Analysis
- max time kernel
117s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 07:14
Behavioral task
behavioral1
Sample
2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 912KB
- Sample260714-h2xtnaa121
- SHA256 45ad714dc73923db5c3bfc0b0489d2d8efe363216bdf444c347f041a30b5cd85
- MD5 1a5700d48f4d011d78c8a4fa19e79c10
- SHA1 7e8c94cc24b7c638b0acacb7ebb4a67f4bf97173
- SHA512 2abae34e84c8afdd8009f3172a33a7be1c2a0533a853a3853ab6104172095d483cdabc6fb0d795b051e929c385970572dbe8af80044ff6111b9fefaa31f34efa
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpT:A3kMm56ri
- TLSH T1C9157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 47 IoCs
resource yara_rule behavioral2/memory/1472-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4cc-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1472-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2452-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2c1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c86-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019845-221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-441.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a55-477.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-589.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-646.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-831.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-862.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-973.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1059.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1104.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1161.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1285.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018923-1523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00110000000064b5-2061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c0000000173dd-2059.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4cc-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x000400000001b2c1-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c86-60.dat aspack_v212_v242 behavioral2/files/0x0004000000019845-221.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-264.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-367.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-441.dat aspack_v212_v242 behavioral2/files/0x0013000000018a55-477.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-490.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-503.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-589.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-646.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-750.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-831.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-862.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-942.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-973.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1016.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1059.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1084.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1104.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1142.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1161.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1193.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1194.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1285.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1334.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1353.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1378.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1386.dat aspack_v212_v242 behavioral2/files/0x0008000000018923-1523.dat aspack_v212_v242 behavioral2/files/0x00110000000064b5-2061.dat aspack_v212_v242 behavioral2/files/0x000c0000000173dd-2059.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2452 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1472 2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2452 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_1a5700d48f4d011d78c8a4fa19e79c10_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1472
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 912KB
- SHA256 45ad714dc73923db5c3bfc0b0489d2d8efe363216bdf444c347f041a30b5cd85
- MD5 1a5700d48f4d011d78c8a4fa19e79c10
- SHA1 7e8c94cc24b7c638b0acacb7ebb4a67f4bf97173
- SHA512 2abae34e84c8afdd8009f3172a33a7be1c2a0533a853a3853ab6104172095d483cdabc6fb0d795b051e929c385970572dbe8af80044ff6111b9fefaa31f34efa
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpT:A3kMm56ri
- TLSH T1C9157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 964KB
- SHA256 487c7dcb5144a0a533f75a23d4730a3090f38538d722086d3b68c431319ab9f5
- MD5 ef428f5291439f69029e0e95ea38c4fe
- SHA1 fbb3e4809053228031a0e8b26150c32a1ed85a79
- SHA512 ef39ee142cc69c2c7cbdfed811a85db10f10342420df4eb7f087c33c4c4e9f716aded06edc028bd7ac421ac529ac08256d25f75b7c8a7119e9b9a234b8c97e28
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp6fj:A3kMm56rlj
- TLSH T1A9258C03A6940FE5D11F813099954666EB777C125F6087DF2368AE253F327C06E3A3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 2e5b9989ef2f2d688f47a6841753714181d6e8b63da86e677e82262fc82b2745
- MD5 bb1985844368f552e63157c8fa8a2259
- SHA1 9d6a3ecc848883f8218e1fd2fb1702b75a13397b
- SHA512 c2d2ad9653ad00836bdab9fa21f847dbe1c1205dc4317f4f40c77c846250c4e7cb26a50496390c71fc7da7a55a170ab106aabe998077ca94bbd02c3cc6d417fe
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpP0Le5ji0hmxNrM:A3kMm56riPji0Aj
- TLSH T15A655A16F6A44BA5D02BC174C9D2969AEA733C425F3087CB13549E283F237D19A3A773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 926KB
- SHA256 07348b6a1b199bec36d2c586f5bf614873b1c4fb232cebb48040dfed81e4c9ad
- MD5 24ef2014e52ee2b0788966e3cae686b4
- SHA1 6fe77daf382e8cc957327fb7fedd8c812cbffda0
- SHA512 8231163402f16354f2312e8246f88c56b34cd3a72870072f01033b20783663131ba3261fe105c740b232aece6664d4dc5486b1a390b1b13613e5dbc8bf625b50
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpRa:A3kMm56r
- TLSH T173157C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 960KB
- SHA256 9fff2f4f16c2931066c644a7521572bc7a0dedefb225548e96209c983f042ef8
- MD5 f85585aecdc9806aa4fb1b854ad42842
- SHA1 d927cc5d74eda44e98ee64024b6de94a82097eb8
- SHA512 f62badc897759736b5ef3aa6c948847b0295b30b677d5004518628d3031b12f363a88419b4e96b80e01f90730f8a545fc217c90b8aa92e4b3ecfeb2a874692d2
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpyb:A3kMm56rHb
- TLSH T193258C03A6940FA5D11F813499A14662EB777C525F6087CF2358AE253F327C0AF3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 935KB
- SHA256 684ead4b7958d698bc71691ddb5773e0b23ef391e8b01dfe1de5a5bc88eba9e6
- MD5 67f7507492c8317efae48ccaf3190906
- SHA1 f8e1be6896101c6882ab4561a8857ec40fe17a51
- SHA512 79c2a80f6cd064c2302e6a4e75b72b79a4d1a162704c2e2722943318fb48028dc7eead9f84a1866fe245ec78f0a7421c14091dcae1bc60b0d8c6a341adfcd819
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpo6:A3kMm56rM
- TLSH T129157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 935KB
- SHA256 43918610d95b7f6df32f19a655eabe2858dffc5e20bc35048b37e9d8d8392807
- MD5 46ca6b2f1c24868affb7c51a646484a2
- SHA1 63a1b35bd42a0c3e5a2028aa00a4efbc0188845d
- SHA512 33de117953d3a6a722dc31c72395b4cd3c75574c834056ec1f166317423bda5375d52ecdca293f446019728d1f2784535397750e557ab918dc07500b727d9db2
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpsN:A3kMm56rx
- TLSH T181157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 935KB
- SHA256 cf5d188e7c97952a655b3affdbf6e93c5c7a859db4889415f98e74d77599e51b
- MD5 a70172ea4fdd40ca2908d13d6e3988c0
- SHA1 36dd64251834ba03209c0722f0210269a0a98d3e
- SHA512 038b9af651af4e31c271c273e899b2fef218edfe0b05b74e01e1964fd83ed1f6cfffa75c2b78fc28df3cd8ffe409c1e7568062988067a45e32ba6ae9dac9230d
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpif:A3kMm56rx
- TLSH T15B157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 935KB
- SHA256 6d61f722902b1dc4551a0e0d24e8c8b13d1136aaa9dd04b23dfdc815b7259e27
- MD5 a547169a7865737621c1e395bb663cae
- SHA1 5cadc153f9f9fc4d5007d409284d2acfebe7294b
- SHA512 62deb084ab567f95ded32513019cc128d2b43c7810151ccaa6a7197a5ee0a2e352b0ea2b986a934dd37ca477b98c3f21bbe0eb54708d7fc390b4459affef92dd
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp8o:A3kMm56rE
- TLSH T11E157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 935KB
- SHA256 9dca456b76236745eff6ed26c2d88efe1979779be5317dcfd43257dbf35cebb3
- MD5 bb8a7522fc457887aaab63f8d48b6d92
- SHA1 635738370ebaf7b1c2c2ff1a1ec657c2899a9f85
- SHA512 962cbede520e3c5092b3aa1eb617e4f0df6996879a41a7334ff974037ec0915c6e55858f81660143c21bbd3f7da5bb7f9fa36fe347df7b859394317f5de6a447
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpcu:A3kMm56r2
- TLSH T17E157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 935KB
- SHA256 743749981a8a34b2b94d83166fda315a25f692f0aeedc2544407bfb7127e759a
- MD5 9f089b2fd2ac900285af591ec822a350
- SHA1 8b0df9b53debc9e8f5f18f5e3b55eb4ad7835cd3
- SHA512 e2dd5a3c621eed700668b9a98cc91118a81e5f72392d74db085be4e674c644cc3c5e8255e3b9beb2643b6f1f22cef88e733867fe6f0158b6ddd48070c84b9e89
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpg9:A3kMm56rX
- TLSH T1BA157B03A6940FE5D11F817099964662EB737C125F6087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 935KB
- SHA256 2d2b9ac7031b76d80475bf12bb06d77735367baf23b4b2bbcfb4cec42b196ccf
- MD5 3d108e6326d98b5f93bce36b23548289
- SHA1 53e5545584c1c51e151ff17ca0777eae29e638f3
- SHA512 67984136709158a15b6a660493a72c773c983b0a79542d3372d661afceefde0ceff14232f22b81a36d951f769c04d002e686600eb48a0b202b520975a3bdc045
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpoc:A3kMm56rm
- TLSH T181157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 935KB
- SHA256 ef398536206af82627cd0eb56df48b6472e1eca1aae20a7642d149091674da89
- MD5 688a30b2e7c125c4407422a49c4e95a8
- SHA1 6b3b06b1368016d0f5db0325cf84740a39fab7a0
- SHA512 340b6b0b7e13e572c4441cfebbe39ed6e32f49410a5b13b2f7d5b92447e4ad9e7ec2537b48822430073ba79fb6c285dda1b0aab0748afafc2f6720a073a299a1
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpBp:A3kMm56r0
- TLSH T14A157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 935KB
- SHA256 0335349bdce2278eb878de241c989c6ef38143c727f717a59615034fd110cb5a
- MD5 b5b21fc0d6d02ad3e610df435a2bb3e3
- SHA1 50f9ce566b2dbfd4dd80e8be4da03e6924c78ce2
- SHA512 f2b0bf3f41fa7ed32c6304ab45fbf843c5442878090e084143c400bf04f4a90e051427c61bcf4d317704a60a05fcb5afec07e5b144c670aa1c5dff962db23d87
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpWN:A3kMm56rD
- TLSH T1B1157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 935KB
- SHA256 39345d2ea33af884bfbf6ad7965114b75306a418d4035be9c94daa00eb906752
- MD5 f9a937464f3806a768c458845e4ea351
- SHA1 b8a7268c6cce5dcadb5a22cad8508ea2a89ff5e4
- SHA512 ec0a83a007dfa7a1ee0b0d1a3c8fae719a7b9856cdd0abcc6cc191e0e00aad695dbee15f0e2c60df593b6990ce42fdd86fbcce75557f6b6f6b633e698d1d71c7
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpaF:A3kMm56rV
- TLSH T1F2157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 935KB
- SHA256 370f6ec4462156426e3b0eb162c4dca4f1592bcab7235d872aa561ccb3d458f0
- MD5 0b2002ce6043f7abf7ad127dfd7ce0ac
- SHA1 28693de1f423eba5e3a6aa861ac0bb90f7971955
- SHA512 0a6d064a5b93e54954599593ea95738d6bac9d11e0a165357ad8ec618fb83352b9946de40adf67a4306693c699b9abe9726e32f4c552ccfb90bb8f51b7ba2013
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpvC:A3kMm56r5
- TLSH T1D3157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 935KB
- SHA256 0f8eb8060e650c945e82a321fdee043479afc836f4c991fa59ac981b573b70df
- MD5 c579a35ce93b5290f79da81cba670ea4
- SHA1 2db035154a50493ce49f947a8c8539f297aaf77b
- SHA512 06f7a061cdb0c41cb5e0d05b2f249b1e4cf446d9f06115a58a6ed46bb93b4439a8c38b0941b96d0d07d94e3c8e00ad5497b42965be4f1ae2ca4e1f1107ae6a1d
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpQw:A3kMm56rk
- TLSH T17F157C03A6940FE5D11F817099964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 935KB
- SHA256 8065ff1a2ab7b379de007ab95d9922af141623f95b122ec3c379977c05692db3
- MD5 ea9d5094cf4ecd754ca914f69bb13d24
- SHA1 4bac1a84b8b984d592affcf9a08cecde1ec30a24
- SHA512 157500e5acbe0df36aaffc01eb1a1da1033ae6d48dd764ee05bc5e0d6861d3f34c0bdcaeb84f7e97e9af5ac4732848a2147f41f465e1d7258e0a0435fedab600
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpvT:A3kMm56rM
- TLSH T185157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 935KB
- SHA256 308e1eabd64774897098a65176fe87ca8636fb31f549f45e4956abe4da2b0034
- MD5 bdfb79aaa3db7dcaae9493e5259101a6
- SHA1 a1217bb6dda10d1c8dab3982b791adcad0c67c4d
- SHA512 d7e39c5914a4624b167485126d46426d63b297c4a9a0e30771d10eb26bb1f6010ae408032397acc7b8573bfe9300aa87812ee73b4fb35a0405eab4a0fc867039
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEppu:A3kMm56rr
- TLSH T1BC157B03A6940FE5D11F817099964662EB737C125F6087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 935KB
- SHA256 328b8f04678a414f82184dfdbe67047f88fed8d6d28350b8ef10049a8e05ead4
- MD5 9c4481d96de0638bd956ef0b266a8de4
- SHA1 8e3f1262e869ab02169612a2c6b7ca799bb0e927
- SHA512 ed5229bff47a6f28ef56ab67e51473f411a1f48c4abe5dce98bef36b49a226fed9277fee96ca151d7645b40beaba4f3f61033d6e6ea16d579e7ad600c344eec8
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEphb:A3kMm56rC
- TLSH T102157C03A6940FE5D11F817099964662EB737C125F6087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 935KB
- SHA256 11adcea0e3b2104f4544931186bd1b25c459d15de5bb354e73d8e658fd80f0f6
- MD5 cb060b63718e949cb29383f234f3d56a
- SHA1 144310d44617bcaec0de3d5c8f8bb605e02a3be4
- SHA512 810ea97c385ef55e57e48e910c63ae4d8e8d692f6540a7f0f315f38b25cd24c8b83b4599d1b14d7b4c3e9737ddbc5ba570b53d0db14cd1cc588c1e3301355fe4
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEppf:A3kMm56ri
- TLSH T16D157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 935KB
- SHA256 b00b5f20af53d386b49e895c8c582528805d7eb8f6ec8304714c99e4b6cfcdbf
- MD5 86530440a896d6cfa0131a0f70fd2f62
- SHA1 f61081bab9add6c53f415781de1947d3a3911aac
- SHA512 1c9b49fc51b6d76598f3e73224324991152c17b37eaf3de662519542750f2d547a05cebf61a25d244f931f9cbd9c5b695ae12cc87593554ef644d813118a973c
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpSK:A3kMm56rC
- TLSH T1F1157C03A6940FE5D11F817499954662EB737C125F6087CF2368AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 935KB
- SHA256 f17a24384bc7777a44b0eaaf1d93f2737ccd8a655240ad9613150c915aee5cd9
- MD5 ab2cb7c7d0b572753d2280e0ff294fb9
- SHA1 fac972e57359dcadf65cc2777171af4101865511
- SHA512 5fed6be399068a6ce9257cc04facc9fbbc1c63d4d8e08168304adf4197a0caa9c1df2313530026bcc2267f26d3160d0393f58e7d67eb589d3e0a611d07bf3c05
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp3k:A3kMm56rX
- TLSH T1AD157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 935KB
- SHA256 12e6b6e00f1c76f2581a5f94a59dd2481bb2e23aec3dc4c8f7001c75489ddaab
- MD5 c9ac56310c0b79d8cc7e2a226ba08521
- SHA1 a247b8fdef7973977504db2e609ca8a4b75e7063
- SHA512 0cdf09db972e99deb14e056ccd257b87f77f2002234ea2c577b25019c07180957ca0a56af0581b84a8e907dd8aea8fc9bc01dc982396d26eec272062226f0d51
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpA0:A3kMm56r2
- TLSH T16D157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 935KB
- SHA256 5ae830fa7df04e73be7e5909d2e5607026d1c2ffaf34ce909669139b8df3d43f
- MD5 a8fe82b080080fc7c4bce40fd4067fea
- SHA1 ef64bb7ae5ce24c786482880a49acfb740b9f430
- SHA512 83e318d97d97c163e94018335fa339211541faf016b66b5d66643aa8054347f8b47d202318dde5c7af74929f183885db1dc94c7730e7592984d6af56c45508dc
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpbg:A3kMm56rP
- TLSH T106157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 935KB
- SHA256 c9387df455677dce3138af7fd119007e3db2811ea9a1a419ff187ffaaff64bb3
- MD5 94bb48426bda20c9605035737ef7cb55
- SHA1 6236f1e848dc4884089fcda24fe4c8a8501fe4b7
- SHA512 f679d1e29b51f40cd215d2afd451213ae994e57cbc7c8be0bb7dcc5a8d3468fb3298c0585699b46686b0f5b52c5557513972853d8b33a0560425da93addbde96
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpWr:A3kMm56rp
- TLSH T1A8157C03A6940FE5D11F813499964662EB737C125F6087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 935KB
- SHA256 a3f57b34cb311578063d699596dfda78941754922b2ff2e97425c731412fd41a
- MD5 9498dc46f0ba5b27f9ae6556a19c878c
- SHA1 f629191bfd6c7ce668d4c49fb211fe70b066d347
- SHA512 272ca3b13d333746361987d201dccc4c568f6dfb8e0ba14c73f0cbdc98ddb5cc8805243d6ac86cdae5f50da14d54b08513b398cf1ca3aa7be16ea72d124c2e8b
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp8n:A3kMm56rD
- TLSH T15A157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 935KB
- SHA256 7db71796703084687aa22f1d2398d1b1370267ff0d639e0f048bce267b13ca63
- MD5 70caf95b3a8a7afb26560cd29ab6f58c
- SHA1 0d18384df9d432b7fc9b6437b7e553d04a3047c1
- SHA512 99044957d05c648b7b749bfeccdd47552312fb7d208ce6c6145b25ec6129027b3bf2de71f0ab0c5c2ad06368420a06f813f7ec90ac0e323ce6f70bac461a0817
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp6x:A3kMm56rh
- TLSH T1C2157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 935KB
- SHA256 e5bf8e6ad5e17dd7aca77aa9fb0d1c3a107c17db34d52b6e0985a738b1e8351d
- MD5 abf4619ca15281d35912cc5e46a87433
- SHA1 cdb2d8ded5b2785e74802add0a8713c4b100f84a
- SHA512 18627a89e2c46c1354fb83807a841d535e70f1e53e8c0ad0ba265d8e0b084337e86de1c68b0cac45a1db28c832accaa69e9ee3641be5f19bc350879523581a71
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp8A:A3kMm56rO
- TLSH T15F157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 935KB
- SHA256 1a6759b790f8efd131a1f9d33937cf60dc99aea858f4f888954d8d3c80c84b0f
- MD5 59c163bd5d91f8ba2c026dbdd5ba8400
- SHA1 86524dc367031b4e9d9aac9d92721da953026f3d
- SHA512 7da962e60b24431f84a651193a710edf3dc609d63464c8d6ddc78afa33542d6321cb29108ecd2cba056e17a353a68bfc25fce2e961b498bb9650a3f0f620be6c
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpl9Q:A3kMm56rT
- TLSH T1E9157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 935KB
- SHA256 6fec2e9b1988a1126bb031617049a32ca9e53f860e613389686b24379d67bb86
- MD5 06cef8d7e4f49075bacb305c00f6cc77
- SHA1 4543407992f8b4e26507570b3ad3d8663958c0a3
- SHA512 dbcc0ba90acffca26a0be82ee8d3d7074cd80263e4edf8f8d4870c9f0aad073c4e037d024a8d09a427f0e48e9c4490f29b98c62b61d6b70fd88e2592c5a7aa51
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpQ4:A3kMm56rU
- TLSH T189157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 935KB
- SHA256 3804994ece58c343e73d77dff98c4f693d75ffe16a287da43a32a3011a544f17
- MD5 3f58cba78e7eac22084233d676842eb1
- SHA1 60dc76391372aa7de9308387d5d96224fdcb4f5d
- SHA512 5c515c650a3f4efa8ba9a9adf140278f0201eaf24893723bb45069b60b0daa938704277e89f5c907fadcd722f9a3f4d3048ed12b1c00ba3bd5fcd02c55c77a34
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpTu:A3kMm56rF
- TLSH T1DE157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 935KB
- SHA256 655a22ff336b7762f64c4de1e3edf67aa3651eee90490978965924e98d2c1f4a
- MD5 f69fcb8a431b01946b2a04117e95a349
- SHA1 8b2581e99f60cd04902177cbd3771c445496764d
- SHA512 90d03beedfadeb9f1e9c2d5c6488a2ec84d3660840e3730cca96f51873d36303b4324551866f01e49cd84f8398bc27f6b962938a2ecc1b2acdbeb02f99386e3a
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpOj:A3kMm56rH
- TLSH T1A2157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 935KB
- SHA256 a294f1745a82d8ae4625fdaed099a766e39a7580d57e462a59667c917af5fbf5
- MD5 51c0063bb0f77ec8c5038d6261e1c658
- SHA1 f54086702bcca550dcca5a6f2e483b0a15780268
- SHA512 b8b062e8b6b6096e99936940f66503e06baccf3720f1a8957e95019aef246923cdc129ec24a6782e36ac5301578e5a21524cdb48eb2b1b9f56daeecb77f8a712
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp7g:A3kMm56rv
- TLSH T1F9157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 935KB
- SHA256 d10b881dd878b6cfd9189959b11e448fa0f2755bad78d9393933dff75af129a1
- MD5 5e298a5d61e18412fd43546fc3b52580
- SHA1 940c11dbb40e0703c74cc2fc913fba9bc58a7c5a
- SHA512 a49c7794b035e49eaa771696e1687430a9fbc426d75b5402e7d695a79192ac80f9ba8054e3becaa8266c00794d9e5b04050f4fd0bfb24002bd1798bb29fe0726
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpmI:A3kMm56r+
- TLSH T160157C03A6940FE5D11F817099964662EB737C125F6087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 935KB
- SHA256 045f727c7a2899faf237a52235cfba9c539bfb14aa945a58e1d2f5e3afc5b29f
- MD5 8d252fa192753668a3450104d7e6e46e
- SHA1 6ee0ef3fcdebee2dfa4f1e768c64606a6a422ad1
- SHA512 345930edf9b81499cfc0a40205c7f2e75888a9e8375be9261ca5670b96a64b9ad1018c241686dffcdecbda783411e945a69758eb9cc07a1642f5e4761f993f0d
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpUo:A3kMm56r8
- TLSH T133157B03A6940FE5D11F817499954662EB737C125F6087CF2368AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 935KB
- SHA256 12cff2acfedf7cc3c2200e8a22134a089d7f5d3007723f0296cefc9136b1f4f1
- MD5 5d78e84aa4a1bc056cca0f86a11e9005
- SHA1 51afb97436c53307f92f5ab443594697bf397922
- SHA512 d2895e657ed03d17221fb6a96ef1894610a844f8d4affe11de7fae54be442180572c1d63d0cbee1395b04bf3fa325190d9b6370aa9cbeb8c72d933ae1e9afef3
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEp3+:A3kMm56rx
- TLSH T162157B03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 935KB
- SHA256 80709b58229b06ff5a8fafc4ebdbdf2219bd4c72853df6b9efece2355e08b6c3
- MD5 5073d40ff43f729c5bc76c8b60ab1d22
- SHA1 b58bff48c68ea9d67c09e7d5ac9e21ed570b8190
- SHA512 91d5fbe70a2ba98d19518fe971c7e3cb74e589642000b9c36343dcb0778bb9950bbdd947071419fb2209afa5b95c6ae73ee231efc12dc41bea22c93d3251786d
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpNQ:A3kMm56rx
- TLSH T1BA157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 935KB
- SHA256 aa87e0972d0b683dc9c5313e3a78a56dd73e985f078d76defd18fe777a19858d
- MD5 8d27fdd9c54fa35beb8b3cc091bba8b6
- SHA1 21ce67aa825931a7c482726ec67dbbf50254f7fb
- SHA512 366c61f0228a526d662d6cf7ddaf858df2a324820b60ba2a65506c43ebbb86438e2d77168223531d0e61f892038c92e4c256523ed3a67fbf00fffc673f1c4bc7
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpCX:A3kMm56r9
- TLSH T143157C03A6940FE5D11F817499954662EB737C125F6087CF2368AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 935KB
- SHA256 1f94a13bafa137e3ac4a182cb13b2bdea2d86fbdaf94e6b1fec4b7ef7d012b93
- MD5 afc95c31cfaf16ea6d6499c1f282c43e
- SHA1 24c43e15a37e312cba18c5a4b087a97de0f4ea16
- SHA512 07e43a6d8e7299d9de55f8cf825fb5c9caa09289300de72c9b460b93556745967752b4cebbc5703d53706a9aa69b33a849684e7a8a9e1bd786d8311f5dbfacbf
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpkL:A3kMm56r/
- TLSH T115157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 935KB
- SHA256 b2f0f7082dc2ceea6d80b55e2035588ebd1d40392780b7a85941b932a3b30904
- MD5 2094eae17f5916b44ffff6d51f5f83a0
- SHA1 8f10946556cfca9b7d66968579cd21a6cc3b4e67
- SHA512 42e030c78308cb967ab0e15f7d572118dcf9c2294d62a30f684ef43c60b3f5cff0ccac295e4f5fb4e3f0c49bcd820935672a76b6b2f18785a1714c5cc4ac57a6
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpAM:A3kMm56rK
- TLSH T16C157C03A6940FE5D11F817499964662EB737C125F6087CF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 935KB
- SHA256 420d3e05c0654f50f052bae0a74416b5b48daa1e26210c0a51bbbe748aaffd28
- MD5 617da82f7f1824634863e52ad05bd6d9
- SHA1 96d3af46eaf94d425bd16a3f28d08c1cafda8ef6
- SHA512 0519240cca7035b334c7f6e94efab0e7c1b71bb608e59a8609a746a6b64769220de2923cfce73d4a5a459a37181716286e8f04e3ca5250ed5ef29589dcd98e2f
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEphh:A3kMm56rE
- TLSH T166157B03A6940FE5D11F813499964662EB737C125F6087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
- Size 1.5MB
- SHA256 aa86cef63a0a3d5caa3bb6054e4d559b311008c0b40bf8ca0fdb91632ec4c64d
- MD5 676061841073dfbfc5ec43f6b1fb8e77
- SHA1 c8c49169227d4549e79246c5c2b556e3a96df156
- SHA512 7519aeba1ff062a008bffca37f67f4a103321a4bac490a759d56605627bbd0cc17343872b4753dd89a5a5adfa860a78d48e0b743f88d4dc1907388ad40dcbdff
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpx5mWpI2jFM5sFzfTpil15Z+M6qTX:A3kMm56r45BjBbTpi75Zr62
- TLSH T19975AD23A2900EA5E2AF4171A9A44131BE3BBE151F1087DF53D4AE193F716C06B7B367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe$
- Size 1.5MB
- SHA256 65bf440daaab15f1a5d31f2fdef4b8d4fbfd70a33393899bd054a704a4f7f573
- MD5 28e3ac35e5a0a6de4e9aaf32ed5fc167
- SHA1 4f12c70da17a19e60883b19350f9a1b7e08898f5
- SHA512 61211f61b405db4347556433038db2e6691b3eec3a22e5ffe1380ca6e88089673b047fbf6a54fbaad5665d0cad4ded62573b43624571be5c93df00193c0d40a4
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkdYEpWMYenGJiKEbXWtfOkUzZ+M6qTX:A3kMm56rcPnRWtGkSZr62
- TLSH T10A75AD23A6940EA5D12F4071A9958621FF3B7C161F2087DF1354AE293F356C0AFBA397
- MD5 SHA1 SHA512 SSDEEP TLSH