Analysis
- max time kernel
112s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 17:59
Behavioral task
behavioral1
Sample
2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 883KB
- Sample260816-wk29pstemc
- SHA256 daec07d65844a3d95019d68a17438fae68211deb4825819ee3ce27ae19dd3f75
- MD5 57eec5a53cffbc6ea01cb5cefb646bd9
- SHA1 84c278f5db9e8d9aef042b89ba8364196218ad42
- SHA512 bcd19ace45dd74f52a2d7224db48432ae80645a589ac4811fd6021f91d59f158bd3b5b0329a1e9993cb970b4ddcb395191bb2a59f44adff71125e33acb178466
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoc:A3mnXoZjzyaEFo3+aga1xzycEoc
- TLSH T175153907E69410E9D15E8134DBA54A12F7737C2207E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/2000-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c52c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2000-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5832-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-239.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-423.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-607.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-729.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-860.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-925.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-938.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-957.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1012.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1092.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c553-2141.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c52c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-12.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-239.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-246.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-423.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-491.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-516.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-607.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-632.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-729.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-748.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-828.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-860.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-899.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-912.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-925.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-938.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-957.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1012.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1092.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1142.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1162.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1188.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1327.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1340.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1365.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1378.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1385.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1402.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1403.dat aspack_v212_v242 behavioral2/files/0x000d00000001c553-2141.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5832 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe - Drops file in Windows directory 20 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2000 2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5832 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_57eec5a53cffbc6ea01cb5cefb646bd9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2000
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 883KB
- SHA256 daec07d65844a3d95019d68a17438fae68211deb4825819ee3ce27ae19dd3f75
- MD5 57eec5a53cffbc6ea01cb5cefb646bd9
- SHA1 84c278f5db9e8d9aef042b89ba8364196218ad42
- SHA512 bcd19ace45dd74f52a2d7224db48432ae80645a589ac4811fd6021f91d59f158bd3b5b0329a1e9993cb970b4ddcb395191bb2a59f44adff71125e33acb178466
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoc:A3mnXoZjzyaEFo3+aga1xzycEoc
- TLSH T175153907E69410E9D15E8134DBA54A12F7737C2207E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 cafc95f00637fc2b7ba991f36ea7c5df4e00580aeadb2f8295f64de9a3149171
- MD5 b8c44f1234946f342472ca6f02c9da78
- SHA1 a4d2238259ad251c1dc90d645a75c01c90a38d86
- SHA512 5cda06495e46cab8afe1871ec5a2296ce0b05fe3324031e96f764c38703f907ded94a03e8e7c907af1b7787fca6afcf3c6d4670cdd8aa2ae3433ee2d7f14cacd
- SSDEEP 24576:A3mnXoZjzyaEFo3+aga1xzycEok0Le5ji0hmxNrM:A3kMxSPji0Aj
- TLSH T138654916E6A402A5D02EC179C7D2565AFB73385207F08ACB13D4D63D2F236D19EBA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 898KB
- SHA256 97046a0fe5e8272a6103dd5d44514dab046c9801c16fae6f4d8220bdea71bbfc
- MD5 4ad6217b327cb1fc25c4fe928fedcb9e
- SHA1 4156489397bf837af038e856eda4fd61a122c61d
- SHA512 823e4fd646d75979cc13b8ca02fdb503fc1d7e6512b593ffff439bebe62a1c7d392e9db2ec302b807c576d86b0a643feb2c1f441ec14767a713f6378d4913a10
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoOa:A3mnXoZjzyaEFo3+aga1xzycEoOa
- TLSH T1A3153907E69410E9D15E8134DBA54A12F7737C2207E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 931KB
- SHA256 bff233be72e39b6551c1104f96b72f1720e263315007599fc2a94ff9febe1dda
- MD5 7fa573f808f27ceeab8fc90de91cde9d
- SHA1 804977b5636d29f9cd6864e2dbecdadb72d7a0e3
- SHA512 35abc5d023040c483b816e87330ada237d16a201662fa26cf613be95eb5ef10111e8cd2cdfb0d7e6986b59d4ac30d024a5e73f1bacd543c3f51d8cd72b1bc083
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoNb:A3mnXoZjzyaEFo3+aga1xzycEoNb
- TLSH T170153907E69410E9D16E8134DBA54A12B7737C2217E096DF13D4E63D2F32780AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 907KB
- SHA256 418dcc770ad01ff9253239fdd0fa5cd1dc811f308224cff1ef853aa1d1499176
- MD5 c7d0ef4dd3e13d848fad629b24bed263
- SHA1 c03af653b020a25db7110926778eed9c35eb8972
- SHA512 bda9f1ab09ea55ad879915eb33aa32d193f50a7d3e74e187e8e4266a9983396d23fc9900e551daab83c6078c1c817193b4b8afb85a5efaad68a6d1d9794db690
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEov6:A3mnXoZjzyaEFo3+aga1xzycEov6
- TLSH T1DC154907E69410E9D11E8134DBA54A12F7737C2247E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 907KB
- SHA256 440298ce400472eda382999a6e56a361710297186192c633a9caa971a65da158
- MD5 5fc0f1d76b2101324c9c84093bec7af4
- SHA1 d287629032d6285ef558bdee1f73029f77b981b9
- SHA512 4b9ce95da3129a941dffd52f2a58a2a14ea93079f2665889a9dab8a5a7a2197b685dd570e560e931ac66386cc075246edcbc86b9322f75025650a0eaa71a7160
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEopo:A3mnXoZjzyaEFo3+aga1xzycEopo
- TLSH T1E4154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 907KB
- SHA256 28880f169e7b250d59656bac7fbdc350f255cd149902a971f37156d10cfee090
- MD5 73f41d9ce76d92bfcdf06f2df6afc936
- SHA1 e8d04073fb849b8ca83f55b1576192821e280532
- SHA512 f18b2f4b955497cb05ce73d37387d110ade5d681d968ba1687cf1632cef9f85e4c4eb766afda19f87b683cede2f581b659b858cafe2c70009adf3b4e6020f0f5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoZu:A3mnXoZjzyaEFo3+aga1xzycEoZu
- TLSH T177154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 907KB
- SHA256 e84bcd46c15ac66a7c8db8c34c9a9aa7ef74606b4292890f88b8e8ffedcc9a15
- MD5 f31c3eb692037d6bef149288b3e5237e
- SHA1 1e784702cb038ad52abb587fc83b0034133ae2ef
- SHA512 dafdc6a6272d631d34e3cd7df631be71f1d21493db7d00c4485468022a3dfecdb9e38dcc84c4fa7e1221f465663183f3fdf60f24c46dbfd06b0190888daef412
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEo/9:A3mnXoZjzyaEFo3+aga1xzycEo/9
- TLSH T19D154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 907KB
- SHA256 939d9602c00619160ea72aec0b85115ca76ccfaa9fba1afb3e883100e7b9bf60
- MD5 446b427612343d7e64d6022cfac69bc0
- SHA1 b267050e4ae02f6f2b24ed1fed913edc8db12877
- SHA512 448d48302fc54a5524d83b7b38f9c7f6e396d9a6f7208402c471c5b05cf04636c15ea6f2ea5cc2934fa7f383e7e896b7adfa1090b45125b6f4d7091d3cdbeddd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEobc:A3mnXoZjzyaEFo3+aga1xzycEobc
- TLSH T1EB154907E69410E9D11E8134DBA54A12F7737C2247E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 907KB
- SHA256 68bdd1f1cb0492607264388968c1598382145c5831fefbe5c1889cfedb3d3e03
- MD5 26c8f39f039ba69430e75f474758b704
- SHA1 2a8c400dcc032afaa071da1fbbc38b021f7c715c
- SHA512 3f03fab6c906a19f4f7ba3e4afe9e1a109e6574b2b1e721d05d3f3fd87ba1c47a134450e9857a84004e2cd3aa27e221a4a5125cc1fbec4c5b79c5695ad839ede
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoEp:A3mnXoZjzyaEFo3+aga1xzycEoEp
- TLSH T168154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 907KB
- SHA256 0428ff722e3e5c933298a8569e2aec761846e115ac8f826681da349420236a71
- MD5 a24ce71d0d251ecc3a19995b9995678b
- SHA1 7e11656ddb4fd0e93237792192177244ea021bba
- SHA512 73f475b95c6ee584072e3e6ef90a9f46e1e88c79d8e4ac56ade8e3cbeb19e96adb05ac0243a6e38194ecfcd88ff8bfd68807a84c511ec2f738962d3f6809a52e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoL0a:A3mnXoZjzyaEFo3+aga1xzycEoLN
- TLSH T100154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 907KB
- SHA256 cf44458146559db1c903d807c71b34af55f3932ebf4a1639363371e8e14ef179
- MD5 f8e9748c8689088127e9db8ca07eead7
- SHA1 ddeb8bb3f242c3f022b3644ece1c475475e1c19b
- SHA512 586ebdc6e996507d82873224b0f33d3cdb1e7ca7c4290866c0c1e56af80034f003abe9069f11391d1d3561c9968d486268388c5d56480ee0c34f87cfdc08d03d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoZF:A3mnXoZjzyaEFo3+aga1xzycEoZF
- TLSH T1D3154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 907KB
- SHA256 86e4812d2cc6b65ddd040bc6642939d0ee4e57cd31f6e078ebf767024cf865c7
- MD5 bcce3b0a01f46fbd55bd550e44e9443a
- SHA1 aa65dff8336655298db256a77635eb8139c6563b
- SHA512 90d7a6d9ed29c23f3e5376ac585831a676c9e1ae4a7aa7ab74bf4ac990596392daec9961ce1f6759e9a071d9789181d23ad887bca8ad0b0148e3a08246fcaf23
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoyC:A3mnXoZjzyaEFo3+aga1xzycEoyC
- TLSH T135154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 907KB
- SHA256 e387ac33dea5c82e3ecba71ac01b9bbe0cf62a0818fcecb450f0f75ba2fb247f
- MD5 60ad1dd13728d879e10730a93ee36293
- SHA1 41a11854e50cff5876697ed31e24f0e485fbfdb2
- SHA512 f0873b617a9479a19c53e3da218514ce006bcb101697a24f10fd8a2d974ba4fd041c1a6a1bc43710cc74d0ad599f855ee5a15cb04604880333b6058218183b89
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEotw:A3mnXoZjzyaEFo3+aga1xzycEotw
- TLSH T1B0154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 907KB
- SHA256 f32dd76c3b61275a592833c2b4e62611f0d18639ac3525207185dcbd7001ece6
- MD5 6d33ece7dd7ba928512af30f36e02638
- SHA1 8bfefb33c53bf5ec16e658e4275e1f6bf33a04f5
- SHA512 3e31bec9a5d84e8f94b999eb7dda97fc8aa2b04045bc32f89362b5c706b482c0ae351571d14a6eadb4dab09dc8854744e70200b7758cfef8f1787ea0ad906830
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEocT:A3mnXoZjzyaEFo3+aga1xzycEocT
- TLSH T152154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 907KB
- SHA256 83133c194d6feb3dadc3fd1290ce5f2d4379a07cd075ca5851521540cc9fd5a6
- MD5 d7fa6ed34c839c883d0c92ece900acbe
- SHA1 c7fed601a0f40ccaeac7b19b6acf9a9f48b6587b
- SHA512 66c09afb6353d23d8d07710cda674e87526fb856ebdf1c7e1fe421d61d0b5fbfb98628aa10bdc9f7ff01880b883eaf024d28eef692fa9e1823a5022230365e82
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEowu:A3mnXoZjzyaEFo3+aga1xzycEowu
- TLSH T182154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 907KB
- SHA256 b13d50324b19780e63e608a05793a8950a862b583267db0789cbf291bcb8bb39
- MD5 c2fb7f94dbaff16ca9bbaa4ccc0b0520
- SHA1 369dc9868781140e37ea95b16ec25d1e67a9fe82
- SHA512 e6cdd8f6275ab47ba2ee8775d0ff2f36bdaa207f9cc825c5feffd1ecdf517ac6f2d12988180c49906601a7d15b1eac66c69a97d4cd9c1378b5b902f1dac616fd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoOb:A3mnXoZjzyaEFo3+aga1xzycEoOb
- TLSH T1A7154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 907KB
- SHA256 97c471f9bbaeee5a1f33e26b8129bc6304934d786b3d480db86a2b2c43c752bc
- MD5 072e46566375e9d8eae85318a616b56d
- SHA1 a5daeb8b1cdfef9badcd2a33e33c9eb78f4c8cb8
- SHA512 cd6d39f7bd5cbb6892617755de44b5953d84400246de303611df7654043d8fb4e9bc4910ff55de630467d07bd5074c7806e7f7eaf39be3b6c41741276910f8a0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEo4f:A3mnXoZjzyaEFo3+aga1xzycEo4f
- TLSH T14C154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 907KB
- SHA256 60767a8ebb49e32a8f84bbb21362cf6d1b5a786c17e031585951420b5077145d
- MD5 6e64c18d9ffd418ae637bc64ed64be1d
- SHA1 5424af1fa666bf009c176777208d130b66c24e33
- SHA512 3bb5e234f5b72c6ff026d5811770d0b23b32f81d3df911b482020d9bd5f3262ac3b9876a40e853a4cb9e19086d36c27b5775c2799705f42a2886b6e16ff88ef7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEo1K:A3mnXoZjzyaEFo3+aga1xzycEo1K
- TLSH T1B1154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 907KB
- SHA256 cbaa43489e2826a56b75d9e6d5c4b61cc056af69792eeae1eee3865e5fb3c4b7
- MD5 0f028b5e738a0aca6b3b500a9e6e1eb0
- SHA1 685b32e74a7f5dce3b96ad13cda528e34c26864b
- SHA512 a40d41f40340f8e3b8c24774410b32673e86e319b6051f0c892cb81d4faee7057bea96f4c9873c1ac12d744f8b6223d219bb7bbd7b63d007bbd6995717852d18
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEo2k:A3mnXoZjzyaEFo3+aga1xzycEo2k
- TLSH T196154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 907KB
- SHA256 2bb1defa7e0ab7976ea7e850429148cb640384e0c3a9c22db800fdd344b4b449
- MD5 5276712a18738358ac59705f5a45b9e7
- SHA1 194487ab619d783c82057776411ce8da6b745be1
- SHA512 1d0a3a5d2e02a4174bf8a7235408e68c708453604f3a484e61319f40131de91b568baeaacbf517e80f4bd455e259d592c962a49f19143e84dfe51f8cc05ff3c8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoT0:A3mnXoZjzyaEFo3+aga1xzycEoT0
- TLSH T10F154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 907KB
- SHA256 c10e1e420f88966574884f309354100448787f031228cd51cfe5bbbf7cad8519
- MD5 9bb423337cdb1ca2bbcec1efe131c16f
- SHA1 07b768263d0f3a30033ac0c6aaf0751a23fbda45
- SHA512 12e4f2320eb2193052a8d8456aaa85641d6db31803fb917327e37bdb51d70a2af7faecb223a0e220ef173782e529780df3f96ad7d06fbccd84915eb704cfe4e7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoi70:A3mnXoZjzyaEFo3+aga1xzycEoig
- TLSH T104154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 907KB
- SHA256 ffdc7d8a0cd390718ce058b927049efd22eaf1847276dbb82e13a257adc2db7f
- MD5 01b5e696ad6e4e9daabf8718b367dd78
- SHA1 479cbae59cec6e3cec95f869b1289bca1f69fdc2
- SHA512 4f1edf812ad1b57f98ac7ab8186d857155cb541ab642d61ec0679e800c5e1842b42b6e1fa69c2b6540f1c6b3747734360d9a33d1432340fd0c659ad6a9764cb0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoDr:A3mnXoZjzyaEFo3+aga1xzycEoDr
- TLSH T15F154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 907KB
- SHA256 c349f5341320a2d421e1712616e287f6174cea896946c14160737746faa54fa3
- MD5 f0eee78da283e75677fd825649b0ee23
- SHA1 d0ffad10874dacb0746af8b4df5d0d22a32c14a1
- SHA512 928075ed1ff6e05fc710a42eecdcfee1e56b6dbb05a1f9f6c0a0fed5a769d7f1c4092e91d3f32e2e27883a26b7a0dc2ada6d770ff3d3835d07ace175e71f37ad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoln:A3mnXoZjzyaEFo3+aga1xzycEoln
- TLSH T1FB154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 907KB
- SHA256 50517f5b2f12de60482c46eedfd8eb16f923786ccd84428606438e49b9a8c95b
- MD5 ee771b1a49cf0f7fc15468fa234709aa
- SHA1 c2f00f4965f6bd2d5d10003a9b754c191bb61fca
- SHA512 0be0912c4173f687f943a6bd636fd5832cc485a4be3642117c1e099f1c7403726dd11b17753b23c15ab1b68c8fa2600276bb98e6f461ae587e4635772197cb8f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoRx:A3mnXoZjzyaEFo3+aga1xzycEoRx
- TLSH T1EF154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 907KB
- SHA256 a7e420bb20de84adbf3293efe5978e389aa11dd529ad4a986ac4136ad8510209
- MD5 8d034a2e63f524e096e94d112c9a3559
- SHA1 594cf7d9e57467c651dfcd9cd74f0da37592fe67
- SHA512 83b25b02ca60c67cc41cfa84e320a4b29c56fdffc3e32f00fe04f05d2b9cda6ccfc9807498de1abcb23a0dcbb34b84d6b1d7bdf6179a99ad9cbcb891ae51ad9d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEo/A:A3mnXoZjzyaEFo3+aga1xzycEo/A
- TLSH T12F154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 907KB
- SHA256 7ca0cea51ab04ecb59e55c7464d61e701673150ca4c157d2c8a46bcac4a78b48
- MD5 8bf5a32701e615ca98c886821156d61d
- SHA1 bb8e4329faa67d11c4a060e7f61cc474850b77ea
- SHA512 c38318c250b9cf0e04685a13eac5fd29b3167336b1b45f20ba203912eac13f0ac0b6320f7d6d225651a00d9e55b7e268ea1d183508390646c3bd664e292df55b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoQ9Q:A3mnXoZjzyaEFo3+aga1xzycEoQ9Q
- TLSH T1A6154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 907KB
- SHA256 392d3f9f0658659c9d6175e3456e1c899748d24296cd1affc13455050ea31d6b
- MD5 e1936dfae54ac71a65402e34727bbafd
- SHA1 8f61740947441e1e6f6c0ddc8c8e32a5c6ec9e7f
- SHA512 d87439229c8d35ef5a7ec941f6f6972ea9321da8f4824fca9f54681c6ff562df05a67d24452419a88c6f1b2701e82e07ff780b580647fa9f7a7127d6ac1a5e08
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEox4:A3mnXoZjzyaEFo3+aga1xzycEox4
- TLSH T1D0154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 907KB
- SHA256 4d84e126ee288b205931fe27fb9b64b17687ae4f8627a062d14ca7f0ed890707
- MD5 bd6618061ff59385b92536b1a79b80d4
- SHA1 63ff5a181767e3d95da1e412a089c5f48c86e854
- SHA512 39441a4dbb6e22c795e464c4c8c8483dc9f4b0139ad44d347a30e0c37e542fabfd62cd6b231c625811bdf890ce79b95526059a928cf27dc9c4bbf628f8985f81
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEo0u:A3mnXoZjzyaEFo3+aga1xzycEo0u
- TLSH T12F154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 907KB
- SHA256 13776971ec5f022034f5fd9fca4e19e8fe6155af77f543fc8a2145d3e26d4894
- MD5 1732739fa4e380c339d10cf2a311014a
- SHA1 a2109e60931de67d835084f951b602c37d38b4d7
- SHA512 6065e3cc9d7f03c0fd64e2535af04bf7a743921bb3a12d83ebd4e83ce008ad30c587f2bbc0afd64eb0d4a2eaf7f7d05a0e0a4ebc2584388acbb363cb1ae675f8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoFj:A3mnXoZjzyaEFo3+aga1xzycEoFj
- TLSH T184154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 907KB
- SHA256 daa9cbc719cf9f3ae4279355a477bed5aeeb52d252f8ce7fb373ade2544d11ca
- MD5 ec5d7e7b3e3bedeab0b2ebb715115439
- SHA1 75373587b017dd08c1c5aff6837c4a0d34017096
- SHA512 583f73879bbc1c59689e5c6e93869248da755569c610fa880d5760ad895adf8bb52d8daa4a0fac65183837448bc4e72f54b686878a3a7e65a0bc7f0e68bae762
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoMg:A3mnXoZjzyaEFo3+aga1xzycEoMg
- TLSH T154154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 907KB
- SHA256 2aa895e0ea7075fdd3c532f09dedda1fec44c26b429c87810f9381189b340b06
- MD5 2ab402627f9d79655fc97be93d3c171f
- SHA1 1a9ca01a0ac5b9a8395eefca2e3bfe35a9bf9740
- SHA512 f7eb8b6906db94eb70fad48650fc3418049db4f6f44189f35408f3d5bc320225604dbb9c1eca7a8b7ad13589091c232f5f46647c746c11984aa7940670c89e10
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoTI:A3mnXoZjzyaEFo3+aga1xzycEoTI
- TLSH T1CF154907E69410E9D15E8134DBA54A12F7737C2207E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 907KB
- SHA256 35ebdeac8285f6e51523d4a9e8322d71601ea843a1ed24120a0711e8ac3fa168
- MD5 168d4523d99115d1e5e2a01e2edf4f19
- SHA1 9f0dc976843217e0711448debbe973192f3d4be7
- SHA512 fecaea4c7d2cdcfc823d4502f77eebb963bea061f8a815c084f6c7ea7655a3d48871f9b46b607bd5537d02f0bae8603b06cb1930ecb76fd091677701010b130a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEopo:A3mnXoZjzyaEFo3+aga1xzycEopo
- TLSH T162154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 907KB
- SHA256 192c98094a0cdff9a388200a8a8a95dc36eeb99ff04d7cdd05f9290b6b9a4e9e
- MD5 7f3c4790a3b4c5d39089203731899bbc
- SHA1 c51e45525d150063626b1a3c851421cb16f94858
- SHA512 58b12adbf61913466b848fa10f228a02463c59bb335d3bf01c51d32f4e91e15b1f039ebc61bfc93123f7af7b2fb908dc965657c807f247e93911004d0ac8e66d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoa+:A3mnXoZjzyaEFo3+aga1xzycEoa+
- TLSH T15C154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 907KB
- SHA256 85a74db4f9b206787b5e71b49e5d6ffab2bb3a83066e1a3a0831fa3016235df9
- MD5 78aafc7853592582000541cb2e81ef91
- SHA1 47d69581559a92e16eea1c58387e6d70b24fb719
- SHA512 64ff0402a4a65d7f2648cb43040e4029a8b88edab03ea5b0a49a834ca419a8602592970ca85f339c92c20fe1959ffa6c0ee740c0c0753ab11a8d998231c4a2a3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoaQ:A3mnXoZjzyaEFo3+aga1xzycEoaQ
- TLSH T11A154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 907KB
- SHA256 1fb7c37bc365c137872caaa7b3acb81860da1cb7dbec0cd3fcee2c691b59fe6e
- MD5 965a8775c62ac14d90862fda83efd551
- SHA1 d91a872f32265527a95341da8e3bdcf69799193c
- SHA512 429dc32ccf0b71ab3a6f6dcce16e2155ab2ac1853ae8fc3768c9d38b6f5511802900cb3c970fdd93bd33c233b2a4454158bdc59f85ca7fa11fd8e43116ab8511
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEorX:A3mnXoZjzyaEFo3+aga1xzycEorX
- TLSH T15B154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 907KB
- SHA256 d6ed002a22542ff8526ee5729831ab0ff656bac0ebbf1157ac0aefa233f85d94
- MD5 0a5dc2277e9d0801453a21d60fd109b6
- SHA1 704b06d4e39585936c467deb84a653b00ad6aad4
- SHA512 3a0ffd97ce8b743025cbc86a7b91b8cb2a273ab527861c5744c15210f0076e428d6272cb003ea08246d507d89f7d6324e35206f5507715104b5842839d69d46b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEo5L:A3mnXoZjzyaEFo3+aga1xzycEo5L
- TLSH T19A154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 907KB
- SHA256 e4493bc60c6ffbfbf4daac5bb21929e33fe98c7ef894c0d35e5c305761ac0754
- MD5 3d76af6ed71ab28deab52cb6a9ae2cb4
- SHA1 bdb8b59602d873b592df0e965a8e0b4939bb78db
- SHA512 0b7f211c0be892abacf4a4d2febc7eec094e06f677effa3de9cbdad0b9b24a3c80453d75e3e9a59e6b5de06cd88e6123d7190b893867ad63c7ecf5b0323645b2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEonFC:A3mnXoZjzyaEFo3+aga1xzycEonM
- TLSH T125154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 907KB
- SHA256 642b94962fca67d199dd2aa22e80e4834b2ce39b183e0f95214be6eee8755773
- MD5 fab91d4d9f8f55a711c02a5d66869b53
- SHA1 0dfaabe94e408eb1877af310a50ccb2a19bd038a
- SHA512 2387187ced5c5df3aaabcd9c9aa7904bbfeb17bd9af942d72ada2fb42849b14318bafaa9a7d0e2f26f0fdfef628fd4f1fb6bfbf16564872dba37bbc50824649d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+agaWXsf3wyPz5L8cEoQh:A3mnXoZjzyaEFo3+aga1xzycEoQh
- TLSH T186154907E69410E9D11E8134DBA54A12F7737C2217E096DF13E4E63D2F32690AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe
- Size 1012KB
- SHA256 4ead7175e1394534e2d92deb0f5db75f855346b7cf4c9515a926e66818bab03a
- MD5 67719e627763e126c6eebd48d012cf7d
- SHA1 70f2909a38f2edad7678d7b436eebc4777cad71c
- SHA512 5ceb24cb49fa13cc6164273d63eb32389cd0bf20dcc98132ce3081be7c6a4df64275d44f7acff8b1c614920331cb84a92acf028707bd54959757e81add84b4ad
- SSDEEP 24576:A3mnXoZjzyaEFo3+aga1xzycEoxccx2w6:A3kMxLccow6
- TLSH T177254902D7A410E9D16E8234DBA54612B773BC2217E096DF13D4E63D1F72780AEEA763
- MD5 SHA1 SHA512 SSDEEP TLSH