Analysis
- max time kernel
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 12:44
Behavioral task
behavioral1
Sample
2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 900KB
- Sample260703-pyzbmshv7v
- SHA256 305c58b89102da3c55bd525e029bfb8440ad9e01bb981762fb2e596f3c405712
- MD5 37caed54ee474c4256c20c9f0364bd91
- SHA1 2b7d57f16b99c87117e26eec0060e2ad06039ae7
- SHA512 1ba27964a14971688c2e898ab4883b03b95e24bd367cf86022e094a3db85712e425a3e64187bf11d5c967d06127afb17489fb218bcc5a24c0cd811dfdb5f111f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjM:A3mnXoZjzyaEFyKUluzyAZJy+agjM
- TLSH T17215AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/4936-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001b7ef-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b21f-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4936-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b8-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5980-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c79-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4f-221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983e-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-417.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a4c-514.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-605.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-721.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-923.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1086.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1135.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1154.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000600000001b7ef-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b21f-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b8-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c79-60.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4f-221.dat aspack_v212_v242 behavioral2/files/0x000400000001983e-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-417.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-489.dat aspack_v212_v242 behavioral2/files/0x0004000000018a4c-514.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-605.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-630.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-721.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-828.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-878.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-923.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1086.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1135.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1154.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1186.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1223.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1326.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1346.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1372.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1385.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1401.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1402.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1403.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5980 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{94CDC4E8-B8E2-48A3-8B99-4B3DE5E797B8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4936 2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5980 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_37caed54ee474c4256c20c9f0364bd91_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4936
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5980
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 900KB
- SHA256 305c58b89102da3c55bd525e029bfb8440ad9e01bb981762fb2e596f3c405712
- MD5 37caed54ee474c4256c20c9f0364bd91
- SHA1 2b7d57f16b99c87117e26eec0060e2ad06039ae7
- SHA512 1ba27964a14971688c2e898ab4883b03b95e24bd367cf86022e094a3db85712e425a3e64187bf11d5c967d06127afb17489fb218bcc5a24c0cd811dfdb5f111f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjM:A3mnXoZjzyaEFyKUluzyAZJy+agjM
- TLSH T17215AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 d8b8b9145b55e1d2fc721439f52ae33d155baacf835eddd297b675d98a541227
- MD5 cfe6d3de19b31e3a0a11ca718b623b1b
- SHA1 4453ee99a0792258439d54618257155bb285d292
- SHA512 362c7e73f44a6af40c67deb22f008972a256ed95053825f9544d3f8f410b8cffd3054aa98b10df6211618634a7221193b2fc720745b78c19485e3cf2a22ea20c
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZJy+agjU0Le5ji0hmxNrM:A3kMjKJ0Pji0Aj
- TLSH T1B8657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 914KB
- SHA256 09c4c22bd59961f67c5a6cf2fd300550ccf0797fbec5f92ff643511168274a6d
- MD5 d9830416d1d53e1ec15ed3908d79598f
- SHA1 96a04b17ae1cc02ac9ae46466acb98f62ddc6397
- SHA512 b726eeb2422d2b3070a4ada43d482fde61a2060fbfc7db661f6100a57217aef84935587235f2a0dc776cb262a8d09e8bf985e9490c1c0cc78d6d4f183db1d123
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjea:A3mnXoZjzyaEFyKUluzyAZJy+agjea
- TLSH T13F15AF03E7A410F5E56B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 948KB
- SHA256 fb8b3850f254763863edb6d271dc9d9bcbdf542f452eab6691464d135d623a7c
- MD5 297aa7c9d3fa4eda313e9ce19e048237
- SHA1 6cf1e605486efc1fe215761a845a33af4f681f6a
- SHA512 4c4c2700e32989667b0c43111704583a7f7a2531afdc5a444d4591d0ed93241cec03a574d140825e026b465bc036577ddb795a8ae8e1e66ce84470eaba5d5f15
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agj9b:A3mnXoZjzyaEFyKUluzyAZJy+agj9b
- TLSH T1C325AF03E7A410F9E56B863099E54612FB75BD622B70C6DF235882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 923KB
- SHA256 80cf35973d0cad38cdd162a70ea43254123a6aefdcddf239b60175a7b44d9b44
- MD5 0b89905b8102926d0c85adb525e68dad
- SHA1 c2c92147ebde7f74064c948f88e78588c8fc4583
- SHA512 54cc5da71cb53a20d43b4d5265904bb548dbecd2da82b486b5ebb42b50107348585b77730636cb1ce249c955f353790f6da45c9d0a6c65a25f4018e558aa721a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjf6:A3mnXoZjzyaEFyKUluzyAZJy+agjf6
- TLSH T15815AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 923KB
- SHA256 45fed96868c5c6ef681fd438be90f98a50947817cc0cdebb14128e6e3b0b930c
- MD5 8b8d1b2db1b00358ed000d304129d69f
- SHA1 97dbe9c1a2ea774182839182ed5fea651a2f50cd
- SHA512 1de50dc6dcee8571c96e6bb01893d2b55801e97795c497af4f35b04b3fe26929d38edfe8241e67b02588f0301994b492621d17dad0f92caa0aaa16ea622084c4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjBN:A3mnXoZjzyaEFyKUluzyAZJy+agjBN
- TLSH T1C715AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 923KB
- SHA256 72d6e931c223ce0c90b7c94bff224f2c5ffbf2dce7cf8ac4cf906a64b912772b
- MD5 f8a48eb52f59dff310d2a7e50c9539b9
- SHA1 4e4a9a0093ca5ad79bc17074e0026638742d3694
- SHA512 f494a015315a5695c4594074a93775632e6ac3a3146b6af4298336f1634db3899b00f921a65b030c786008d91b7d9aac294c2402b0226a1fbace18b2fefdcce2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agj3f:A3mnXoZjzyaEFyKUluzyAZJy+agj3f
- TLSH T11D15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 923KB
- SHA256 0a7491ae28abac42ef04c02d52fb62552df60ab3b14a021374863df78bdd299c
- MD5 d18627cdd0f7de0ce993494a0a81aca2
- SHA1 3bf2d1443761adc7c4a6b3d450ac773064adf01a
- SHA512 1590ecd5ba8fa5e30d4c324ad29af26afa4f354d58cad672dd22e12bfddabbb188fca09fe4788130de0f4635c5e8324fe8bb3ac06372f3c51c0c1e65cd55d4ed
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agj5o:A3mnXoZjzyaEFyKUluzyAZJy+agj5o
- TLSH T1CA15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 923KB
- SHA256 bdee54ed8639fafa32588e95ffe5dde93ea8bfb066e6d49ef4737a63b5e0f262
- MD5 639282ee5360850471ce06df9b857f2f
- SHA1 fdb5b44973e84e0dcc8717bf344840e2e8bf870a
- SHA512 5bb1fb1ded3ee05bcdea3a577c7150dee0c1ff1479feb2b4c03b814179439d64e60557c87f2fca29c199346dd8e52938d2615a13ec9dba8a2548dd22e94ad89d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjpu:A3mnXoZjzyaEFyKUluzyAZJy+agjpu
- TLSH T17B15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 923KB
- SHA256 b6431ff2fed717aa359057724a2b641b9077bb36e99eee2ca3e0c2ee7128b7c1
- MD5 d92151a74899cc6e62514de1a8546cd2
- SHA1 1c6e502ae0254a92fb8978dd150514a097047fc3
- SHA512 458eb05680abd73afaf239f3ba40afe056704fba940999472268fa09df38a14445f1c0acbe9a863dddee3d43534ec760d426e796250fe5b3582a7da16036ca79
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjP9:A3mnXoZjzyaEFyKUluzyAZJy+agjP9
- TLSH T1BB15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 923KB
- SHA256 090253c91678d5622b9a4e7953c4daa7082c06813916d4a86a02b19178699ce0
- MD5 5944aade7140bffaa5efcfb6e57c65cb
- SHA1 a003f1246237bdf370e75207390fdbe53cbef6f1
- SHA512 7f840b8b8cffc217eeaec12a5c61766834f7e7b27b4bfa61cc604101cf788ba9dcc415f306bb0ca293035b1fa65ed5d6fcbaf02081912d98bbc5608b90e7482d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjrc:A3mnXoZjzyaEFyKUluzyAZJy+agjrc
- TLSH T12E15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 923KB
- SHA256 6a637e83ef54539bbf7e4ada4ef33b44ec1bfcb80029f7423d5f946289ca7db0
- MD5 3bcb751654c863c6db7552641bab5e1c
- SHA1 334b090c0307ecf2f85a8746cc8433c0394c5bf0
- SHA512 ed7b75bb6fd4984552f49b684b7ca6304c928d69ad5efc56e7456ce8d2d07597ab1fb6bfacf6c5bb6eb287b02cf32c02ed7ccc368d42a52449ccbf0e7893774c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjUp:A3mnXoZjzyaEFyKUluzyAZJy+agjUp
- TLSH T1F415AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 923KB
- SHA256 fbd09a2fc4e1a1f2dae20555d5ac2b0963408c422831dc0d90c7034e76051125
- MD5 d80628c4bc98bedf5d7fba35fd311282
- SHA1 2ac7f0cc8a0bd7205f2b0e42ab72a09f9c92a4df
- SHA512 35b244848be76c799189e77306ef9dbef740759955c0750df81127eab31d7920c74c6ba99f947e5269430739c1d1fe0f095589efe46f6cd43da6b8374645e803
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjb0a:A3mnXoZjzyaEFyKUluzyAZJy+agjbN
- TLSH T1A615AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 923KB
- SHA256 e14ef1e6f62f861f997024aea63fb909a3109d77ecc6a9b7e15eaaedcda8699b
- MD5 2dcfe01c368a04c5f87441cec6f662a3
- SHA1 56b0f4e5b6a039be1e79dc957f80dddb9ea4cc07
- SHA512 8687060decade8ce77bd1e6c2ce7b668d6d2ca0f5e998c6b762b762d1d0a8d664b2bde75eaaa0a311fe6a16e5a56b3dccc2d648c3242e23b4757866224f44f06
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjpF:A3mnXoZjzyaEFyKUluzyAZJy+agjpF
- TLSH T12415AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 923KB
- SHA256 0d4a1e440e4a006773694188ab02a22a89ca1fc0bd4804a4e58cd459d3dd6422
- MD5 6543c9ca3d75612bacba87ec0638b6a9
- SHA1 2fcbc5125ffa7f49f8767518fde787f4fb134091
- SHA512 c68d64e45742e78978d4f083e9377c78a496c53cc1f301571159559a9e0e975727168285e7d1e9228a398655206083c4ca79786ecb8b9d110d019bac9e348536
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjCC:A3mnXoZjzyaEFyKUluzyAZJy+agjCC
- TLSH T1EA15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 923KB
- SHA256 147a5a9858f2e55caf2ba97d1c5a86da6ae342a0c08495021ef0f7648c9cee28
- MD5 596ab0466603a81ff93c5c8d8c8e294a
- SHA1 d345f684b2d70f44e9ee0092fb3eba0ee773f30d
- SHA512 bd8f01a7ab6a44e2099cc22db48da2df0ad6cb7721acfd7b2dc14fc0e7de94cbcb832bf109e785cab940f4775f61ffc2b0d58d550e885a6ad1371f5430a1df62
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjdw:A3mnXoZjzyaEFyKUluzyAZJy+agjdw
- TLSH T1A815AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 923KB
- SHA256 7ef6520dfc6781e708e4f7f6c8a002398dea3b950b3d2b2477b416c198ff15f5
- MD5 a4f66ad395377a7deb037f65edad114d
- SHA1 0b1204222d300475db505b8a094f661d0f1524ce
- SHA512 f63a280ef30417f35a18c355d02600626d911a614b28ad6e99e54d9e176585a6167fca7e303ef9801d2038150fc49155092a41a73e7dd1d5f31ac443920f93b6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjMT:A3mnXoZjzyaEFyKUluzyAZJy+agjMT
- TLSH T1CD15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 923KB
- SHA256 d0052b1466ed8ae25606e0a7f3f93ad57cce877e45a5b167bfac6f4c59d33271
- MD5 fe775bd7cb22a9d18dccc9286f8339fd
- SHA1 ee6b87a19f900759cc4a2371fb8dd1a9576db3d4
- SHA512 87d179daa038f8e3cc6ead19aa4c01308738b7da7f6c231068fe007c9fee06249b5ac76ac1fe9b7ada92c06b46f9caf83facfaa8a4ed92aac82b1aed3c0c5e74
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjgu:A3mnXoZjzyaEFyKUluzyAZJy+agjgu
- TLSH T18A15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 923KB
- SHA256 20beed7adf496f1322d1bf29e17507070307678b9aa587bb34e222654e2ca6b3
- MD5 11143f16d289ae064bb95b3dee27c841
- SHA1 75404c1a6e196c9d96e0c4110255855edeb987c1
- SHA512 06a3ef75e42ab2978d947630b10d81da2c66ea67f16ccde586ea3751d0fc718c5cf513424a3d14ee175c036b39896707691f0ee573e2116ef491dd6709a78206
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agj+b:A3mnXoZjzyaEFyKUluzyAZJy+agj+b
- TLSH T16F15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 923KB
- SHA256 5bf8872f8338e618ba576b9cbae7311648bcb76b538fac3ec930fce437fbeff7
- MD5 6c5a2048380e07d7d801d4a6a21fea19
- SHA1 429b7064afc4f0713720597a00d0845bec503de5
- SHA512 756c06056aa912020b33005516c53a9984b64c5c30f95a7e1503fdb68a81b9702736c2756811955e8a4189f50bc3d9e6a9805bd072ae20547e6304773e70e65f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjof:A3mnXoZjzyaEFyKUluzyAZJy+agjof
- TLSH T17D15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 923KB
- SHA256 9f6ef5e885bc677cbe1cc78d7704496093dee0bbf8427e2ae142d4fd72d137bc
- MD5 28fd32645428c1c0cb40adf2a493cf5b
- SHA1 5f66f0d9067e55476ed397c62ceab16045b4a7fc
- SHA512 4024c1c0aa33ca7b20532848f51387f0ea396bc8e55e325a126a9effdfe9937a5eeeeb31b29ea3590b2dcbe89965391888f1d754164cc1f0efd337bf1945d2fc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjFK:A3mnXoZjzyaEFyKUluzyAZJy+agjFK
- TLSH T1C815AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 923KB
- SHA256 bd6833d0257111904840a36f54a92d5fe3b0fa263180c57ca82b57e7ffb2ad05
- MD5 42a3f160d86fc81dc6abd4850da710fc
- SHA1 960d70ec0f3af7f43e1d84088432d6aab9e2df20
- SHA512 2a19e010044e5ff52d1433e79bab328e95b2d50cb244035a95d4d51a2e89446caa241253e1748da9fc3f028d075a61aeef54250c63d8200b0a317326c70f7082
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjGk:A3mnXoZjzyaEFyKUluzyAZJy+agjGk
- TLSH T19215AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 923KB
- SHA256 a1f5b38d8e3d1e7c9e90691678f078ce067c1bc2c6bf9423e9a87a923574a995
- MD5 b48871a31b76005cb5275178499fb242
- SHA1 94928e5265f4d6a931b2012678a882e25a1e7dfe
- SHA512 6c20d89bda6ca86d370ad7d85b1031eb7e0230dd00adeb7e08bce6e2a1c2e4965d798a1aa28fbba7ea7177e80122d02ad8868991809cfa9a345038cb732d9d26
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjD0:A3mnXoZjzyaEFyKUluzyAZJy+agjD0
- TLSH T17215AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 923KB
- SHA256 61fb6565fc68252fd3e9bb0aa7caefb9271080d1defbb7001c14b28b898bed81
- MD5 ce56a3d873c9e681d19d0f6fb4dc527c
- SHA1 4ca222e1362e0577e4a06f624c11edc580db3502
- SHA512 b8f19a89991447d6e436725e0d6d4139a81d51e38fb604fd4f5a60cfdf61d0997e288560b5d3852f51616a5987435ba9f7a4223d6b838c2c134353811a3f159f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjS70:A3mnXoZjzyaEFyKUluzyAZJy+agjSg
- TLSH T1B715AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 923KB
- SHA256 e154410e095f04d76f032d2fd94edafa245c146f81753b6045ebe52900b12860
- MD5 07218ff7bfedbe8cc0edac3756b6f104
- SHA1 c43f35de7444ff13ecbe87f81a4c12d1d7781a69
- SHA512 cbad692681d779c1e56ae16880338d687ad64d7b9fae35275d4b6603fcf06a24f0d57e412d9d6af164452e74b3632d85e9d88332a661be4ac63609d70da073fc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjzr:A3mnXoZjzyaEFyKUluzyAZJy+agjzr
- TLSH T15615AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 923KB
- SHA256 a9c8a4f9da0c26d8e79b213681ceaadf7e5af4c384ca5eafa6117e439d10c306
- MD5 eed3e7ec2817a199bda17fe4945fb946
- SHA1 c997eb0075c8eecacb5e02355da5f4b71a6e16c4
- SHA512 2ff3efca54b7789b51b23cf97d3451a9187374fef82c73d4e8f7e6cb5f6dfd015b260b788f9236497221b77afddf1aa8e98dcd1c3befac186359e4302e012c62
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjVn:A3mnXoZjzyaEFyKUluzyAZJy+agjVn
- TLSH T12615AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 923KB
- SHA256 226a31937a4dbe51e7f303cce1dffada42f5e019abf7294e177690a6c5542c29
- MD5 16a0358b0d3ddde6ee715d5029a644c1
- SHA1 80ca6bdc41f22a9678f1d857e806de731495690a
- SHA512 75b87d1748678c18a5a067c15767ecdff3a18b903c3a2bd5dce6f5f541810999cddc464f9d484debb642750f416f5c351f03468bff01b2d901807659fa882139
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjhx:A3mnXoZjzyaEFyKUluzyAZJy+agjhx
- TLSH T1CE15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 923KB
- SHA256 3f0635d6730eb261f620aa886304214b45b8bf37014870a71a19ebb7a4580ef3
- MD5 48018160005e6c5e06d67fdc0dcc8680
- SHA1 ecd3d0b1a480ede4c0cdaaf717cce512e87762c0
- SHA512 2f249c5e9709364b250e3c39549c7db0d4ff2b552f1c1783788e851694c442da8fc6a2b838c42546d809a712a0fae502f6bdf3a3ad7d7b04b77e5b825abeb069
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjPA:A3mnXoZjzyaEFyKUluzyAZJy+agjPA
- TLSH T14215AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 923KB
- SHA256 b361105ae4947f109c3dda2ab5adf6e219e6259d0fefe9d11c72fdd2d53a07ea
- MD5 fabdac0e4bf578d59f5028b5e55c3f90
- SHA1 77511f1bca7af61a69a543b8655d81949459948c
- SHA512 c6119a77bd2d7c098b7ef7d79ea5ddeeee37e52e507e1c46203bfde060f2b529eeb9c799324c15d6fcf7f222fb6f8375b40445eb21b7bbce139537dca17fc830
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjA9Q:A3mnXoZjzyaEFyKUluzyAZJy+agjA9Q
- TLSH T1B515AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 923KB
- SHA256 e690cc7514cd12a3e3d9e48fb9196fb96289d664b7241b8bce641f1cc55b6cd3
- MD5 621a856be886fd8f22506c7d922149a7
- SHA1 732697de7d744a7ccd8615c6e15bbe9ad1310f80
- SHA512 8c6230cf7d9b3019f52386e6b78fc22fcfc57e0adb5c0ad56c84a0b22539fd7eadd288893ed21080381f6dca9d33abd355fb46e735834fce88edfeb8e1fa06fe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjB4:A3mnXoZjzyaEFyKUluzyAZJy+agjB4
- TLSH T1DB15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 923KB
- SHA256 e775014c7b64fafdf5b867c1590df0d5ad714a1d1c7b2966478db39373256f1e
- MD5 df012a1f6424b9c06ad1cac0b1e826e2
- SHA1 62ffb58bca53bc5a76e13868ce3af32cb9d919e4
- SHA512 bacfa44c120a8a79b8e234fd54de0c046ab7720bbf6272bb8b58e1a806f2b96ecb3f50191a6d96ad5c00aacec87954cfe60e81bc7c93e6d7f2a23a120d0f7a2a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjku:A3mnXoZjzyaEFyKUluzyAZJy+agjku
- TLSH T16915AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 923KB
- SHA256 aca869c46d4ba6b19d3d1c8e089218bb72d091663aaa0f5f29074193ff600efd
- MD5 711cba779c67a5ab2c42d34698b5fc8e
- SHA1 943dda80cad7e1d9517c115d4a2c68386d91bbe5
- SHA512 26968b1b21d85ff4396989d57befcb23179f813d84532bcd0ab7496a2974f30901acdbd4c2fe1360c7dbe5138eef109da55fee63ac3ce5a8c0dffe719b674ef7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjVj:A3mnXoZjzyaEFyKUluzyAZJy+agjVj
- TLSH T1F615AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 923KB
- SHA256 fe1874194449533911bbde3f0faa1bab195539b16f69b8578330965216cded15
- MD5 a6924681cec772d06bd6f37cf7e65101
- SHA1 740ca75517425fd036fba88a3fca33e718458596
- SHA512 9e7fc6b136296299b856e050571d566ceb929ecdc6b5c984e9ac8e9ee7bc2a6dc676aa0b68a72b962d973fb3144b0ba2658feb1629f6516ad99e10c1c972c283
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agj8g:A3mnXoZjzyaEFyKUluzyAZJy+agj8g
- TLSH T1D015AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 923KB
- SHA256 16365bcc0853d904a947667c8cca277efec1e14006830c39142e0a4dac0dc5bb
- MD5 6e75a346cd89aff55a9b116ba9e7729e
- SHA1 6878ff402979800a3dbfbe4f6f7c6b3118ce5696
- SHA512 7448848256e7d40218b08fc2d77202b119cff0b9e3329cd08b65e0f06b8eeb89dd1ca038ca3c918692bf57f35ad865903eab8ff8d62a6767d47081ea6ba2084b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjjI:A3mnXoZjzyaEFyKUluzyAZJy+agjjI
- TLSH T1ED15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 923KB
- SHA256 09972a5cce2dd1e6d01c4cfc2f9d23c21c471c6e459cb840b64124866eb7a22b
- MD5 509fdfea5804022c145a82daa12ea5e0
- SHA1 a0cf082b3b19b2476602fbfd0ea05beac2cd9688
- SHA512 0393c474e29a11b4a31ce669986492bd1cb29bad2a047cc8018d1b245ecb4afcb4b83c28465f7ef28d7bb88ebc94e409e275312e3bde66b3d972683c0dec027b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agj5o:A3mnXoZjzyaEFyKUluzyAZJy+agj5o
- TLSH T1B215AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 923KB
- SHA256 e602c040e55507dab73f1ea74dca7a0da0c6f9c32fb807df29e239060f937c70
- MD5 3b217ed2888ed6b4de953be453827257
- SHA1 71f6982c88f2d51b07cbb9c0ac46612955cbe63c
- SHA512 7e5e1df5b2df90e53583f59948d6a92222ca2063fdecad172221fa30ef29e5a6f8ed09055e79488bd67961ce27753c27ba247ca362f5d523a23106aca2fae547
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjq+:A3mnXoZjzyaEFyKUluzyAZJy+agjq+
- TLSH T10015AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 923KB
- SHA256 e26d0623e00f993af30d7633c93c3fce67c357b9c2ab677f9bc95c4483dfcf8a
- MD5 e80f670812b9ee8f0c1395a0b5675599
- SHA1 bd1e3f891f0f6ff92081c24424ef4ef51d20a9cd
- SHA512 57c21020f16b6e9ea21ca2e09cb4e8fed900cea1694369917761ddab4f3dd784fdeca24362882f82d360c4bc5f2ab4aafd149f4a0526cc8675bd52035488e931
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjqQ:A3mnXoZjzyaEFyKUluzyAZJy+agjqQ
- TLSH T1B715AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 923KB
- SHA256 5aea729ebe21bed160e94c7bd0f0e02edddf9d9af482f7a5544485ecc8881eee
- MD5 0cd23c4d6ca59b0923c094040bf1ae1c
- SHA1 6f8b1272f758b05750f2cbe8266d882dcd238b3f
- SHA512 82bdee981fe520a21bb0208589fd3639ae65f250be23366d859fb5a93bed3785b3e15a7e341973872b90beb1cb70dab0fc3b8fcabf85c0d4f539ef147d58a1e3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agj7X:A3mnXoZjzyaEFyKUluzyAZJy+agj7X
- TLSH T1A115AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 923KB
- SHA256 30bf8267fe0fff8a6a8b5c26b362c77fa32829344a6468db47210626cda2dfc5
- MD5 12f598a437ca534f2342cde415b259ca
- SHA1 52b34fcec59f5830ef8e0bf2314d005b4b2a28b3
- SHA512 5e94cf2b948d275c24e4819aa42f968f0212cec9609b6105aa5f00ec997bc0290c955067b9b5578255da0de51d21f14d515a961e4d8289108362e6b0c4f5487c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjpL:A3mnXoZjzyaEFyKUluzyAZJy+agjpL
- TLSH T1D315AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 923KB
- SHA256 e85bafbd1682cfd7f68135cc6203eea4cc41e0c477e570f210418bb8a901bf88
- MD5 f750caebc2b418260eb4e3fe78a3675c
- SHA1 80b6d8f0dd109dada9559edf581571e57939e002
- SHA512 35a9bbaccef8acc94d089cd4e825e7c0f8a149e7870d1e879078b6177b280d6c06956fb932b41e3e03b04d6acfa417596d2bf25d9a183f5b9b675c7453282963
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjXFC:A3mnXoZjzyaEFyKUluzyAZJy+agjXM
- TLSH T19215AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 923KB
- SHA256 03f20a8d636275c4d8a66f3cf85a4b58e90dd12cc94900db48732619a6a0544b
- MD5 6ff775168681cc1f9f9fb29949922314
- SHA1 2fd315caba3183de90d5fff01be982248a5a7ae9
- SHA512 847a48247e3ac3933339912063569aff6a576b55ca99148f993140d234909b34ad8b88999a40927575ab0e1d28a322e7cd12ae5364edf975dd1cca5d7cfe013f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+agjgh:A3mnXoZjzyaEFyKUluzyAZJy+agjgh
- TLSH T19015AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH