Analysis
- max time kernel
99s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 22:24
Behavioral task
behavioral1
Sample
2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 876KB
- Sample260714-2blhgsey3m
- SHA256 5e3dc858e3067dfe64a936a25e31af50262ee692f40679632c55465d9f4f97eb
- MD5 4678bb5457c772a5cdaef94c95f13220
- SHA1 adeabda6dd2a46c0c8d698a0d6fb05e9379ab85d
- SHA512 44825ea4b81160f7ceff2876a2d03c4ff8802f244dfcec9da8e1e8575b4e7e55868832f758bac9c4df8aba90e9f0dca3196ca518e17a93b406cfdf5ea10bfc0f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkf:A3mnXoZjzyaEFyKUluzyAZJqFBkf
- TLSH T1BA15AF03E7A410F9E52A823499E54612FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/6124-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c468-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6124-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5524-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-420.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-512.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1152.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1402.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c468-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-60.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-226.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-263.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-420.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-493.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-512.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-603.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-720.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-953.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1009.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1053.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1084.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1133.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1152.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1177.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1184.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1221.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1324.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1343.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1368.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1376.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1384.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1397.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1400.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1401.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1402.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5524 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6124 2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5524 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_4678bb5457c772a5cdaef94c95f13220_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6124
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 876KB
- SHA256 5e3dc858e3067dfe64a936a25e31af50262ee692f40679632c55465d9f4f97eb
- MD5 4678bb5457c772a5cdaef94c95f13220
- SHA1 adeabda6dd2a46c0c8d698a0d6fb05e9379ab85d
- SHA512 44825ea4b81160f7ceff2876a2d03c4ff8802f244dfcec9da8e1e8575b4e7e55868832f758bac9c4df8aba90e9f0dca3196ca518e17a93b406cfdf5ea10bfc0f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkf:A3mnXoZjzyaEFyKUluzyAZJqFBkf
- TLSH T1BA15AF03E7A410F9E52A823499E54612FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 ec54a2f3b4b4dbbb3efc56a9f58faa5fb29c82ffbe091020bc735db7122076b4
- MD5 070e7bfec7562299e698ab8ed17a30a8
- SHA1 956d662e10d98f40a7339ad7a08365f04bafa17e
- SHA512 7dd45887e05b763c558f051ec35ec7fd2298dd3b19e07f9402ef1d82e24298efc66fba0c1cc6b2553faf6c3e939daa54701c7486e4ed43ebd53cc691a09d177f
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZJqFBkL0Le5ji0hmxNrM:A3kMjKJpPji0Aj
- TLSH T19C657B17F6A402B5E077C178C9E2965AEB7138521B308ACF1399C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 891KB
- SHA256 05c6e0bc1652b66244a1434800fc2420446d1c290abd46e7b702a81c320fd931
- MD5 b8b3df53cb0bd4853c3b99ffc0f265d8
- SHA1 5f07a9a519f7b75d6e34a90ed971d0f8c3eee574
- SHA512 6b9e89c1e1b616794fb5e928e42216bf46f823ec3a4f387737f42c7f86c22f9f7cdde3acbd8e8e140eab9286121742963d46097e81e970570bd223f5b3d56dfb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkNa:A3mnXoZjzyaEFyKUluzyAZJqFBkNa
- TLSH T10715AF03E7A410F5E56A823499E54A12FB75BD621B70C7DF236882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 924KB
- SHA256 9e404e7070fda11af41b1d534b91baa238d9e8d2fcc9b06c001d9cf403d428aa
- MD5 f857645ebe9aeb138d6b3ab163931be3
- SHA1 0c0b5f963fdc88a68b6e1f08736d09343f51a511
- SHA512 0afe68859eb27fbcc291fbf2848f499d7a34a604ed89a2a46c23bda7736002fefda293be58d3172b04c423317a43dbd545111e63e7ebea999a027b58182559dd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkub:A3mnXoZjzyaEFyKUluzyAZJqFBkub
- TLSH T18115AF03E7A410F5E56B823499E54612FB75BD622B70C6DF235882262F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 900KB
- SHA256 988661b948c3cadcb36c55d8f7e1b7e54d7d6b3cc2e810fe426855f3f889070f
- MD5 743f411cd8db4cbd1c6020e47d63b968
- SHA1 d8885d477d175afb959517b9564e8e02f442f72d
- SHA512 e3c3d1bd3d2e602ae115c78e4b99a3d1d4572264a66c221674a79d654af53260afbab4e8c24ad394ce006047deafb77576ee107590389ee154220045e67bab20
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkE6:A3mnXoZjzyaEFyKUluzyAZJqFBkE6
- TLSH T15B15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 900KB
- SHA256 02dbdec967fdca8ac96f018101200d5bde2e24be0a8d0ac78087dbeb88584909
- MD5 2ea428d23d8664f862f0e64f994ebae4
- SHA1 3008ab2d3f7a71ff45d11f4d9c8b0a1a270328d7
- SHA512 a4681246f0eeca687bc3040a146fd8f08626146a6670766c46bbbfca435a4cb9906510e276bf59bd47ef1bc71be0a4371c5cbcc2c02eada429ff61839b67c393
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkgN:A3mnXoZjzyaEFyKUluzyAZJqFBkgN
- TLSH T13915AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 900KB
- SHA256 2529abef97c7fce92f5fbee3fa626740f195c66607ff34dbff07c0c0908b7480
- MD5 18c591e3c46858a2e0342ba97edf7ee6
- SHA1 b8a1f0cd8027a7e9d73a99566903a4bf99899ef1
- SHA512 67e1fd528edc8c94805fdcd990f33454bab8edd02d50a1456ea70864affe37a0e51764dcc62ba45e357d0f9aff4b6231390c1accaf0d5e88688a8a91d524e7e4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkOf:A3mnXoZjzyaEFyKUluzyAZJqFBkOf
- TLSH T17715AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 900KB
- SHA256 ab7e1eda8a5d6dc553bc7d0ba82c6d8174dd14a300d570d8b94b8a34ce78e373
- MD5 30ef7c96d0e49a4134570f8c8238ddbb
- SHA1 3682813c3e8a58cdabb79c7a0ec9e1848a9a56a2
- SHA512 1ecc1b1cdf6d30de6205c04245b435114646edf4af044b713b832cccce9766820c704f0038e0b54d6ea9774374002cb2ab6da555fc72273d887732ed397ebf8c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBk4o:A3mnXoZjzyaEFyKUluzyAZJqFBk4o
- TLSH T1FC15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 900KB
- SHA256 a0fb70d8023f0968305dbf29c03a1f245816d5d8864c5fb24a332fc9d407996e
- MD5 fc0d38da76a347dcc7839b4b7429bc47
- SHA1 50a3b8927be3d5b146b84cbd927c759a0a088391
- SHA512 23d79ac37123851d83470996b897ac15fd24e02d5df0f7d561a61ab6cf59b1ce34b54192a554f93855af930b6c16fc27a09453971b5b0f6c5143424f7a205e14
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkIu:A3mnXoZjzyaEFyKUluzyAZJqFBkIu
- TLSH T1A815AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 900KB
- SHA256 c032f9111793524a58c12a0a74d9edfe42905f5c2292253771c099cb065cafd5
- MD5 bac2f5230b8ae373154b3521f78ac34d
- SHA1 982ee91af28a814847a4cd9fe96172927d1b9e42
- SHA512 ee28045db66815525b4712c4176dc66e3a349d98790865abf4099899cc213a5cd6508746ce06568dcb61d784c549c5ef070207bf43eb77500e875d4a384c0950
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkc9:A3mnXoZjzyaEFyKUluzyAZJqFBkc9
- TLSH T19015AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 900KB
- SHA256 05410d67f8e05c0c61506c1db69254b0216f19b561eed87936fc207743c6b8cb
- MD5 63f9b406db1b953a5eba8681f2958fd2
- SHA1 9d579834bf19f7f9e783087c6e32fd6b342e9fee
- SHA512 9f0af1f9b53fe5ba4ca9def992d887c7f18e7a35338d12350729d903360fd805f40afe2f6856d45b6d2a0637475de58a9dd626b4fb0c6cc5e39f22fe3ffdfe6a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkEc:A3mnXoZjzyaEFyKUluzyAZJqFBkEc
- TLSH T11F15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 900KB
- SHA256 611167a10a6ccf91fb97669d903a73a4fa76ef101ebfb9c0ee68b03bd548c007
- MD5 7ffd9d30da211a0713c7040f63876389
- SHA1 79a1b4c0f332724212796a98ae36e38a3ca255c8
- SHA512 c6bce22bd5dbb3a480317382dc2a85964a8333d8b496a5e9cffc457688ccfd27ea405e8f8803e0d04a8b84ed21992c862b32ec649f14df64305e6d9c2b9c94ab
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkdp:A3mnXoZjzyaEFyKUluzyAZJqFBkdp
- TLSH T1AA15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 900KB
- SHA256 268eebb4111875fb983e932ac1ec0a390ce1ece90815f118f14ec65cfb333543
- MD5 fec9365d4a56d65c63bfce8408dabaf4
- SHA1 3b7d378c48910156dfcef6f79544a0d749b42e51
- SHA512 6132b8d71ec5e8285bcb60c862fc8671d5b5c5f41e2d042faad96d8766b5737217160526aa98abec47cb74dfe20551c1a9566fa3bf222641768ffce8efc8e21b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBki0a:A3mnXoZjzyaEFyKUluzyAZJqFBkiN
- TLSH T13815AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 900KB
- SHA256 b676ecf4db0bb7857e71dd72039f47a8bc6e729535d420e78bb4ed7e429d0105
- MD5 183f9463d9d009fa5415e578ff8e7249
- SHA1 77062edd16efddd080fdcd563566538df408f6db
- SHA512 17d65165500cf30dcde9b001b2c69be7e2d474c8c7228d004e1a9ecc3da92599c5617d1b3d62a5abcc13fd570c82987cb3cc2af6e6a07f86e887c6da56115a3d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkGF:A3mnXoZjzyaEFyKUluzyAZJqFBkGF
- TLSH T19015AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 900KB
- SHA256 49ed6e8f2e3634f3c0151e236fc2beb71efbea39b3913b19e0b10691a988d804
- MD5 a91bb9293b8964d8b6a6ae06480ba9be
- SHA1 2d1844aee8e8e2e02b8aca15ac47d020351558f3
- SHA512 6d8b05de85685d735423079e49e79b1f4278ad4483c0bf8d05986ec2526c66dc85b68e55a33bfcc821c941420560c10a5a1af9b8fdbc9a1fb55ee52a85efa258
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkTC:A3mnXoZjzyaEFyKUluzyAZJqFBkTC
- TLSH T1F515AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 900KB
- SHA256 2cb442fc056c7454936ff0442fab76092b926696e241f05242d7b480de30cd5d
- MD5 0984bed53a792381be4efc46754eaff0
- SHA1 cf6fde2ff8ba93202e4cdc45d31d5608a5c79125
- SHA512 280fc9cbf02c3c0b1afb6d36cf30aa97b4c05f144361cf1de6cee5ae8c32c69a84455d553417d7d02e38f1418bafa294a87e5444aca762589e12d0a03c105f35
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkcw:A3mnXoZjzyaEFyKUluzyAZJqFBkcw
- TLSH T12A15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 900KB
- SHA256 5b205377465cb4bc9cffa8baa1d9191d3e340c7c27be2eb87ad1c951d3aa69c5
- MD5 56eb81f47e142a258301af388453d043
- SHA1 3bab9ac7e1c9267b2ef4b407a4f2101ee17d296b
- SHA512 37ac1f3e861a5538235c3841f673cc1253ac146c02cb80649b11c15820cfaf46cbe4533f34c5ce3f49c3ee3c2b041b1af3ac485e8406edd257f5340484aae040
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkTT:A3mnXoZjzyaEFyKUluzyAZJqFBkTT
- TLSH T1D215AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 900KB
- SHA256 82e25993658f79c64093720d09a80ecbfee1141ce4597ea7a2eb0b7a811eb339
- MD5 8cde1d1be0fd5be5fd080ea50e03cb2d
- SHA1 45627cc410c024cdb0ca7497ae94d92b045394bc
- SHA512 e45c5f2ee0c324cc576cec619976e7ace239e61edd030d6498f975e9681430be5c078a906cca4bee0b2e400e3643e700cd10ae01ce2f87916f8de0dbd59cba5a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBklu:A3mnXoZjzyaEFyKUluzyAZJqFBklu
- TLSH T14115AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 900KB
- SHA256 d15cc95b85ef1f163ee7c685d560473527c24eb0c88b0acbaef65793aad42dd1
- MD5 601adc1e8f7d3acd7045f96ee592f9ba
- SHA1 2b344e9187d0000dc568a20b24b297a5c67c682e
- SHA512 cd184d6cc9f3a0bec4d67f7b967eb87da2ce631350e8f67db4ceac8115bcbb3b8b0d579a9050d3f2188d4f1176b3315f738bc7144914c58b5f09c89f03e8c648
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBktb:A3mnXoZjzyaEFyKUluzyAZJqFBktb
- TLSH T17C15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 900KB
- SHA256 4dc1f68fac6389284f64d42d49e354a56b124a69842f9f5eca67dcd521d10103
- MD5 ec9c96ee9eda97098ab4856cfcd9445d
- SHA1 c45f325f0d5f3c18dafba182df5f41d6e10e0b0c
- SHA512 1b4618eda6a87c0cbe9c4b9c47c8dbeaf523d299068d7f292b75571bc96975a6cdb57874b88b7770c3f66a8567168f6c6db3d9d86e4976c761f93ed9709f8a29
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkdf:A3mnXoZjzyaEFyKUluzyAZJqFBkdf
- TLSH T19A15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 900KB
- SHA256 a9fd41a541b9ce340d0ec2dd2f171c937c65ca3b2eb0f203fc315c7d00de8a67
- MD5 afe0fee9a05ecacd37244a2de77d48a9
- SHA1 2e5c2b39d8cf659d26a9e4d8834d2e31ed91e441
- SHA512 80bda48aea8a97d65be230dcb25973ff3c6f84f49210b931bc7803174b97c65ee7ed7bc05e986e3de1111d1efd96cb86331f9824c11f85e25134bebe54d0a29f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkGK:A3mnXoZjzyaEFyKUluzyAZJqFBkGK
- TLSH T1DD15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 900KB
- SHA256 493c2c1b1c616ea9725f97eaea46c74a976c1dfd9378d4d0865ce623c1cb4740
- MD5 78e37b9b4fd2e7f3202b780ce2ac39b4
- SHA1 9a8f471dc6e92bc51dcffb5facfc0232cbb737a2
- SHA512 d4d1d178b0d28a7480617f867a760a6ca2cf9b09429a79711d7b09ee7c4bcc3cac3d2e691cdf06911e92575e1a9e610825960d6e270581a7e7a2dca8bd53778e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkzk:A3mnXoZjzyaEFyKUluzyAZJqFBkzk
- TLSH T1FB15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 900KB
- SHA256 31b1af4fb9184bf5236ba793aea723803bd8f290cdbfd0667575515dd1bfc90a
- MD5 9e316340bbd549c947aea8d7d4e4676f
- SHA1 eb8631e4940d7f2a417aadd0f6dbf0841d9d8748
- SHA512 d52c668d1af910c670b14c83b846a597945ea89bdfd3389521ccaec0a6856a0bfc035085c44b2a52134ef04adb2a0a2da62dc2cd56803ba707d0d66985641d2e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkE0:A3mnXoZjzyaEFyKUluzyAZJqFBkE0
- TLSH T1D715AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 900KB
- SHA256 217ca90d7426cb1274058ca1b30f33742f07f25f74c6aeb24f2786bfa77327de
- MD5 af439ba83a9e7c8cce4fa2503d452d41
- SHA1 575822e0532e579a1b26d360f41b17536c593ea3
- SHA512 d7971a209339e0673e980014052e879902dc527bbc52b837fa7c7a597c9599f9de7b4f2990fd0dd666379272526f488ca38b07f7b7197b0b6c7b8b0b7d3fa648
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBk/70:A3mnXoZjzyaEFyKUluzyAZJqFBk/g
- TLSH T10315AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 900KB
- SHA256 66de5e14c4615e9d8b5dcf1244008ad485cf1fe2bae82586432667b82788de3a
- MD5 717640c1c657122e800667055a3d222f
- SHA1 9ec4236c525f0856ac01366cee7cc046e7aed981
- SHA512 0f094aecef1393b1c12c311465b93e445f28fac4fbb08449e0cae31f319fb0106e238ebd3995efab0fda7987ae0f056c538dfdbd106e597c1f3191256f691816
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkSr:A3mnXoZjzyaEFyKUluzyAZJqFBkSr
- TLSH T10915AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 900KB
- SHA256 801fff6361d4736097cb485191986f46b2ec366b049298b5ceb4f6ba53399ece
- MD5 708ffb458dc3c6cf252e9d46867455d1
- SHA1 e2bcd90513bf235e6a1e63efbbd52c3620ab6c60
- SHA512 96b4faa68333e3dcc029422ab4b3c935ecf7cf9f6e48f37e42f85d43d5d36fe9711263f89f7510e877c5cdbe55f7127205652096a54e9f682d18f36623f3858b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkwn:A3mnXoZjzyaEFyKUluzyAZJqFBkwn
- TLSH T17415AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 900KB
- SHA256 5182f15bceae8bb975ce4cd3bc8fa934fc699274004f0b49e1c9333474e039c2
- MD5 1875ca949a2bd894fe75bcc1ca205fb3
- SHA1 5785552ae0b5bdbfaaef2e7b5c3bf0865a380663
- SHA512 d05a62012e18282ebd084294d8f4cb3d1b76a40bbdb1d610d154a0bc1cacbda651b1d813771cfb84052f7299a6bc78ce08b94209bc2ca6b9c34a6db9051e0b33
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkOx:A3mnXoZjzyaEFyKUluzyAZJqFBkOx
- TLSH T1C015AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 900KB
- SHA256 d1d51e616a8bb0225ea3fa74dd486d42930b39000956014c3b7880505cdfce94
- MD5 067d85ec38ea3ebf901e48db9f720c0c
- SHA1 60e1872afb62118326020d82cf5b5aff5ced26e5
- SHA512 dc203933a2eed55eb5648ab9e19733c4d579dfb9dbd70fb7f7123f68fd7a7cb78906d0aa8e0933689a965281410a5724709f8cecc558f2ac364458a2466118a6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkoA:A3mnXoZjzyaEFyKUluzyAZJqFBkoA
- TLSH T16415AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 900KB
- SHA256 1e2a6ccd130c71939887ab1291ade5c46e8cb6847807aef9a899f2c191722666
- MD5 0b68a08563ec933eccb992e5c0019fb6
- SHA1 18f640ccc0fa0daa9c9037382cf4740a5f4311b9
- SHA512 6c75d8d0df9df110cb7ff384178c16c4a3b13098c46cf2fc68bad6eb6b5e223665ccd62b20fdea4263cf50a653803b2c6f2e0ea74dc888278ab01bed2999c908
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkB9Q:A3mnXoZjzyaEFyKUluzyAZJqFBkB9Q
- TLSH T10315AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 900KB
- SHA256 9dcccfe7b17e1faf0a15d533dda697a82351892a4458cda11c707680fc8257a3
- MD5 c0919a1c5fd423d35e1226642275415b
- SHA1 3404d6986da92689b62f71b2ad7005a9278b4a16
- SHA512 6be1efaaa2115298f2c414579cca8dfdedb18931ee809464f4eabb3dcbb0c21eea912ed4e46f67480e78d5d9212126c1bd2e09f341ec16862e680cbc33a1d759
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBk04:A3mnXoZjzyaEFyKUluzyAZJqFBk04
- TLSH T13515AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 900KB
- SHA256 7e90720d70d2ac89b1bba7f707cd407aa9aa3c90b0ab234f0b5daabb0e4d81cf
- MD5 f965672834ecf89001fdf8a0b127db8f
- SHA1 0853a7becd32f63ae9a88cdac8592d2cfe36a303
- SHA512 cc9989f37efee488475545cecb88425aa7660b0e2b38f9c8f457504b38b272351f684365a78036feba9cfa823e62bb4aaefdd160311204c10900f3f255199292
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkfu:A3mnXoZjzyaEFyKUluzyAZJqFBkfu
- TLSH T15215AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 900KB
- SHA256 aafad936d58f0c72150fd9e9e7657d81d377f5c4483bccdcd96592b1c1ad38ce
- MD5 c4d2e9a1dadf0905ecdbb0db5a9e1c9a
- SHA1 d81e010294a39bcafe1d322ec3e80f394adb0f4a
- SHA512 d826085e8df6cef73024f673fbe05428d8122360397c49d9809ba927def5b758b6945b40c4d41e4d8b74839e1986a043ce17e5bf8336a1078b03177931a19bcb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBk6j:A3mnXoZjzyaEFyKUluzyAZJqFBk6j
- TLSH T11915AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 900KB
- SHA256 05c984f20623fd803df3b5830a164c0f3a4274eb23ff2556cb2ecd2d0cfc3a1b
- MD5 b8908d7289d47100d476dcda575ee38c
- SHA1 99c663ecb9ca118205f7a21075b05f950ce2ddaa
- SHA512 95a54b503d83a87dbcfe9cb8c84566c9aa24dd3250dd0773380ac1d42be4b767f787bdaae332dbd2296b09d55260a1858c9604a4765dda03e697f0ec1c3b12ef
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkng:A3mnXoZjzyaEFyKUluzyAZJqFBkng
- TLSH T1EC15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 900KB
- SHA256 6d3dc897e23a637d5cea711ffe73029f3654f9daf2d35e765c278091a73c6dfb
- MD5 2fe00a9e7e238eeb56c81eccafc0d27a
- SHA1 03d00a5eb12872001f37199f3c9de6ec4bc7f480
- SHA512 23b40d4a2b47de9e7678d63b96f13109debab87a81e9d5935f47cdf68f98759e485a28f2bff409aea71a72f781bfdcb6da4a2413fa73991a0d14845fd4b73942
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBk6I:A3mnXoZjzyaEFyKUluzyAZJqFBk6I
- TLSH T16115AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 900KB
- SHA256 752ead2623ac24df5ca726f5ff80662aed80cc635e4db36a0603aee1c397dc89
- MD5 9f848e22f2ecd1658794e920a1fb1cf9
- SHA1 954e08403087fecd87ea260e54bd74b7288ab506
- SHA512 337932184c3845069ea2a1d420b76231a06d5c9ade104c279a5185b66cb13125b7581dc16597b2f64f39562ba142c92d5e9d29882407797134cd6d6ff2165d0c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBk4o:A3mnXoZjzyaEFyKUluzyAZJqFBk4o
- TLSH T18315AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 900KB
- SHA256 2ffec9b13c643056acc88f23099c927a05cc712da9c104e0baed8a6249752f5e
- MD5 f29767886972fe1d869c6c31e58154b1
- SHA1 87c6d6b876b8a2d94d05f2ad05e6d56568648831
- SHA512 3574294a359ded851d109ea0ae78a4bc4440439b89818c330dc892eb7a6996379ba38668412f500b7ddf5d5e9ba0fd4c6e6edd9024c7316a94cfa8d629dfc8d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkL+:A3mnXoZjzyaEFyKUluzyAZJqFBkL+
- TLSH T1B815AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 900KB
- SHA256 eafb2e59f9ae938f5cc5e19b3abbcf013eaec3c5bf5091cb749feac1c2183d32
- MD5 d257f5f89025f4a140ef3c021f3803d1
- SHA1 c4b45b2ff13455a03a318581bb065f7a49b184df
- SHA512 3f9aefef1e71537a8ba481329d2cd66160cffd873a819c3f92e0302a167b31cc167b2ff203e6404792ca2033bfce4ca292ff0a568c087ba2038fc9d1ac23a352
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkBQ:A3mnXoZjzyaEFyKUluzyAZJqFBkBQ
- TLSH T17E15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 900KB
- SHA256 6afab4796b541adfd5806127928525284996c3a2731252625bc399fac31767c6
- MD5 cb417354e5dcc7debdb073d298646b1f
- SHA1 d2295dcb4bc890e91a85f8e44419d286d775e063
- SHA512 f2fc31692d0342b06e296b78441cac6147808d8d4a88cecce8482b225e98f9eb6d9226c9e5ec3d84d1b3c946e698bbb68f895f58006fd89b70737788dc420550
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkGX:A3mnXoZjzyaEFyKUluzyAZJqFBkGX
- TLSH T1D815AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 900KB
- SHA256 0bd28b9eeae5866d2c25024b1f884ec513fc71269422baccfb8f17f5bc46c9c3
- MD5 72d780c42762f7dbf5e9823f9d4ede4c
- SHA1 44072d1c07928cccb17e914381ed40b44d210644
- SHA512 31caf2e5c8b1116d8403eb9a6c44ae09899d81062ac79ede3c70d340bcfd00a0b2b47633be850274f5b5730893ab1fb048f98e8fbe473c3ad961a01e6fc915f2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBkAL:A3mnXoZjzyaEFyKUluzyAZJqFBkAL
- TLSH T18E15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 900KB
- SHA256 7f9b227ca8644593fb0c0f32f0b8149fc94a533e12fe2bdb7493ee17dec88e3f
- MD5 26f55f3aea8fbe67816ef4bf6ea887f8
- SHA1 85c0e138f9633d84645ab6358be611e5c10a0fd9
- SHA512 db77b8e67737f8f2188cfee6e2f03d96ae59fc0bf7edb918204ecfb3c30aa56c969b21d1bb189bea0135a545c5b4b4a693654581cdc98dfa132fe19995357968
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBksFC:A3mnXoZjzyaEFyKUluzyAZJqFBksM
- TLSH T1A015AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 900KB
- SHA256 3586fba89fd47d1592c965f9293bdb7fbdbf6bb42ea2c4a4e6c47776456ea566
- MD5 dcf431422ad82149913c03fcdd3d2d5d
- SHA1 d733f07d059f442ef3c8f1470d4f1ad390c95151
- SHA512 21cbee445f8e511aae58ca6fc4c46ab0b23a33687099549a4b4cf359c7d326e4bb47504a949748343aa3fe0a01c0edb0cb2a80e2107f07dff9f68adf0253b7bb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJqFBk1h:A3mnXoZjzyaEFyKUluzyAZJqFBk1h
- TLSH T1D515AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH