Analysis
- max time kernel
100s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 16:29
Behavioral task
behavioral1
Sample
2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 683KB
- Sample260810-tzdhsadj3w
- SHA256 b8d570939246f99340fcd8df94dc0a2d0a81a0bb086eb14931cd60a0fb34be9d
- MD5 3c6aa984387b47d590fda99fa5962578
- SHA1 65f4648cca6313e75c5e9e3dca2a05180789fdd6
- SHA512 312c017185207702ab297bbd7eddf041dde75c5da273f45e3c38546ca4f99d537c426d86fdfd97d9a7fee884ecb465830ce52b8c19e498d7f75abfc70b0e398a
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlI9:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicq9
- TLSH T15DE4AF03EBA104F9E11A817099D65A26FB75BC631760D6DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/5904-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c53a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001848b-106.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5904-107-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3100-168-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-253.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-588.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-724.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-843.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-875.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-986.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1085.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1360.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd0-1548.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b67b-1909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b679-2002.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000172cb-2108.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c53a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-39.dat aspack_v212_v242 behavioral2/files/0x000300000001848b-106.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-253.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-447.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-490.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-588.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-619.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-644.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-724.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-843.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-856.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-875.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-986.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1054.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1085.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1134.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1141.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1172.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1186.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1224.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1328.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1347.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1360.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1379.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd0-1548.dat aspack_v212_v242 behavioral2/files/0x000200000001b67b-1909.dat aspack_v212_v242 behavioral2/files/0x000200000001b679-2002.dat aspack_v212_v242 behavioral2/files/0x00040000000172cb-2108.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3100 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe - Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5904 2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 3100 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_3c6aa984387b47d590fda99fa5962578_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5904
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 683KB
- SHA256 b8d570939246f99340fcd8df94dc0a2d0a81a0bb086eb14931cd60a0fb34be9d
- MD5 3c6aa984387b47d590fda99fa5962578
- SHA1 65f4648cca6313e75c5e9e3dca2a05180789fdd6
- SHA512 312c017185207702ab297bbd7eddf041dde75c5da273f45e3c38546ca4f99d537c426d86fdfd97d9a7fee884ecb465830ce52b8c19e498d7f75abfc70b0e398a
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlI9:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicq9
- TLSH T15DE4AF03EBA104F9E11A817099D65A26FB75BC631760D6DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
- Size 968KB
- SHA256 0eaacc51676be092979e2c780c39ac79c623f349628774d0b28486ccf67c6059
- MD5 77a4385eb3d8de393b3b42db217bd5de
- SHA1 9bb2e8732c3b3c28b983f3b5559346b412e8a9e5
- SHA512 5c86e55e948c0b37d229d152e0b06084a17503692651af55ec6d8a5a4bb5141a51256b8d8689331ee81307d5803c8792c1fba440d454ebbd132da18b62bc44d6
- SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaicqSTWaLl3z0zDD:A3kMCT1Llje
- TLSH T12B25BF17E7A004F9E9178134C9E54A16EBB1BC661760C6DF136892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe
- Size 946KB
- SHA256 fededcc327f672552e4ee61928b05bc7d437a57496675c8666558c678410e0aa
- MD5 434bd97479e38bf040db905bd1d99618
- SHA1 f383a2238314da804237fb1b3652ebc773c21c25
- SHA512 7a03e321cd95bb960a2443c090a49a1df83c7f03f4918bde7f9f85a9cf7ee941956f5b6f739593e0145b42ad0bdbeab0e6590b82826ef29b24201e0099e2426f
- SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaicqtMGN/v4mWLqYPhOp:A3kM9Mu/v4eY5Op
- TLSH T170259E13AAE400F6D066C1748AD59A23FB78FC7257508AEF535487191F22BC06B3BB79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 782KB
- SHA256 94fb5ae92eefc049aeaf7fb2444d55ea510c3340854811a2285e38cd893e97ae
- MD5 ede1d599597b580628c664c6b20dbdd5
- SHA1 93f98f12ba2ecf9b1205a841fc9c0ff7bef3d9b8
- SHA512 584b00f6b860ccfac2b7020ec76e9028b25163106e485c4a5f2078f8e95c777d693563a372cccac6d30cbc0379b028bc73853d8a897a8aea7b3a69826ee32f46
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicq3brNPzB+NU:A3mnXoZjzyacNVOI/7PYaicq3bBPzBAU
- TLSH T1AF05AF13E7D104F5E516853099E55A22FB79BC631B60D6DF236882252F327C0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.2MB
- SHA256 b71002ea3aa95c2058f471a5c37ff133f44d1051ec03cffdfb53fa2858d30f44
- MD5 ed8f9ddd486f6a698808ec939c0ca13b
- SHA1 a8f75dbd46f460d367ed058ab7f008b829eb6ca7
- SHA512 13fc442e3d57437824ceedb9627dae296270afe71945f131da35fb7291a814c79b55e0c781fc11c3f489eeda88ebbc7e45dc34dbd4c902a7deb8ce6f9a740a98
- SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaicqJ0Le5ji0hmxNrM:A3kM5Pji0Aj
- TLSH T1C4456C17F6B442B5D033C1B9C5D2A69AFA7134421B308ACB1399C7283F67BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 698KB
- SHA256 e9ec92454dba215afee10c3971b3e45b0a24092a8281ce040b0bb59f308b9ea1
- MD5 46f367e0f60b40fa03220a67d242d126
- SHA1 c5dc1e3b6f48af5a4f2deb413e054ed15ddd63d5
- SHA512 da89df9f47e8252fdbd597a1d9ff427a4913e557f069bb2746d4f2c545e823774569728cc199ede4042eb571719124d8c2e656a23ae812f3def22cf624ec527d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqba:A3mnXoZjzyacNVOI/7PYaicqba
- TLSH T1C6E4AF03EB9104F9E11A817099E65A27FB75BC621760D6DF2368C2152F627C0BF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 707KB
- SHA256 6734faa5da814cec973ce7c7abc40baf428f59644d80330f99f6ce7ebc0bcf23
- MD5 84efaa0da6859580d66557bf44a0f194
- SHA1 ffa3bf70aa3bb72ef7adad4e51bd9078cfbc62ff
- SHA512 10c9ac02641e59119850f79a9fc0c88f09eee958cff46bc56834b53ada1b73f7fd92af4b8fa4864e94f7d7e058fc580727f1ca3321492dea77890d1c264f1c00
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIdT:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicq66
- TLSH T106F4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 968KB
- SHA256 68b53c9f4c184d3daacfd4c3ffdeca6e428d98eec987a6f9450066d0469b058e
- MD5 1895341fb2ae23f4c63df3bbd2e2fc83
- SHA1 a71c7bdb4cd57e7961acf9cc9a815988bdebb81d
- SHA512 cbf4cd9edf0f542be9e08d1a2114924633a662740933183a37509acbbb53c1c1fb3948b728d3da48c1eff3754e81572cdc65ec5e5c369099e7d3944b1bd5821f
- SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaicqqTWaLl3z0zDI:A3kM6T1LljB
- TLSH T1DF25BF17E79004F9E9178134C9E54A16EBB1BC661760C6DF136892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 707KB
- SHA256 72ddc117c284b4b5c04d4061db1acf4c329aaca75b1fd7a43514183ce2f5ed17
- MD5 aef37e9653d7503f41fbc3d7e685df16
- SHA1 f0286da11e49102fef69ea14be523dfc4e27e319
- SHA512 fadc3d178381cc3096f1e7615d65bc01bc6142a743d9391d99f0cde6f0dbd0453a3c45fc174037a84a60b58b8a91d422b4c059b55ce93aff52c8bf8883fa3f2b
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIls:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqq9
- TLSH T107F4AE13EBA504F9E10A817099D65A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 707KB
- SHA256 51b53816e4d7428791291f83f86fc280fb343e7b3349a3e067c749a612e4b84b
- MD5 83c0db364ef13a3bf2df46de2b32c1cb
- SHA1 2e23ac2b3a28cb5122853ed9caddba7e8ae7d1c6
- SHA512 794b770d46251b380e6be9c9441a1613cc1fda3930ea875aee984db73c97cde95ca3617b2705cae7a83e155118264fd33c38f7131a4da851343936f92daeb3fe
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIqc:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqqc
- TLSH T182F4AF13EBA104F9E51A817099E54A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 707KB
- SHA256 98bfb61db072735058a0a981b3212260dcc5dbb127a974e634cdba7416359032
- MD5 c08cdda19edebaf40a0447f6c0da6022
- SHA1 92473d41b8d3513ca61fd7d41e9e79cddc1d0949
- SHA512 35711d6ef97d22ae1cd4f45cb46b9196757deb09d0b3647b85120f756b73926a8222843feca2182cc10dfcf49be9cecce760abc8db17ff01fb1783bfa141a7ad
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIIy:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqjp
- TLSH T15FF4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 707KB
- SHA256 001f5e181784cf724a1e52849f971cbf0af20487ba391e8958006fa89a998269
- MD5 409261a0bb3d8deef2d9a1c986c3ac6c
- SHA1 ccf9accaf172a97bc9edd992509fd953944cd932
- SHA512 c88034ab4002da615499cf5697ce533f6125ccfdfb4ac9a6828e9eb3d5653655ba2e2c157bac0d887a0c9d6b045f20edff9a81e05970901a19c66dd3753aebf7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqE0a:A3mnXoZjzyacNVOI/7PYaicqEN
- TLSH T114F4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 707KB
- SHA256 27a48f1246d0236788de33530a8ac9ba004c02d8cec019fce2961657e46901cc
- MD5 e5616150539f38d8ececffef60d70251
- SHA1 a4322a915b050a2b11ca853bac8c5d2369fc8f29
- SHA512 7a6dcff0c7b453b6e02583d41aeb5e78d82197276bb7b75590446f7240428e89c49db0db20e3c3d7e0f3d4c63379d26764c98a6c0a57f8c92b1ebc171397369e
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIwT:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqsF
- TLSH T1F4F4AE13EBA504F9E10A817099D65A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 707KB
- SHA256 6e362a69187795065e043d45b825f67cbef3cc4182f5f284b791d49f290d9452
- MD5 efcdfda9d4f3c45f118bd24024e4b2ee
- SHA1 db2aad52f3f544abd96e84394aaf3f7685010ce4
- SHA512 3329a604b454a14995a5abc65ae44aed41b3a581b65c50f40681e661c25e0abce8eacb94dd341f29fc9a8bd2006b65badea003039c1214eae285e07970514e65
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIJC:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqZC
- TLSH T1B7F4AF13EBA104F9E50A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 707KB
- SHA256 a190178f0c91ad984446fe88451ccc989cf306f32391c16fce6a8140ebed6652
- MD5 526da571a85785db0e44b657d40b3f01
- SHA1 cf43027efa9e69765ebcbbd8f533e4b70aeaaa32
- SHA512 fd82f7116d75f90ce502be9c72606f32cf6d1ae096069fe80f4db243055a2047e1549ddf31932454f6e7a714ce261c7d5099632beba11ca90884e0b3b66e501c
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlI/V:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqaw
- TLSH T185F4AE03EBA504F9E50A817099D65A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 707KB
- SHA256 4aa5f57e396e961b984beeeb196630c1283df9be9fa3aba758b06a5500049486
- MD5 c6b525bf72746a0c86ecae6335606dde
- SHA1 c83da64101f8c9bc6a0b053868dc8f488b60661f
- SHA512 8a6a0d19d393fd5b5d23e8943f38adbbe6a581bd9720b7d393e604e89162523970abe981f306a355ad5efba6802e8f73e2a80e00c51bfcf3b8f9df4baece1fac
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlI4C:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqhT
- TLSH T105F4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 707KB
- SHA256 95202950bd4b1778f41ec1ba95beaa6491ba1e56890680138f6549367ac1c9a0
- MD5 b18f49a1f77c0414d78da1a328d8a1fe
- SHA1 939ffc9166b4ae1f8909a514b9d47c2743dd8d56
- SHA512 c1fa10ca63909c30e97a3dae333053508cb58bea2ec1ea5ae5b8dde746e8aa350b3861927e7e53488b9aa0416877aa4000f9ee0bbbc75569fe1ba03936c6c43c
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIvu:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqPu
- TLSH T114F4AE13EBA104F9E50A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 707KB
- SHA256 bc0b586bda231e90a0b171e1ca31e868a036b79af4ba531ffc7cb70cee6e5d5f
- MD5 46754e144e6891ce0282f9efbae04007
- SHA1 62ec6b6e7f2b264cc8f145b89e95bb2caf2b0998
- SHA512 e40aeec28eac772cc7d6204b14ce860cd24e8615207fe1ece9153dcef627b72094025e740321bd0624877bd28202b2e715f90d13a7a8dad1d4d5fef5b63c0de3
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIos:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqzb
- TLSH T104F4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 707KB
- SHA256 74a7bbe48eba2bb8050239be9b5d0e12010d333ab5126ad229b640f6d6c02e12
- MD5 01938c40801ae766005cf3a10b4d86fe
- SHA1 3494402f7c75fc01819fdf08272a729929407ad2
- SHA512 ac40eb5411cbe5ee7d908ac7c121ac13f5ef2470cfb66ab76caf944bf46009bc21320bea34b83f10c97ecbcf8d65da8fb1b45d056dedac21074c2e2a782da8b2
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIp9:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqHf
- TLSH T103F4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 707KB
- SHA256 f12163470e7a8902d886dbba09cd99fa97c1b6d0d5ae385327f278cd89e4ab32
- MD5 3d6e98683bb41d51d4a5ce7871ac3d96
- SHA1 6055dd50916eb1bef0610d2d347652988a9f7040
- SHA512 552e8fb56ab0a057fe3c6500f44514e5b7b9130933ce1aa2312168fb6e3e1a8eea0c7297eee1261bab96e496a023843ee860337ee3c06b106f6cb9d07a8938fb
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIH/:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqwK
- TLSH T159F4AE13EBA504F9E11A817099D54A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 707KB
- SHA256 22aec9c8d636240999acb836102b68361bd10054e4c5692329361a45d9abedf3
- MD5 7a89a05afaf07db5a4af2b6c88ce42b2
- SHA1 7a33a9cb726fb317ee325e19271008cce3a9c91f
- SHA512 de90c554db764eea88c24d42768ea4a3e58b1de2627971b225dae4d1d9dc6976190347a4808763198490a84a6174a58a8fb09b88373576b96ad0739a0dcf22d1
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIvy:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqtk
- TLSH T106F4AE13EBA104F9E11A817099D65626FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 707KB
- SHA256 a50a096d936910bfbc2e47fd1505831305e8e5d91985a178731049de4b25632d
- MD5 7a6e43592ea2e6164c2967911ed04047
- SHA1 6709413c857491365f28911f50a808dcc3e4fe27
- SHA512 264aa436d9aa3b170425c0665bace3fdfa7c4177718be9fe062acf4e964737232189d05bea8d9ec9965d781753e0aeb47a548ccbd5e7152a9ab7880150056167
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlITz:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqy0
- TLSH T10BF4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 707KB
- SHA256 1ce1c467bc5dec5fa49639c23d21c7dc9e522c9b5b1956e753803275f4394018
- MD5 1178c07bc0f71c40649e0776b73c3748
- SHA1 de591185a56afa9dfef5fb5fe39aeb350aaabb6a
- SHA512 e6c7f06a5bcd9c59dd56e99f6fe6c4758f5f99c31c4ce7deae4aa9c6e706c09db680e9e8313157f6cf6d551098a49e0e744b7eafae843aec0df0f6d784232080
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqB70:A3mnXoZjzyacNVOI/7PYaicqBg
- TLSH T176F4AE13EBA104F9E50A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 707KB
- SHA256 9033a17391215c35c19b92b106b23f99744d26bdeec05fdd233fac0875704be7
- MD5 ed06de619d174643c6e8007dab5e897e
- SHA1 16ba32cb6c472c268f35eefad702c85ce8a435c5
- SHA512 f5dd88456fe5810f465d5d98eec2c9247ddb7fc21ef4edfc1db475ef39e9324f07f63f1ef6314f9cf8a6046b0374c9f83c9b8ecc7bf69176a2d566e16fbff3ee
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlI38:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqor
- TLSH T15DF4AE03EBA504F9E11A817099E65626FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 707KB
- SHA256 16f8bc347e9814e9c16524253dacb7c72887c50dcbb9b3244b5a87f465ba5c1a
- MD5 ccb3064f47bd2ef8da6f8ad670929638
- SHA1 519cb03583eb62cb812a68da24d8e1f794c30246
- SHA512 07a263d03cbc7d2f1e436921e8f2a2f3bd4b8f90ef30b13dffbf9326920a80e165d61d124570c0bceebeb17e00a24e4efc33c3d811a0ac088709cdba8c2cc65e
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIAN:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqGn
- TLSH T192F4AE03EBA504F9E11A817099D65A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 707KB
- SHA256 8568256d30ea2c3ae345544c7fb890e4a5c78c24fffee7edd51c94dfa0a2d369
- MD5 08541e357a8cd1d2c53e6d09c8cc7dba
- SHA1 0cb8f49820bd6e67481516fe12be61d3c1f382b4
- SHA512 8d6bc2b02cce6bde9bd06ef803a2349264263121bb0ac2a8589d6ff35208d88a4b83759ae95c68d72873e5b12ce318f02c8f3d29788320af3a080c3967cdaf64
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlI5G:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqMx
- TLSH T11BF4AE13EBA104F9E50A817099D65626FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 707KB
- SHA256 1019cd680733a0ecc55cd0b3b27e8d9f1a6898181f54e9a0520facbae3be63f2
- MD5 4fefe47b32c437e58f8cefefbe6914bb
- SHA1 c2297a618ec54943c1a66de454b4d5384995a656
- SHA512 ae83e8823f368022165da392dd807177c6b51f674a0f63ddf5884a114d993a45bb031c5c4ef4568fe54e9394b7860d8b259eb50d9fbbd7078f1c22eb2615827c
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIl5:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqGA
- TLSH T13AF4AE03EBA504F9E11A817099E55A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 707KB
- SHA256 649a406fc54c7ca69c67a57be721bd4cffa2dbb9ce5276ef8ec46cccd09d3de8
- MD5 109d819940e801b2c5c258360c5babc8
- SHA1 9cd3f2fa72b19bb51fa922318a5a7957b996a977
- SHA512 eb5553b9ce0a006a71e3c136380c52c1a39260ba4bbdd80a31ed02afcbf05f5e7735d623a20df518e2161ab14dba3613b79b3030871ea4c0eec60bc3f1670dfd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqf9Q:A3mnXoZjzyacNVOI/7PYaicqf9Q
- TLSH T145F4AE13EBA104F9E51A817099D54A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 707KB
- SHA256 a84eb514c06ebd1754d0e356131d9602508b67e63f69d72c40c1527b5ed20dcc
- MD5 627cf270f8b2c5288e3bac8c0b18bb8d
- SHA1 7336026bcdf6e444f151b54851130b055635a0ac
- SHA512 f36e4e3b135d0042c43287f99acc3c490939a4d473780fbf46ea23c785e47139c2b61c93e048aa24108407b856b89a6d864d7d43823105b48a066b2e30994de2
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIgW:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqW4
- TLSH T1F8F4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 707KB
- SHA256 04144d8e94781ec8d9295d85ef7187df8d46c16cd2dc6353d15a7ec149bd2b3d
- MD5 6f77cb8d1b3bd24a91216025d8cdb3fe
- SHA1 c0bd1de4a9ce89b56a08a0d90e44bdbb198390a2
- SHA512 36b42ac1b07649b284f8418e5082537d09ae7611321f4b188192c28b0aa379131ee347edcc2b63c03cbb271b95e9007fb99cac43a4a3a6ec2beee401529bcc25
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIor:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqFu
- TLSH T13BF4AE03EBA504F9E11A817099D65A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 707KB
- SHA256 f4690637a42b3a99fb775b5cd264768f6a75a23c5d17224830aa56db6609ad25
- MD5 add8c6a31861d9c617640512ad4fb31b
- SHA1 7eef199d26f5f82416a9b4a8a8180185a20c600d
- SHA512 5358d4eef0c11aa8c1f10e839970801610f7655470e2b34a0c862d81ae56f90c4c9d776e4903e919056c0ba909a5151a12a581a318211364c9971b8d86e36079
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIb6:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqYj
- TLSH T1DEF4AE03EBA504F9E11A817099D65626FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 707KB
- SHA256 d5034670eeac8f5b621c90541c2a6a761f7a4fa10e3d3517bc59c6127943a8a3
- MD5 c461aa7a1ba233a1859e4c5fe65c0bbd
- SHA1 e85428036ed9e80e03ac98e3f82a221574117ead
- SHA512 4937dcfcc031f5f46e778a496285e8446c04452b4b5953966be497c538aed7013b31b7e7ccf708164b65c9ce7732f916249e981dfd7c6d7bdd75fdb3034280c5
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIRM:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqpg
- TLSH T1BDF4AE03EBA104F9E11A817099D65A26FB75BC631760D6DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 707KB
- SHA256 ea96e80934eb63a57b7740cf4e38b1f1f0b3cc5da8aa3743aa4b8021976cf100
- MD5 d93c8f81cace66574faca8ebd6a8e437
- SHA1 d1538fe884898c0ad559712fb14e824b03c9caa1
- SHA512 5d0816de9e72c71967aeac96ac534a39aac19d7cf6d392fd01827d5d1b360b7b2c085fcec613c1cb71c4c4eaabf7b75ec57d723305531834187d85d01297ce58
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIe2:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqwI
- TLSH T137F4AE03EBA504F9E11A817099D65A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 707KB
- SHA256 b2c461044809a9f8281740f57c8498f333d4a8efe2cad0ae70635b94740fe1da
- MD5 82ebebebc36ea2546df4054b9b16316e
- SHA1 4a62b1d8adc481f60937279a44dee77cc7a1eed5
- SHA512 5897ec53f0b164c070c14ccd211b6635cbc40e05ada9917e40b592635b23e136edbee9df38d91124615f84ed4f1cd4f22032e83deb2c768d48c3dd2b2b6d0e54
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlI0q:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqyo
- TLSH T17DF4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 707KB
- SHA256 c29e2ba90070c6ca4c0bcc67f8c8c30f140394da6bfa68a129857a6591f1cc19
- MD5 e9004b4031c7bfea612d756578b9dc26
- SHA1 73f64b28dacfd378d59c1033bcf2503f6df5c734
- SHA512 c6f9b2979587f5e7b058e81cdef40b3c145e1282fe9abec5f8965741bd5ed4dec2806d6883463db6d8fa5abdf211d65f0548720e52652332a040f8ab9795ed9f
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlICp:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqp+
- TLSH T1D3F4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 707KB
- SHA256 f4dc7e37ab4c06f188e97fb665bb6f4e9e4ffa621362ba85010b04e6c38ec8ea
- MD5 43b43b7d2b2a281dac49d0f29162be51
- SHA1 317f61696ad31d4e22236f9f9fd75cc126026506
- SHA512 ca8433db8cb01abd98fa2b57a5900b14b43fc8cd05f4f80a4c14c57a0edcd92d06b35be766a3122c46d03152e6f5c9f6242145f864302be483517fde3d338281
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIeV:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqXQ
- TLSH T198F4AE03EBA504F9E11A817099E55A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 707KB
- SHA256 10b44701887b715a6be4e224972d450e5606567e7a5de29be5aadef6815d5c73
- MD5 ddb873ca3791562440944b0be247cfc2
- SHA1 71fd3eb528ec4f81cb6b25e5de44e98a4fe8c880
- SHA512 23a92b0b33b96a6c8f20142496c5602267bf43bd70eda40264ca8d9470f9f8bf2f7bf3fc475c33217aefade092427f042b29a77b4fd99334839f8c2e830a6d57
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIoT:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqsX
- TLSH T1B8F4AE13EBA504F9E11A817099D54A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 903KB
- SHA256 0cf7480f8fc9ac00c4dec2a5742fbdadf6e8fc683bed9d42c84b49278cb79d7c
- MD5 7abb3e78daf82d96aebcfae725fe532f
- SHA1 9c37ea9d67b84ac89b6d706858be0899a82388d7
- SHA512 b27eb8c10acc575271a11a1bba1f6894a89adb9ed57cdc8a206b21c42ed8dab7c6caa3d879bb764d62d30b402dc53ecdf50fb110b3acb25b0039eb985103c640
- SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaicq7jCXF7IwZ:A3kMnC17IwZ
- TLSH T10515AE13EBA004F6D56A817499D64627FB75BC22176082DF53A8C2252F237C06F7E7E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 707KB
- SHA256 e2aacbe3b2fcdebed259fe23dfc29f3c3047f64c86012cca180843ad1d5277fa
- MD5 acafc846314c1ba1ae341441ee60988d
- SHA1 598743176890456c79a8724872195d9dd71f9ec8
- SHA512 a6abcdaa2035dad37e1b071b6b0e4f332f9e4d52a2f61de9a8cc6a4d691857426c283faeb06996e8f42bbdd15a6b997703107d7216390c195c207844b3a61808
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIzm:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicqKL
- TLSH T144F4AE13EBA104F9E50A817099D65626FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 707KB
- SHA256 6ac1ca9c82281021fd72ffc91a92247f8bb82b24a333a3607d3810e944a46625
- MD5 0df3399abec1135865821fff44615c65
- SHA1 233e8234d2a502435372754ef30eceea3ba666c4
- SHA512 5c6c3db668444327a8ae981a98f642a69982594d04ca4b13625cd22ec1dc08e185ad12571ebd52187adad3f52e12ebc6cb1808f9fa0e6534f8ed0baf4dba4817
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicquFC:A3mnXoZjzyacNVOI/7PYaicquM
- TLSH T17AF4AE13EBA104F9E11A817099D55A26FB75BC632760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 707KB
- SHA256 a47cbd28dc6f1956e137e8c518f964aff4eee0d1632bdbec3b808852bcac02fe
- MD5 0263383b1847ef43dcaae43d48c6caf3
- SHA1 1397b1705954f4455a64e3ed547c477d7b43dba1
- SHA512 b993a68cba6723999288b0c8bc4e7ab9d26997ebf73e688806b116dbd8ef3ca4c86027cd83a40b87ff235f9655888f33305f3651b955e7bd68d0df9e8c466f98
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLasTHfCtIvnYa7fazIlIlP:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicq3h
- TLSH T13CF4AE13EBA504F9E10A817099D65A26FB75BC631760D2DF2368C2152F627C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 744KB
- SHA256 1fa48d3cf9eb4c90b5030f705d6ed1338aef18a01061e3ec63cb29b8e19cced0
- MD5 27ede861e2a7076342ea6f25624401b1
- SHA1 5f28c573f970b4f70c32aa0784087e56da7437aa
- SHA512 874e907b65a84aa0d1b74ba3bc96df5c9f30afe1c72cd27f3540db896e6d6c1611d0a8149f277575ff1ad66ed75277586d359adfb41669678c56f4d88b14b315
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaicq4pIyvJd:A3mnXoZjzyacNVOI/7PYaicq4jv
- TLSH T157F4AE03E7A504F9E11A817099E65A26FB75BC621760D2DF2368C2152F637C07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
- Size 936KB
- SHA256 1127803b0c68b069ba5a97764959da0139c8d6f506be2780232077f507242424
- MD5 83e12439f6c7889c8aea7d261294bd5e
- SHA1 6f09f18fbb1b01dc7738471f1c950a0ed3c04f0d
- SHA512 84ef039f709bfa886fd0bbfdcb1061d5f9d388d5cb313cdd1d6f022b7b238626dd4856e9dc0ccbcdea8ead753e0381e5373adb47fab67a3a782afc08f6dcb505
- SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaicqZV+PAk2hMH3:A3kMpi2WH3
- TLSH T1A515BF23E7E404F6D117413099E9563AFB75BC121B2182DF6368831E2F627D06F3A7A6
- MD5 SHA1 SHA512 SSDEEP TLSH