Analysis
- max time kernel
105s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 12:45
Behavioral task
behavioral1
Sample
2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 932KB
- Sample260714-pza1fac18p
- SHA256 974a879205af03c42a177c6c411295ee9f18b37a9ba63debaa8b0bbd36c1cb32
- MD5 98c259fa6efd1491e3d93955b194eb1b
- SHA1 622dafc2fd069e08dc13042d5f06656ccc05c28b
- SHA512 dcf917be67799b17f22e6316e6dd4022c788a53ea9a826b5e52cb5b1125111c87170bd16f53f6e289a516128a111fbb87b8103df0ee4de7234512f71fbf4e4c7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNC:A3mnXoZjzyaEFyKUJqogibzywFKZNC
- TLSH T16A15AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/3360-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c539-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3360-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3364-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000017616-96.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a54-257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-597.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-713.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-788.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1349.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1399.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c539-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f6-41.dat aspack_v212_v242 behavioral2/files/0x0005000000017616-96.dat aspack_v212_v242 behavioral2/files/0x0013000000018a54-257.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-342.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-475.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-597.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-713.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-788.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-953.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1008.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1096.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1139.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1177.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1293.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1330.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1349.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1374.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1383.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1399.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3364 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe - Drops file in Windows directory 63 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3360 2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 3364 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_98c259fa6efd1491e3d93955b194eb1b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3360
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 932KB
- SHA256 974a879205af03c42a177c6c411295ee9f18b37a9ba63debaa8b0bbd36c1cb32
- MD5 98c259fa6efd1491e3d93955b194eb1b
- SHA1 622dafc2fd069e08dc13042d5f06656ccc05c28b
- SHA512 dcf917be67799b17f22e6316e6dd4022c788a53ea9a826b5e52cb5b1125111c87170bd16f53f6e289a516128a111fbb87b8103df0ee4de7234512f71fbf4e4c7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNC:A3mnXoZjzyaEFyKUJqogibzywFKZNC
- TLSH T16A15AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f983de3fa86879eac42140d90710ae179dcd9b25e6341adf0f50c74e2de8931b
- MD5 1604d9cd7409ceb244015d898aa89642
- SHA1 faffc0f0efccdce8f535c6f1977f9df1d596498f
- SHA512 3d06e6abf4820955b1726c79bdca67116b8ed6bd29c1705c2acea41d8fea593fd3393e8a591b30f57f1650b4d2e4f17c81c450046a12901ca0135da2c5f8078a
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogibzywFKZNC0Le5ji0hmxNrM:A3kMjK29Pji0Aj
- TLSH T190657B17F6A442B5E077C174C9E2965AEB7138921B308ACF1399C3292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 946KB
- SHA256 550f045b6edde284ceb1a715e02da20a1680dac970ef63d3b0405709131aa1f5
- MD5 3559b77e65ae37699f9adeeea8e1040f
- SHA1 8a8cf8ca2f1b95f0d0cb1d0a42ba5fd0842dfa36
- SHA512 8dca7945b15d5f94349eda3abb0ac3986dc222ecf1c5ec425e922248b2c3311b28ec4c886404de4243d53099b899c1907fdc26dccbbe057e41ea686263c46baf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNMa:A3mnXoZjzyaEFyKUJqogibzywFKZNMa
- TLSH T10025AF03E7A410F5E51B823099E54612FB75BD672B60C6DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 956KB
- SHA256 2c7f2410360c075de8c002c4c9f4d65a113b1f3bee6808a34057c04f7bb3fd81
- MD5 50c03e7abaeffa1a0acb39e90d8f9c5b
- SHA1 b3cd8dcd68ee1b7ee1f2df1f2fe7fde019c6b5a6
- SHA512 8260ec4cffff9098bc514b373d34676aba70591b8a013620b99ce5e080bc55b0c43783218742252c5fee7f6ca082e9b2020069ab1ebad4120688e8d7fbdcd9bb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNl6:A3mnXoZjzyaEFyKUJqogibzywFKZNl6
- TLSH T11325AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 956KB
- SHA256 1a66a97d4887a456e1e12eb6af4a142383c300f8f8d31e4c16fa84e28e86f558
- MD5 b453333a7b86f1b100069a8356036699
- SHA1 04eaf96eb86f902a1f65f34c916e63de2e19dc3b
- SHA512 6456a94a0e4b4e7575ae243228a6c90e6da6452c5c4483a2e9453b1c7f97d3c4653fa5cccc4d619d6f20638645457b1b053ac40d03b9b24bdb423484d1efe5da
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNd9:A3mnXoZjzyaEFyKUJqogibzywFKZNd9
- TLSH T13025AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 956KB
- SHA256 741908a9eb14cf38bf9a929f9b27725b281c2d45f8a14fab08f15e38b4495dc2
- MD5 35b7c2a5496893908f6fdd9e8779f301
- SHA1 bcaa7342c2420b447b3c96dffe3efb88d6b0c503
- SHA512 892b5d255ae034c7e841fbe44f465532316246f831aa2a2ae222074fd82105b4185252b4ae790b02f72929892e181e80df8a59566c4e8fa6ef177244473c9d2f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZN5c:A3mnXoZjzyaEFyKUJqogibzywFKZN5c
- TLSH T16325AF03E7A410F9E51A823099E54612FB75BD672B60C7DF236882252F637C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 956KB
- SHA256 0981fd50a2d3f6a9fd3cbe6f852071a2f4c39659a3c6a1a69f1f18e659d37e69
- MD5 638e42c16f877f39912cf648f169b9d6
- SHA1 cff3d3afd5e333fb95d73f3b4dd046bceb4d0b55
- SHA512 617682eca95e9bcf870d96cec1c818b1ab3cbe1e95d7487c18fe353d7b3861377de8e32dc1063dcb5b5d3e8ef73a9600b5dc55f7876376d091a6f3d30a9f4c1d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNyp:A3mnXoZjzyaEFyKUJqogibzywFKZNyp
- TLSH T16325AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 956KB
- SHA256 077f138e7d42c08ed9036cf6d376b03d39c0c2e89bc89d165ce6020c30743050
- MD5 a0c4a6e4bbebd0b24cac45d02222b93f
- SHA1 a9c0c28594b09dc7a59f8b088714deef8a3ae069
- SHA512 849daf87e866bc1a59211e2326c78c5769731b23ea9d8ca5c60b0c1635039d2db321cf951ba094ae51af9e7fa841003ae9d2a139ed4109ca471425e29a01f9ae
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNF0a:A3mnXoZjzyaEFyKUJqogibzywFKZNFN
- TLSH T1C525AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 956KB
- SHA256 4c28bea924ca50072ff89939b2368153378b1482d136ffcff26df62dd23755df
- MD5 94cafa11c2a4ab5058dac30192804907
- SHA1 069e7e729b95d1d94704389153b069ada9695578
- SHA512 ce9802f6601d8247f1bd8299adbb59f859eef9970aac76900dbe7d54ca9e41a4671d7a56b8fcfa17691046fab897d29d142456ab45da79db0447019c66c9a2ae
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNXF:A3mnXoZjzyaEFyKUJqogibzywFKZNXF
- TLSH T10825AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 956KB
- SHA256 3561911e93c07f3a78c6566bc987487b2f1bc633454e12ee7280f55e5f6ce1b7
- MD5 fea89badd43b998036fdaecfa39c6d4c
- SHA1 5c19964666c27e9b586c2ce7a7b598b03f3e45f3
- SHA512 cb4e60c68677651f636dee50c64f617a16e279cd6a766c810f1bc03c9fbbc79f37362c0de9f1eab1171af70dc6b70e24d049f2d0dcc622b02acc0ba066975ac4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNoC:A3mnXoZjzyaEFyKUJqogibzywFKZNoC
- TLSH T1CD25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 956KB
- SHA256 541866985a2bd23d9e37caa9d0ae5d3c813d695ffbcb50ef4582bd518adc489e
- MD5 29b547b0322b5b0d08a14eb31e3a42ae
- SHA1 f0757636c0b8b0517f19c89affddffbaf9ba350f
- SHA512 de8150cff0946d8aa4b3cea48181212c0f064269d702d6bc8dd1e5ced5b0398d652c26d52fc1942cec424f8bac8108400cf43bf87a9257fd45a5a56f31b80630
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZN7w:A3mnXoZjzyaEFyKUJqogibzywFKZN7w
- TLSH T11C25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 956KB
- SHA256 01d53ea74d5b4c585256394a49fce6f1c1f790f90e679a30d9b605898d42876c
- MD5 9c0064f7960f9f6b7bd112606f0b3f8d
- SHA1 51609aeba77645f71ac01067ae010085ecf53460
- SHA512 c9f042bd7a04e0c1285e35f24c34ff44813313a04dfab6b254d99a505d49ad15c754b644de390364d67dcc13a7a2aa5ca1b16cc4752dfb2d1c770e724bc9864a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNCT:A3mnXoZjzyaEFyKUJqogibzywFKZNCT
- TLSH T12A25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 956KB
- SHA256 3fe55d8d5f747c31b36da01f25f9dc9dafe95bfe070f3c920195021f91f4fbc5
- MD5 c2b4bc481a8173a8df1a3166ffc1979a
- SHA1 ccfcd1c7f5b3da8e617dd633948808407c6f4995
- SHA512 9210b2428da786d15af273e8693ee658ac538a79baac464690feb2df4fef0f82dfb247c781bf0c3550ec110940db8a09bdefef715d172c10c2ef60d21b6491d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNSu:A3mnXoZjzyaEFyKUJqogibzywFKZNSu
- TLSH T1FE25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 956KB
- SHA256 da9bd1f31da24b01a6a01222ad894f8d4602df9f4a999159ec904d7b041170f9
- MD5 2da9e16b542e293c301b069070576294
- SHA1 43be6c03bedf8a5f35706b2b1271064259fb8741
- SHA512 bf2b6b1f4b10ef0fc58e9a82df73e45583f4907aa629e01994ff78cf69e1b1deafdcaadab88fb53c5c07a22b3cdea89b3c1c33729f1a1e1e5ecf6b7446532625
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNMb:A3mnXoZjzyaEFyKUJqogibzywFKZNMb
- TLSH T1C025AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 956KB
- SHA256 1562d8fe1f1b6265758ee3f7397fb3cb2d7b11fbc59da410022ba5179255f8eb
- MD5 83a74c6769974f4c1c62737810044e81
- SHA1 03b465767989d1d8374acb4a9b56c75359a36f1d
- SHA512 1fb3378c350cc42cdcc76488a1a3cb5f461b531baa4550a6b2d70838119cccc0d2163723c16b728ce4c37862e018504c88293abde3d2cbd7cb8df62514587caf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNyf:A3mnXoZjzyaEFyKUJqogibzywFKZNyf
- TLSH T1CB25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 956KB
- SHA256 5f73d727fb47f97ac508e02853669b144d03967a18673557a11dbc64d76f67fb
- MD5 19002e1570e48c37ada589d226dbd95d
- SHA1 4d36bcae714949fe834062ee1b43f3c5cbf74d51
- SHA512 5a7011b18490d4fb063507c0f6ed87996644a0509a53496934fadb6c5444a1bf28ca40aba40f07695f0268fa238c7e94a4db9928346dbb41a3c97406fdff6164
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNfK:A3mnXoZjzyaEFyKUJqogibzywFKZNfK
- TLSH T18925AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 956KB
- SHA256 47ef63872f2a7323cfcffb44a277d1943faf32582e3a40bdde0d1d9ccb7e8cd7
- MD5 339e7a331e37226e5b4c57183cce3bd2
- SHA1 86aba77bbf23de885e86ba9adc2710dd9399cc0f
- SHA512 2ab50bc31a5f0ae48ba540f17c72d029a101399ff2b4587318fd62435c345ed610f85cd2d507e0cced31d26756e4dc5abc657623af90a8343bffc3edd72200ce
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZN4k:A3mnXoZjzyaEFyKUJqogibzywFKZN4k
- TLSH T13125AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 956KB
- SHA256 5f1a0f222da2831dee34a319e02d45df282e7ba28155ce42a00bba7ec183192d
- MD5 d4be4b1c7271112cbf669c421a248545
- SHA1 236f181f3ceb3349aaa06c5c875c7db446e27e54
- SHA512 07df9a7ae8b995b74e4ff5eb59b526060f48d22e7f8cd8246616d29a22aa87ff3a9e5e29cdc44d918da79d21598416087157d10d8259dcbc20c2b1beeb7df373
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZN50:A3mnXoZjzyaEFyKUJqogibzywFKZN50
- TLSH T1D125AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 956KB
- SHA256 c46ba43f629bc6fccfe8303c1c0cbba947f44d4d27b9a6eb949e50b41af7b9d1
- MD5 c9d8cddfe608f62847372fc0ba1b29ed
- SHA1 84c8ad36bc1ef12900a0709243c087bdab5915c4
- SHA512 09f2206e282e21bb72ca68a2217e14855f58c6fdb3fc7fca21b2381f29e0b7026fbad43b87ecb69b858914eab2140a0fc41f4b805cde0315727990323da9bc2b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNs70:A3mnXoZjzyaEFyKUJqogibzywFKZNsg
- TLSH T18825AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 956KB
- SHA256 918d22f180c4f6854456ac7d56f7e7e4658634518e35b4bd8cab8fe900e3f581
- MD5 c9a8935283a13dbb8eaee97c0e8aebc9
- SHA1 2472d780522f9e2836ca96ce5982debe2b9b5b4a
- SHA512 72b4a4a03f645a2a683b2c32e1963e29f97fdcddd088c6c21d76100a0ec6f59fbf3727e6462aed033491f6045b55f70917713ea9ef010b3f38c9757100782aa9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNJr:A3mnXoZjzyaEFyKUJqogibzywFKZNJr
- TLSH T15825AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 956KB
- SHA256 5f7a0c83ab1411a55a99263ce8c7a6f6e7949508da1d5e7b8e33b660e2f63a38
- MD5 16ccbf8760ba31481a15fd4321a2faab
- SHA1 d089685b828054841ca3b7e578a1c9ebab499535
- SHA512 9e2270d5afad5bffccbcef5bcd92c02278473d2ae212e129512319ed2bab5bd6e23551f5fe07bac42737dd88f71514482132daa23356c70b129a5e6780967559
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNrn:A3mnXoZjzyaEFyKUJqogibzywFKZNrn
- TLSH T15525AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 956KB
- SHA256 15b728d02353fc98ee34c076a75aa595332e79b670dd072ad9d42c92e121b0e4
- MD5 82bf955485aaa23a262e8d8fdd1d8e35
- SHA1 ea6ebca1a57c5ee2a3c415b6d42d4662abb00bf5
- SHA512 8c991ec813a972e438e1b471816550809171444b1c6e75b58dc1615434fecdbf9cfa3d6643a11323eca83ec93da8252c3b214cfac1d61d6aefa06984f17c4e33
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZN3x:A3mnXoZjzyaEFyKUJqogibzywFKZN3x
- TLSH T1E925AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 956KB
- SHA256 6c1bca46bdd7cba4901a1214d3bd54eeb298817be3c7f2d16f646b09517c56d7
- MD5 4e395a26dbda825a5d8b20bf8c5a94e1
- SHA1 54d4a15250de4a8f2733819e1b61b5d20200e22c
- SHA512 bf8abdb06d594f803ea2b0093f0a37616e0484857543700ffc3bb801e62485effbf23b362cc097642a0b3f5b82a255aa7950dc807a2e827356605490d4c98e2d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNtA:A3mnXoZjzyaEFyKUJqogibzywFKZNtA
- TLSH T1C125AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 956KB
- SHA256 22bade365f408e0b3c2b49e53fe3344a10c99aa7cc3a290f487531bd2d11cb4b
- MD5 5076258d27f67c1a5534eb8d1079b097
- SHA1 e4860c0bbd6e9bf8652f16a0077d86a1e3a49bc5
- SHA512 e4b426347fbe55cba09ff2d0bf7f727d82b2621f3978c379d17dc1f94256d4741b8e2125c5108a1a2db3885a1a50f88181ff02d6998216cc8054a9187ffd5311
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNm9Q:A3mnXoZjzyaEFyKUJqogibzywFKZNm9Q
- TLSH T15A25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 956KB
- SHA256 a5d47486f53142d2fba16078c96d00ecbe41f90df0f70c150563e2e736e4375f
- MD5 07892b3f02ce3ff732634153ff9c0211
- SHA1 f6e82528a790d8b379f3b2901c7fc2c6b7bb85b1
- SHA512 7bb2678678e23c849fe3c2c75b11828e33f15bbe230c70f3d252cceb840487bc7221efc7107d91c9b04045823c8fb31be6f23c47c7f59e7f2ec39c2fad8b1856
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZND4:A3mnXoZjzyaEFyKUJqogibzywFKZND4
- TLSH T1D325AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 956KB
- SHA256 b5c67b2435cc80cc1b2539d9259b2ca6e7356a586bb607e66fc190caa35407b8
- MD5 36a6095b8bee54d10d34c3a4fea8ee17
- SHA1 5d4ad8b542c97872941644981ba893bbb85ca943
- SHA512 0a4bfef10d21dcceeae849f22187c43f1db19c520899a9fd89ecf492ce6294adeb8df4bf185a3fc7bad1995ea52d787ae68f22dd0b1978794ade6e7e4de13ca7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNqu:A3mnXoZjzyaEFyKUJqogibzywFKZNqu
- TLSH T15E25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 956KB
- SHA256 ff5f3acd578c5182b6557fd32e0ffbf23c36e7ea1e293438efc401c59679cfb2
- MD5 d798997a1282ab589743fe0a7f4b9e28
- SHA1 d6d752f49897c1cc6a245f5a8a925219418b59e5
- SHA512 d1827b78f6142eb5b019b84e62e3275cb3d0339c890618ae4437a3beef6664e2293a525e4130def63e8e353098563660f516fad35706c888fbbb09634424763b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZN7j:A3mnXoZjzyaEFyKUJqogibzywFKZN7j
- TLSH T14625AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 956KB
- SHA256 cbac572e5e19350908465703af694fd3032413e4798783cb743c6b3c938409e9
- MD5 945dff984dabdb3692b4256aa9c72504
- SHA1 1b738e162f38615e8a17963ba20f4c18c1cf457c
- SHA512 14b92de2c208546641733753823a7c984d451ff16e305975363ade063c99643f29d94e8841bd68e2cbb1f5565d56617e9cd8be905ada07c8c83bc2f7636f7818
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNGg:A3mnXoZjzyaEFyKUJqogibzywFKZNGg
- TLSH T17325AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 956KB
- SHA256 2abb85b663bb6344424ff651ae9162164d2fd6fdf8a5182cd805b1e8c9f076d8
- MD5 b4f336988413d881e7c1dfdcf6eef5f7
- SHA1 64c251c5d988cf4720c327a643cf059a643d8792
- SHA512 d8d7c8b4f8ed448300bd2018c3c5a6988569ac16391c31cb0a0b6bbbd48b2991a3da72537e336ae21ae573f155017c5f57b1b6fc9ea5c2167f4c486414360c32
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNpI:A3mnXoZjzyaEFyKUJqogibzywFKZNpI
- TLSH T17D25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 956KB
- SHA256 ca6d70d48724e2ca8cfe3d59c0e5905b60d79f4f02ad374c585ce2127ad5ee49
- MD5 d26aa877543462ae29aeca437e4b140d
- SHA1 da610e929e833ddefc9ac87d492fff5d7f1216c1
- SHA512 dfdfec92f683377ebcf0e96e318060e70fd321cf586c4baa7aa29a0be3d7f067245cdb5e672f716fb5188233d3e36d34b720274faa05ed8789d1bbafa7f569a8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNLo:A3mnXoZjzyaEFyKUJqogibzywFKZNLo
- TLSH T17F25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 956KB
- SHA256 f3a5e87fbfc2062848418d572b7557b725fc2555e6d8405fcfc239f4b950a077
- MD5 f99b73f8f8cb7a24f6c2870b02233264
- SHA1 270be394a177070a185973edef189743d88590d9
- SHA512 c904f90f449468d71fbf0df3833b8f28e33e6479d21e63c581edc8da2cef3bc53359cefe15043d3f10b50731d025496dda1b5fa16b3f07b5efe01bcfb83a72b7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNw+:A3mnXoZjzyaEFyKUJqogibzywFKZNw+
- TLSH T13925AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 956KB
- SHA256 67c99f2d884df78abadab473b3c12fa04d97926c88a77debe378d52df4f80b23
- MD5 b18233dcf4f4ae9cf9baa995221a05b3
- SHA1 6c4ae5b57047254d16ff9b66a81cb2aa49a62bff
- SHA512 80d2057b25c1341013d984ba49d09735622306f9603568dd4cde57fa8d79eb0e3c2938ecb799a4058bc09c87efd3fd76a241d60523a676b64da6e760c9c02de5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNIQ:A3mnXoZjzyaEFyKUJqogibzywFKZNIQ
- TLSH T1A725AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 956KB
- SHA256 0ba5f536d1b031d7148279fcab054eaa5b8a81f2576778a5c2dc97654c3206ec
- MD5 48eec3fab5123efe4dd40fff8158620e
- SHA1 becbb769c8f234b8e6ad240c94caa4620ff0b684
- SHA512 c739317613c1773e707264e970b47a051bcbd3478149d78589a95b30cb97e205ea9de1277aaf6e8f111601d7e040731038a9ac0c98986d346be39566bf3c6ebb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNBX:A3mnXoZjzyaEFyKUJqogibzywFKZNBX
- TLSH T1B325AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 956KB
- SHA256 244217868bbd2c197126b13dad38dc4b6d11db616bfa1a654fa6e06a1bd06357
- MD5 1b07e03c4155d1176ed13adfdd20c6bc
- SHA1 c4bc6fadc90df566e198cc71a79bec224eaeb273
- SHA512 f64d3333149c8bd978dfae4523578d8a23c161deb0ff601092c61291d4cb0f1bc4ff299618113d654eaf72f2871c64af6a4beefed54a649e6f6e54fd9c4f7c52
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZN7L:A3mnXoZjzyaEFyKUJqogibzywFKZN7L
- TLSH T17425AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 956KB
- SHA256 20a53728fa0c9c17a174e8d9ae9627dba0010db408f37a7b61c0d4ea6fc00865
- MD5 c39f43df94b64b42d6481532a8a3c139
- SHA1 d63a815dc02fc5ec5796382c57c8b3917d0873e2
- SHA512 876dda9869ed792056ec531823f8db9abe5193a3f0d97e7fc259790181fd197b3b909f91ef537f6950ee68c761788273b8c842747ababa1f799e25cd3d353521
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNBFC:A3mnXoZjzyaEFyKUJqogibzywFKZNBM
- TLSH T15D25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 956KB
- SHA256 61209febc7fb38a1dd941d14d3222121d1792a59c594331ea0b56681b7f163dc
- MD5 4be14ff63b7410d6953174994a80c6d6
- SHA1 d78ceb522df6bb4a8666ca102d408dbda8f6dd26
- SHA512 3e4112e5f0c9fc9599820c66bc56f494b1a0ec6eedc2363d396c86657291006529006f44a3652456bd2cc9102a63b8711e36a76254e4443e3cea0d4ea98f1e80
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNqh:A3mnXoZjzyaEFyKUJqogibzywFKZNqh
- TLSH T14F25AF03E7A410F9E51A823099E54612FB75BD672B60C6DF236882252F637C06F3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$
- Size 996KB
- SHA256 e42073a733242d133d66e01613fb0125ba884b2b52d6b3245fa3d4b8eb841ef4
- MD5 615f5ffaed7735a037ee14ce7e7fe924
- SHA1 357fa643b9be4f16cd52e2ce16d830ca359976ea
- SHA512 bc00f75c67788b91ec1083d321ba26e78b6d8b4f3917f8d1d03c67e69f0b0111a7494342b4a3d64af412fec2a7cd80285ebc19ada42e8a3c3cb580b0a5b6efb5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogimyPz5L8wFKZNxqnkraG:A3mnXoZjzyaEFyKUJqogibzywFKZNxj
- TLSH T1D525AF03E7A410F9E51B823499E54612FB75BD631B60C6DF236882252F637C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH