e55448abe366fc65c57e408fca27dff
- SHA512 f2078c801704c69deea577d617768e2d267960ea12503b61b695c4c3698de1f1ebeff597ee94d06054418f65574e74e745098ea7c2a1dd13bf153a1f87a010af
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jGn:A3mnXoZjzyacNVOE/ELaEh5zyp4jGn
- TLSH T18705AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 851KB
- SHA256 1620049e7b603aa324a2e365abdb83f5185a965ef9ef559d1af4049b95c83fb5
- MD5 25173a0e373a5686838251519a04943d
- SHA1 15e20fb9a75c38067751362fb7a5f7986eeb0ecd
- SHA512 bdd42c57b5792bb794269d11be3b3a0e6bb61417b03b9452585d6d61692e8cb0938bf094ee7ded2809b0d06f0369f83670dab49acf04c20173bba3832eb16d12
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jMx:A3mnXoZjzyacNVOE/ELaEh5zyp4jMx
- TLSH T13F05AF13E7A114F9E516823499E60A12FB75BC671B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 851KB
- SHA256 ebd480bf7c34158cd805a76a1a1ba93ca2307c83b8464a401df4aed2b42054c9
- MD5 594698a069d0a532b6a204d826a7aa5b
- SHA1 bfb790689619757b293a5cd35fabfa926654d01c
- SHA512 8dbb985c9edf71f09f1da659d5475ff675f2c14a07a91f7eebaa9d152830fe716951bdd0cf6dfc0a668eb06d11e49ddf941c363674afec374bfed5bb474723ee
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jGA:A3mnXoZjzyacNVOE/ELaEh5zyp4jGA
- TLSH T16605AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 851KB
- SHA256 973522944194bc0310d1cec6ab5c82d4e2e8039da18e315eceb0a2b039c812af
- MD5 057928a579a71b464f0ab3f2e62f463a
- SHA1 49fb2216aaa03c51f8c650b71512dbd1fa4393e1
- SHA512 5258da02f021291c5a90a38d86b787fc94346cf93d737c48b7dbfabf06b65b8294dd79e8b9b4c3aa1b7fcf3d76b0813643cf2b6e0fabf8cf74ab222de9854a9f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jf9Q:A3mnXoZjzyacNVOE/ELaEh5zyp4jf9Q
- TLSH T1C805AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 851KB
- SHA256 61c75b413af54c530b53edaab1b63633115ac252a1ed50f274d52da1b8e8b761
- MD5 b254b7e2920ca328d75f6432c31a8bf7
- SHA1 ec073bee03c5cee3076992d57ca3ad558f30fc23
- SHA512 b22df83aae34b93d6fe84001fc03a9513d05e18a33efdede10979d91ea23aecdbcf0abc31ec43f82b4544e83f1a7b51f1f8cb5c009dbce77b1dbee30b98e1728
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jW4:A3mnXoZjzyacNVOE/ELaEh5zyp4jW4
- TLSH T12105AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 851KB
- SHA256 d381d5121b05e76b8e6414c3db030d80d4da52d19a4b58dd73ea3bb159f7d680
- MD5 a109ff8ac0664cb12924b18fff780b54
- SHA1 f2ce36358a61ab80803e6553a3c0d07acaabfaf8
- SHA512 63fa51aa120f79e6e4d3726687fd0c8c1b5329c0edf0a87fd5c5b34623105405df32afa4c33e4fb446b6c9d4fa3b96fff12127bc32cae0e42b6975f0f3c7263f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jFu:A3mnXoZjzyacNVOE/ELaEh5zyp4jFu
- TLSH T1D305AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 851KB
- SHA256 9069bcdb0f5260624e39d880c91eba1cd25a1d831b507c85d830f27cb22f1fe9
- MD5 ad29d2e88c527744dbbd142fb5df4fc8
- SHA1 090173fd3d86f9a01fb6bad6b3b316c728fe8e8a
- SHA512 fedf2fab667d13ca6c7a75345b3d106c4e8ce5bc07f04bd3d4843330fae299c39e8875d3fa1a5a8b6734e0eb2828295402ce758464e3a59944a29e167b097f63
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jYj:A3mnXoZjzyacNVOE/ELaEh5zyp4jYj
- TLSH T14005AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 851KB
- SHA256 1348ec8b8228a83903bbcce8a1805bcead1d3dc318d7d758797691985b151f9e
- MD5 dc3b325c4be1dd94148b5f0172869cc5
- SHA1 a32f5be7e5b831ae8948df80116697a8824c012e
- SHA512 f0d6352f3be6ee67e1fc19b7409e738c2702e552c7a447d286986b8390c56c8c5f2106b210fad65e17a47a174b0fa5c1fcf43d9658576df2071fcc189bdfeda0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jpg:A3mnXoZjzyacNVOE/ELaEh5zyp4jpg
- TLSH T1EB05AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 851KB
- SHA256 6a5af479244c9f6179f5a4bfb5a90debbac224141666f63981c4ea5622b74c48
- MD5 62cf4968813cd93be44c80c8dbc23c1a
- SHA1 370963241b11d49eef171fc7f37a512a0f4c06e7
- SHA512 ee246dcab5514d203b920fe775497d2bf390c6f6f059282a4cc472be53c7e9863a6157c68c14db530d866c868b655aca0035687d0cbced83ccd053ef47b9280a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jwI:A3mnXoZjzyacNVOE/ELaEh5zyp4jwI
- TLSH T11605AF13E7A114F9E516823499E60A12FB75BC661B60C6DF236883252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 851KB
- SHA256 9a6cacc3d81f777569c3acf4a3ffeb129d0b39b7254786332831df0e6ccec785
- MD5 29300d7d3b89c67d6648e84bf364d79c
- SHA1 27999a34df90c1f51e7fbe5cda847e64d27805af
- SHA512 1a4fda4ea218183314114634bd7634ec2197e4690bf5e4f0f339169c9c9532b3dfdcd1d212ce0b2c7b83ba4a8c1a1af7d3ad3fbd8eff0c02f052c984cf606a12
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jyo:A3mnXoZjzyacNVOE/ELaEh5zyp4jyo
- TLSH T1E605AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 851KB
- SHA256 f757228d7c95675f20f238a341f50eb0a557372840c613c75481a8705e49f067
- MD5 90214bf3a5a2ad3cd533db1085e4ebb4
- SHA1 c131bbfb6b4523657e88d2b9f118aae67540c11f
- SHA512 64887919cb457c25072692471554078b38ad5f8802670ddb0081463c304c0c1bbae8301302ea2238c26860cdf35368f2ebfdfb0caf82928a0da6f174b56a5332
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jp+:A3mnXoZjzyacNVOE/ELaEh5zyp4jp+
- TLSH T13B05AF13E7A114F9E516823499E60A12FB75BC671B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 851KB
- SHA256 73286fdc4c1947cedc7d160191999a2f449027841c98b25027ec26c8c9f16eba
- MD5 33264872801290c308cb5ade33552c7f
- SHA1 78ea9484f4bcd1ea06c8d5cee45aac1cb1aa49d9
- SHA512 1842fc5ee6f70bb87f9330528fdc589637da3003a895e740722ca059ebd0ab0326f8f74657d8caeb26582dc7d2c1975128f5ac0b245cd46e692962553fbd1814
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jXQ:A3mnXoZjzyacNVOE/ELaEh5zyp4jXQ
- TLSH T18305AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 851KB
- SHA256 442c7a13d53b4b0c9fd10139279e58ac7b4dd2c2699194c01be711465e60f0e9
- MD5 89188c41b42f9838e995f044fd50797b
- SHA1 1e583b8bd5f327477bab8c5bc5e94d43db6bbf02
- SHA512 a0ff4b1bf3c2e1262b67168f4d8b1afde7bb973980d7fb0e017693112f8c4b5ad7e1d98693324a37f40f564eefa640999d29e780fef4bdb359018b399ed17178
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jsX:A3mnXoZjzyacNVOE/ELaEh5zyp4jsX
- TLSH T1E105AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 851KB
- SHA256 2e9439ef0e4121ead0dd1c72e804c823138bee1eef561819e81fe561a24d07fe
- MD5 83fef52e8395f035dde18e24b8bd0434
- SHA1 06512cb5b6043cc8bb144c1415b7a3125cba4b0b
- SHA512 db572de2aae49835192439610aabf7aa95af27ccd0053f5c00f20c3ad54d44cd85899efcfe179186d1372d6c3650e8ce5962a04762166ff5259dcb013c066977
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4jKL:A3mnXoZjzyacNVOE/ELaEh5zyp4jKL
- TLSH T11F05AF13E7A114F9E516823499E60A12FB75BC671B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 851KB
- SHA256 c563c4f17f0753b8f99f61bf891f6a816d2c0015b4e0112b2baa2f49f2749a74
- MD5 efb7a32a4888ee05af139881b152737f
- SHA1 6da8a8c4c38b5e57ff0220183c154ddd392f442d
- SHA512 92124ca4a86736a7865aa6ae8862e4d9d6c76144a585623ea6003a8437af0720a4ead45990ab643e37455b9d21f97cb507ea513007016e0aeb95afccf8a0514f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4juFC:A3mnXoZjzyacNVOE/ELaEh5zyp4juM
- TLSH T14505AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 851KB
- SHA256 7a1e5e479d43025c8817742bee1c85be04c979b2f015f9acba23b93c7791ae0b
- MD5 4184e75a3527afdd12f189f32da6188f
- SHA1 c942b4f529cfa4f0b3f6466ccb506cd107d0d0ff
- SHA512 dcbb8a500f6216da44c877a87346da9711c5dcad8124a66c2e83c6ab26caea6c03e227b1639a122c28e75a3f3684abec247ee06c8b102e81b8796306bdd3037f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0kaEhYyPz5L8p4j3h:A3mnXoZjzyacNVOE/ELaEh5zyp4j3h
- TLSH T13005AF13E7A114F9E516823499E60A12FB75BC661B60C7DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH