Analysis
- max time kernel
109s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 14:37
Behavioral task
behavioral1
Sample
2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 760KB
- Sample260820-ry7dcsdh52
- SHA256 54396adb0ca702cd705324899c7e2199df06d8b8a294c1c1f8ef78e9eca23b79
- MD5 c4a59dc81afdba2af2845bf5f7a28e6d
- SHA1 6172914db9fa24b93b49c7a12fd964aa08ffac08
- SHA512 b3a440ccca08985eaee0182fec2996fb9f8cf711b00c90b43b62879a4be3542c7b53654eb06b18858e4348255cac3e1d4318933fb08c7a21f48badcb9e34a9ef
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE:A3mF5jcAkSYqyE0BOzylE
- TLSH T1ADF44A16F6648675D073C1B9C9D2AA9AEB32345607308ACB1385D3782F237E6DD3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/3312-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c50c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3312-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1508-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c85-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019844-225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-590.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a54-627.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-713.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-738.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-770.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-844.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-869.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1085.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1321.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1404.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1405.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c50c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f6-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c85-60.dat aspack_v212_v242 behavioral2/files/0x0004000000019844-225.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-371.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-480.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-590.dat aspack_v212_v242 behavioral2/files/0x0013000000018a54-627.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-713.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-738.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-770.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-844.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-869.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1054.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1085.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1134.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1153.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1212.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1321.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1334.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1347.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1372.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1379.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1386.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1402.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1403.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1404.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1405.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1508 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3312 2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 1508 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c4a59dc81afdba2af2845bf5f7a28e6d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3312
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 760KB
- SHA256 54396adb0ca702cd705324899c7e2199df06d8b8a294c1c1f8ef78e9eca23b79
- MD5 c4a59dc81afdba2af2845bf5f7a28e6d
- SHA1 6172914db9fa24b93b49c7a12fd964aa08ffac08
- SHA512 b3a440ccca08985eaee0182fec2996fb9f8cf711b00c90b43b62879a4be3542c7b53654eb06b18858e4348255cac3e1d4318933fb08c7a21f48badcb9e34a9ef
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE:A3mF5jcAkSYqyE0BOzylE
- TLSH T1ADF44A16F6648675D073C1B9C9D2AA9AEB32345607308ACB1385D3782F237E6DD3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 a4a36349316fcf5061ba5ce5c3f0cb5c475fc31ba113496c92c2f9c478e1002e
- MD5 a963be6ca15628f9dfc6c6a3998c3a5a
- SHA1 47dd31231e35a313a7af85bdad3d0b12305ee4c6
- SHA512 75f10a500932f57d7f464b0d655c0b45b2f968be647c05d4f39fbe56b99829b12f78f118fef8386098e3c5562d3e9937f9b4fa0e3a74a988d191bb83ed3b9850
- SSDEEP 24576:A3mF5jcAkSYqyE0BOzylEP0Le5ji0hmxNrM:A34pYq/RPji0Aj
- TLSH T12E552916F6748375D073C0B9C5D2A69AEA72348617308ACB1385D77C2F277E68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 775KB
- SHA256 cf02bae6f0faf76a524b3de378dfce805c553698b7c69feb00399cb55e19a55f
- MD5 bd523c9171e22aa0be594e8fb9672e66
- SHA1 b9e76477d29dba5244b687911446f5a1e603931f
- SHA512 1417c2392d388fabe8267e452b93376740fd3519e194f2679fedefd48005a18c3b9cc8fa4d0a8ed67547ed4c0924bc80dcc3f5010b8009f1dc587542bafd2a22
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lERa:A3mF5jcAkSYqyE0BOzylERa
- TLSH T1E6F44A16F67446B5D073C1B9C9D2AA9AEB32345607308ACB1395D3782F237E2D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 808KB
- SHA256 303add277bf5f8b12078d1d1fbe99b5c9f145d6b5e16ea8f6d1a3f60e06fed4d
- MD5 c1e29c44ad4c72da9a8dfa9bd48c27e7
- SHA1 7be2feb6822733cc40508a57d0703ce8790c1ccd
- SHA512 11dcb66f23ee66e6a12f32237fa33427058a1bbaf7c15f84ebdcc0600b07379f7f38fdc1012ea6c7f839db9431f9e1405ef0da0f5e227c7431fb5930c45cb04f
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEyb:A3mF5jcAkSYqyE0BOzylEyb
- TLSH T15F054A16F6648275D073C1B9C9D2AA9AEB31345617308ACF1389D7782F237E2D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 784KB
- SHA256 cb227a7ef944415a470ba1d763f04ae43d3cfbce739b4ec5c439a29f3d9c5308
- MD5 2883aa8d93f8b62ac324aa25d5f9e61c
- SHA1 e89f904bf8c3aa68c014e686e2b8f7c67a44cc8f
- SHA512 45180b0997769e246960769ee7ffcf0b19c58c292ffb41ff4bf743a8bcb3be6ee3ed11fccbce69f6371cc26ef132eebfc791f3509802e3678c73e7429c8f1b7a
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEo6:A3mF5jcAkSYqyE0BOzylEo6
- TLSH T17D054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 784KB
- SHA256 e29ae7811496402a176077b33facb7f6e791d38ecfa48554a7d32a59ba323737
- MD5 122c5092c91a26c3dd2ca1bd4ce2a1e4
- SHA1 47633e4fa5ead4d46e7eeff1336990cb57f12c50
- SHA512 a98300bed68bdca6b225e929a5866c017d70146c31bba8b38e2c6028025faa125186ecd759f8565025f5cf430207673de65d4257070c1fe394cabaab107bf14b
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEsN:A3mF5jcAkSYqyE0BOzylEsN
- TLSH T12A054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 784KB
- SHA256 7dfd0903caeaa0e3b21d25a105e1fb90a02c8b0d54689e227d3b5898047935ea
- MD5 becf252757adecfbb59dd23d376fef54
- SHA1 2283816d1a3db8d41f9ca0b96b60af33c28fe233
- SHA512 ea8ef30d468a3f59016c52ffb59585de3ba8f8f9c90d5a5a917e98e70e7a327d755801c2b83e9200f97c568092ff36453f5e0b696f00702ecae59e45271810f0
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEif:A3mF5jcAkSYqyE0BOzylEif
- TLSH T1D5054A16F66446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2DD3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 922KB
- SHA256 736788787bbdd191ce3f80483264ad575782dd5e5ba43cca3b3560820db112cb
- MD5 3410db2251ebdc19e5ef46ed7d572188
- SHA1 558b086a45bf7ab08a0289769fbf079747bd014b
- SHA512 c948c3275800b38f8ba94226df69185749db1e2e189a7b95341ed71353831820047bd9e0bab595482b205ca3e5fb062d9ba5884823260a646b990740b065d79f
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEQyPz5L87:A3mF5jcAkSYqyE0BOzylEhzy7
- TLSH T1D7155A16F66442B5D073C179C9D2AA5AEB72345607308ACF1399D3782F237E29E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 784KB
- SHA256 100c2f65258428c39cf425548d0baef133f2c59ddcc034b26cdb7cc7378e07e5
- MD5 d7329da93806f06b41925975a98ea504
- SHA1 5f928f44e2131d6efaacb999056fc23e84113bb4
- SHA512 c9e1819021ed91d559cf2e718a82076343cffd25bf2eebb4d71d7a6b6e8d5c6429fb5c18ca0d6dbd26626da34f8a047f76c31c33e0754828ac427d282bf22c65
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE8o:A3mF5jcAkSYqyE0BOzylE8o
- TLSH T15A054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 784KB
- SHA256 feff592b5a3aec39b2dc71008966572b30cd47c0b1da502d66cb4743c70f8c84
- MD5 d9e009d637fd8cf3ca13b35cdf36ab0b
- SHA1 7e8ad9304a910a9324a661a744605cd8bc1453e6
- SHA512 b863bf5280e6101fe3fb1cd81c314906955578cdcf3e06907ca9a69e83908d40ad0705a95cba88e72ed189bf2b7b48c965cf35b09ebf3de58d9069c74d08de00
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEcu:A3mF5jcAkSYqyE0BOzylEcu
- TLSH T1E2054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 922KB
- SHA256 88d76800b51b029d0ec528ad3574eae26ae110bfa4ea5fa8adb1f88deb129e9f
- MD5 7403606ce7320780bf1450b21e967576
- SHA1 482157a13c6bfbba21d09cadafda11fe976cd98b
- SHA512 8f2032963a5e6bcaceec7c261bbd0de9344eefbd4fe885cd40e4ecda6cbdc62e7c4e687e5a0bf6c5bcb23bc621c146c1246bae64c1cd9567a85d4495790fef2c
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEhyPz5L88:A3mF5jcAkSYqyE0BOzylEwzy8
- TLSH T1ED155A16F66442B5D073C179C9D2AA5AEB72345607308ACF1399D3782F237E29E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 784KB
- SHA256 44f8f321512d812a3548cbf268f876392269d1030eb8fa639ad4bd35a68ec8b8
- MD5 0574595d2cece30e5de7f9d3ef975708
- SHA1 4b1ce2da2a89f8d079aa948a261e4957a43bd6ba
- SHA512 aab163d51456758a8dc72d6677f36bc32460615c7f017f2eafbdf079d7ec97f2d30219160385da024c6e9b1199ef433737c580e24e9991a57c60114cbef1c2b8
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEg9:A3mF5jcAkSYqyE0BOzylEg9
- TLSH T1BF054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 784KB
- SHA256 c464607911b19382faadd3949bff0210a94421fa62c099b2f2e7207866680b9c
- MD5 9c0bba18d759221e27a47d0b875da67a
- SHA1 68e8cb3ccdb3911f4f6fca5e8cc0fc1fa20b8b3f
- SHA512 dcb50156435040a21aaab49ef90ffa8e0325fad203ea54a8abe0e1d4b3ee80b8d6f0724d695342a4c12ddd9bbe63ff5c5cb140739a799dea95e1db8690b834a3
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEoc:A3mF5jcAkSYqyE0BOzylEoc
- TLSH T1A3054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 784KB
- SHA256 9502f60d87dc0d79f518752d669b4b97fdff80b195b02ef0b07c68ab25a2b449
- MD5 67f4ba72bf0691252f8d8cbc4815af90
- SHA1 b7c3707a259471edb9b7e5cca15c9dba4cf293cf
- SHA512 bb2ac5ec11bcade0de2a8798ccd4fde0d4902aec2a3fec5a76d7cf180c26caa49decc3a0d6d53b1034a1ab8e729f7265c87a5661dc2b36fac6464e383379ae61
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEBp:A3mF5jcAkSYqyE0BOzylEBp
- TLSH T15C054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 784KB
- SHA256 f9393852c6a90fa0e8cd4255572caddbfac00c894a5f40198fa58c860b006199
- MD5 3ebaa1f2db47cb96628fa0b1787ed6aa
- SHA1 e02aaf90bbf3d5c2d6f1a0287bed0881f7435dfc
- SHA512 fed46a136ebff74adbf82ac913c6aa0c07178997bd23cdbf245ebe6579ca5148fbb71fabb41ff50f0d12ba314eb747613a649225b34c0426c08010fe734e1010
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEW0a:A3mF5jcAkSYqyE0BOzylEWN
- TLSH T147054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 784KB
- SHA256 55ca761509763eca478c400032a2ee6f6f069164ec87f5c2912ff6449feabf50
- MD5 857424555d994fb34d8422ef2b82c124
- SHA1 0533d7d096ef4e41b16afbbd792bf1ff0fe7b36d
- SHA512 c42d9d966eb43de37678fcae71448ecd851de5c0861d66ee38a4c615b4bd06f48113ac01cf01e0d6e687427cb70bc8b38d697cc53b55513a77a3be6dfebf41f7
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEaF:A3mF5jcAkSYqyE0BOzylEaF
- TLSH T120054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 784KB
- SHA256 036bc8d9a106c1499ca5528a95465bfc2962dfc7f17ad9255b2dbc1081aed8e0
- MD5 2ca3e50a131de46220b595ebfef3bd1c
- SHA1 c54937e827561108b7c1767ad7c4d2b4905f6efb
- SHA512 dd7713cbf156fa6cdfe1f0deffeb30b66a8d62f2ac3d0604002632a70770d84aae03f87d8073f055f750acfce3fd3ed51d4f6264ffc20ec29a86b242ce67c7fc
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEvC:A3mF5jcAkSYqyE0BOzylEvC
- TLSH T15C054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 784KB
- SHA256 fcfec303199ccac855ca2153d310301a05fff2284c3338985fc07d219226181c
- MD5 4ee5f85d38e76bb549703b6921cea5f4
- SHA1 adeb82a1325e5065564ac6d531952fb2f3aa31ed
- SHA512 cf161e3e968bb99e3ff36d3b46bf928754c5dc0b301825081533f1f08c06b319e5d1edd1710ba65c87d0c41381c64fc72e38fcedc0c78a958daaf1d75d79798e
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEQw:A3mF5jcAkSYqyE0BOzylEQw
- TLSH T1C8054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 784KB
- SHA256 5170f0c9f039ef503e5f2e64196945faefa35fa3b695ddeda716d7e4385d5071
- MD5 2a9f8f022bb3bfa545c27effdbd33fef
- SHA1 9de710c6ee91364c174e94c7dd8c443f1db96370
- SHA512 5d37828ace0493f4557ca3417a0498c68546c687cdd5b1b989861e35c34ba088dcc1017107e5a0edffc205ef9140d9992ba317542c121f448dea3fa60558b163
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEvT:A3mF5jcAkSYqyE0BOzylEvT
- TLSH T197054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 784KB
- SHA256 e44b4175b51b25a14636d7e6d4f54671ac3ae3c792713f2e0c519ab16bbdb21a
- MD5 6b5ca615a4fb784459096f38fecf4e13
- SHA1 ec80f3b2c4602d21c7c4d0d96ff11153d1200477
- SHA512 92af900ee578addcca5766d64e51fb5b840be0df5ed49b79e0c4d18dd11bc7959a4b3e1b0d9736b1341f2f3db0b2f0728ddd4ca264555a150821442e003244ef
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEpu:A3mF5jcAkSYqyE0BOzylEpu
- TLSH T168054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 784KB
- SHA256 6a39d1a32b1b827e8717c2b1eb340836d36e4d1a0255b7f62c1d46c30ffb2e90
- MD5 96a4df9f0469c0e391c6942f0cd3f2db
- SHA1 6c5bec827b2e1a387c43aa4c79e30aa4a8c9020f
- SHA512 a801dfff3f56095a2565fc45ef7fd31cd511a1be11c4a26ce1fc9b7dfa89b16b9b8f676f82aeef4e9048c0aee1be7dd293c8d82885f5a1c0df38d0ad40c30783
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEhb:A3mF5jcAkSYqyE0BOzylEhb
- TLSH T193054A16F6644675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2DD3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 784KB
- SHA256 17bb9a6eab71ab8b7175255b8e0aee39ab19c204cee728a9a2d9fad5e14c2b05
- MD5 4796a2b59db368aa1bd5773bc770327e
- SHA1 88e7686e97c6b74c0bb262a06edb294e5621dba6
- SHA512 2dc8e130dd70b6a2db253d7a2399904d9dc435dd163654c4546775534a0e81fb2be7f843963041aa80b8ca4f7ff95f345a356d0fd5384137d0044baa33173f68
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEpf:A3mF5jcAkSYqyE0BOzylEpf
- TLSH T1FA054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 784KB
- SHA256 ba2931805756799fc486a38c8d1e92499601651895e38a7712ad33b1208e84c6
- MD5 06c6653c0068ac24a53e045dc0fa6a80
- SHA1 87f2705e38a4398ba69de7663e4650375fadded8
- SHA512 bcd4e4d6e42da0b254203e8bc976b195a5fcb6a9419e99311a0454243c13e9950aa57e9c37fefda86b36761ea495b820c3fe7aa4acc69b9b2082fbe638b8e0f8
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lESK:A3mF5jcAkSYqyE0BOzylESK
- TLSH T1F5054A16F66446B5D073C1B9C9D2AA9AEF31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 784KB
- SHA256 50e15126edd6a0dac29426d572e275b3a475657ce57917f5df4d6107b95af673
- MD5 7ecf79227753aa4f90e9374291ebc389
- SHA1 0f7c84b0992efd45cc76ea4207bec011601ed690
- SHA512 42f341d514afed27e8de72b4b658f80bd0e83bfc98c473ae9ba79e87f12f82b14a433335f912a88a4db26ca3af5c566bf39611c4bbdb8f2c9b41387515db2ced
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE3k:A3mF5jcAkSYqyE0BOzylE3k
- TLSH T19E054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 784KB
- SHA256 d56b2df9b0c96e0e00085414aa58f705bd3aaab948354121e135dbc9196357d1
- MD5 b8def80b93d0109ffa87a694b1815852
- SHA1 d8ef07f1ded65f6158225cb41fa9b3ba6054699b
- SHA512 2987418650f3abd257725da1d5c460c8c246018b22f01178fb5b5925be31f70b3c0cd959143f001b68cbdb10284a080a82a7a6d0c7285f06fd588481c67e2925
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEA0:A3mF5jcAkSYqyE0BOzylEA0
- TLSH T1FE054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 784KB
- SHA256 07114eba51a989a6dbdd693dba6990293e099a846a76fa7681a27d09bfd58b61
- MD5 67b722d5f899dbd4d4ccd9116ac82727
- SHA1 611692e1ca0532fac348f70e6702002fda333893
- SHA512 38d5e74818129f491e06670f2391a83be09932bfe2e480e4d2331a65966bb9fda7b16ff72babc404126ff33d36c548b4bbdd4b94aa9220ea41c770dabd2b85b6
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEb70:A3mF5jcAkSYqyE0BOzylEbg
- TLSH T1F6054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 784KB
- SHA256 f7680dece52de8e9c1ba348d653940cf768d17fbedadbbed37c852e9a0e42d67
- MD5 712515cce51c5b1a6df503313f497db3
- SHA1 53b99b975bb3ba102b809df5e9062cde81014045
- SHA512 b13180843cc6b33f3fba9d3f5642c6b5b309023581c618613980d554f4f6a63f40ef4b32a619c69fb030a8208cc39579e8205d3084db18b0d419078c4b91353f
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEWr:A3mF5jcAkSYqyE0BOzylEWr
- TLSH T1B5054A16F6644675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2DD3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 784KB
- SHA256 afcdbb58c457fbe10185e398cf42e0e41f887e420c89836de60a6a8e92ae6db0
- MD5 a6aadc6ed7de5d401085feba8aeb98a7
- SHA1 2eafa76296dfcbf3797ccefc2fd74e07e173144c
- SHA512 3aa6c9129514bce0ccfaec692a87c0af17c93d87f5c5e4f7029cb0d67e8adb5e9adb61b264a1e6e6a27e782b70895efebb60e27b998df5a8944f0de73487f288
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE8n:A3mF5jcAkSYqyE0BOzylE8n
- TLSH T1F4054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 784KB
- SHA256 e0dc8f3f47d1c953dc31b89a2e3813fa84421bd87d7376399f24f1521b7d938e
- MD5 65fbd0c406360129112ec4387719e4d7
- SHA1 c78dd7bbc6ecff73f044d545c11630974ab5df90
- SHA512 0d7a99c74c44f412142e527577fd4eb7d1eb63a1d28c989c3bd3e3b04695e1e1aee96b630b7ce63c4dd2a6812969157add051f345816888d0d02f5d543de7707
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE6x:A3mF5jcAkSYqyE0BOzylE6x
- TLSH T14E054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 784KB
- SHA256 e4d44dfc32f71c95b9d3ba72d0db63775c124e31917c5a2afdd078901c25f73e
- MD5 3a2e7ced5c3748fe90e89d70639e87f5
- SHA1 3ccfea0b23afd487192f42b2b72db3da216ca2de
- SHA512 ac8107008565a4781f916ce38d7263fc1c1c9756bbf97b0a9bf55ea3b0287d2b1c650e9c835d89073df8a0099ba3fdadc1516388ad933d10efe6169c338805e6
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE8A:A3mF5jcAkSYqyE0BOzylE8A
- TLSH T167054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 784KB
- SHA256 712da8d0ca65fcd9630197387a9a9598522cc33ff16120b0cb84838251856e8a
- MD5 a751ae8cac8855b40540b90ceb4176e9
- SHA1 d3e12ae17aa0cf2e3f9ecbb7c8b455476ddd86a7
- SHA512 e676a581478ddc92a73cdf2dac830a851136cf15fe2a5ef256da09d5edc2126b8194aacb3a88895bda8e14986f7d65ab0edc687a81c783003ecd90db17533914
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEl9Q:A3mF5jcAkSYqyE0BOzylEl9Q
- TLSH T17D054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 784KB
- SHA256 5cd0d93e164d5b6ca2b875eaf916882cb6df24d94c5748bf32b5f1ddcbf7f2be
- MD5 8d736cb530b758b1cab1b6c009b62957
- SHA1 4dc4f33c6e03855d9d6b6c2467c7c50ec7180d86
- SHA512 2b9c48909b32690d3fd3e11a961a66a2e43e35ef19649559bb8f7ff5af94954d6cece91cfee2826c0330ad22398c4d5aa029a98e23c8c6dbf403a49839826b20
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEQ4:A3mF5jcAkSYqyE0BOzylEQ4
- TLSH T1E3054A16F6644675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2DD3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 784KB
- SHA256 65d1da56f70f67c4f65b3af1e86eaf2468db19ed04ab1f080db26fdeb474958a
- MD5 c18836224e9df6cfaa96a1be5d24fdcf
- SHA1 24aaeda960f9984367d300528cd60f52374211c2
- SHA512 355fb3a836c4c0c4278ba664ecadbe8ace502b4f167bbffd50b363979efd83a6075278ba42a13ee34e82aee057ceb98e6179c3123bf3dbb4b50919330ddc7e57
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lETu:A3mF5jcAkSYqyE0BOzylETu
- TLSH T15D054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 784KB
- SHA256 1ca6c22843d20c31c8b8ffda08052908ae83b2d52464663081fc697dfaed9075
- MD5 ac8ec2cc24c1fdcbfdde3c2606198d12
- SHA1 cb1292a3fc418d8f089c293b641e4ef8b80a04bc
- SHA512 8e99e61ad09f73e77c556824cde7c378e4d37427f4f343ea4365e98df5ba37860cbb4d6407952b65b0b96a5f054bc9a43194a992dee196725ca5d142b860bff1
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEOj:A3mF5jcAkSYqyE0BOzylEOj
- TLSH T181054A16F6644675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2DD3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 784KB
- SHA256 e809f0134a6de4e736dbac81971b3b84a52b6b94158174922d32c627d09990ad
- MD5 f5428c7dc8a0e36faaf1913cafd15c23
- SHA1 42d4d5799a6cff5c37ce09133919a4e89fd4e536
- SHA512 71187689caf3521d4a25bcf6fca263c5ed64ac6c3f6a355baa0e20114d1e80942869bd2f1230f865040bf57b079c9613e42c67c0ceab0184e56b47db7480fa54
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE7g:A3mF5jcAkSYqyE0BOzylE7g
- TLSH T10C054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 784KB
- SHA256 8fe4e93e4107c9cc37f1a923c70373ba96b7e13d02b1be9dc4db5195ff504d4b
- MD5 fe18c3755d6bca7cb846062459356584
- SHA1 a4e79f9417b6bf187d2c9f3d687a06e1ede3e03f
- SHA512 4d7847454324dec8832c1be2787629a3e8a03738c000db9458aa87b2aef75aa45ca66d256bcfa01eb121803a30852213f253a036687b881d6ea4eef2530432ce
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEmI:A3mF5jcAkSYqyE0BOzylEmI
- TLSH T1FA054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 784KB
- SHA256 8acea4e83e69ad105f9018533ee2430019571313a82f612a163b776acd6bc4b4
- MD5 bc7040aeab3f27b99300158a2553e182
- SHA1 db10faca8e1e915aef821df27417f5d38943c95e
- SHA512 fa40bbe2a0a5c421681551f3381b68e4e0b653756a63303c5780c87cd486f51f2191915ec8beee722ab2bb0dfb85a3f950bccb2d90e75ad4c0a67f1bc70f7d75
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEUo:A3mF5jcAkSYqyE0BOzylEUo
- TLSH T1A1054A16F6644675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2DD3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 784KB
- SHA256 917d13cbfc709199ac2d009e67a6de092a593e124bcb7c0dc29ca627d90c30e1
- MD5 33a3917a2a25537dd473629d4596f738
- SHA1 c4d8a6b279d30b485af7217b3b05639c34067eb1
- SHA512 0fbeb94b0752afe0c27e9f6f8cd99b2bd0f39dd5664b4d1e1270b18a7d9c927893e15db848734fa3b591581fa055bd61719a868b452a5b790b9b8c60a15be12a
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lE3+:A3mF5jcAkSYqyE0BOzylE3+
- TLSH T1D1054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 784KB
- SHA256 11f1d8bb311bf86196886ad7c122fca1b0e8cd96e8f1aac2e155d399d19a3052
- MD5 cb7f6c7ea1e95087df991a0f104c13e8
- SHA1 e9c5209a523f636d7ff2fa1e20f0a1b3debf904e
- SHA512 60bc492b6f7eb7a25448c6d0f51ca0415381675417faf2acae6ba179027bd6475d7871bbc0eac69822a278ca2d06d5abeaaa3e08ff8ec6ec225218650e772ba9
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lENQ:A3mF5jcAkSYqyE0BOzylENQ
- TLSH T142054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 784KB
- SHA256 6d60d92ce694dd929a9a99060adfeb2df2c24acc69931583c04042085ef01e3e
- MD5 bb6418aeffe23e4d87733fb9c8d9a9ac
- SHA1 6d0174b7f7829c1a1e94f79ec3209c2eb992ea18
- SHA512 0261d5e28139409ae1378eebf08c83b10383cc9cd37534accd74063254a4695f18a246623d580a93263c7281a41ab0b9f55902cb36744d01fc4781b5a5e49ec4
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lECX:A3mF5jcAkSYqyE0BOzylECX
- TLSH T1F0054A16F67446B5D073C1B9C9D2AA9AEB31345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 784KB
- SHA256 90f765bf8d580822368ca00051a1c9dea1f718cdb454e638404615cb09071631
- MD5 27f7e73c8894e88ea47cde778a353c0d
- SHA1 c5acc732caf1d105507f33df6bd958843cb86732
- SHA512 49684638d362775ebd15bb01a7cc02156618f78592b48c498af028338307e9c960eeb4ea251e3cbd9b9d50852d84d69cd103b0cfd9c86a1e5d8ba78a9137a5ec
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEkL:A3mF5jcAkSYqyE0BOzylEkL
- TLSH T1A7054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 784KB
- SHA256 a49a708622a2dc550b6e26355e06ecb4c5f83db70efcd2a7040b2181a3912aad
- MD5 4635175e1fee3989da90dea72fc72534
- SHA1 fd409194e0c8667a20640b05d7016b993ae1eb69
- SHA512 33aa841d5977aee0b27b7fb5fb03130cd0887a5d28996e37581d0e658032103f731e161c635d7ecc354fa798dd0c931e88a957ccd86f13e3ddd6dd44d758c0a7
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEAFC:A3mF5jcAkSYqyE0BOzylEAM
- TLSH T1F9054A16F6644675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2DD3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 784KB
- SHA256 7fcbb964ad8499107cdf5b65e0406848644ad5254b89c73c8b7c8355453cf720
- MD5 13b80c802efd8a105cf76498c880fbf0
- SHA1 7a2b8323a152f9f14b5d93c560ed26b1b6f4e80b
- SHA512 0cb1c92fd4eca2f4cf140938b4f35415c125c91115b76397fc825ff56a8ab8c98c23d3f3dae6ad56b29a0447dd561ac90991132cfa20c257b290fae113540ce8
- SSDEEP 12288:A3ZUw1gL5pRTcAkS/3hzN8qE43fm78V0F7jyPz5L8lEhh:A3mF5jcAkSYqyE0BOzylEhh
- TLSH T1A8054A16F6744675D073C1B9C9D2AA9AEB32345607308ACB1389D3782F237E2D93A771
- MD5 SHA1 SHA512 SSDEEP TLSH