Analysis
- max time kernel
104s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 02:58
Behavioral task
behavioral1
Sample
2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 871KB
- Sample260716-df8a2sby7q
- SHA256 fa834a746c8e7fb44e3067d86259e5b1dc02c08b903e280145cbe8107c3d9e9d
- MD5 249b0ecba95fa7c022304f9570e4c1d8
- SHA1 05bff7194c8fd6cb73cc26af9a96c775dc06e05a
- SHA512 529f79193b3c4d468ccef462433491d7cf5a78b07a71ddda1eb9f443864a19f37ad4d53c0854ce9175e402c03728ca45c40cb2033bb0ed7694efabe6a845ea2a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEsa5RNo:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNo
- TLSH T1E115BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/1352-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c602-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1352-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4360-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-273.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-424.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-473.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-591.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-635.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-771.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1092.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1155.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066ad-1847.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c624-2134.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c602-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2de-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7b-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-273.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-424.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-473.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-591.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-616.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-635.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-720.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-739.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-771.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-911.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-937.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1092.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1105.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1142.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1155.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1189.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1226.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1323.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1336.dat aspack_v212_v242 behavioral2/files/0x00020000000066ad-1847.dat aspack_v212_v242 behavioral2/files/0x000c00000001c624-2134.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4360 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1352 2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4360 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_249b0ecba95fa7c022304f9570e4c1d8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1352
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 871KB
- SHA256 fa834a746c8e7fb44e3067d86259e5b1dc02c08b903e280145cbe8107c3d9e9d
- MD5 249b0ecba95fa7c022304f9570e4c1d8
- SHA1 05bff7194c8fd6cb73cc26af9a96c775dc06e05a
- SHA512 529f79193b3c4d468ccef462433491d7cf5a78b07a71ddda1eb9f443864a19f37ad4d53c0854ce9175e402c03728ca45c40cb2033bb0ed7694efabe6a845ea2a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEsa5RNo:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNo
- TLSH T1E115BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 970KB
- SHA256 9c0d2da4af7b632367455d36cc5f07b926c6b746e1e9f76df76878cba72bb051
- MD5 4d5081d5f1bc3aff221049320192ba6c
- SHA1 d1cd1cb5d15f598b8357fa6589927f4815a8736c
- SHA512 e09656846bfef1f52deb03c78b343258437dbd3d3f8a14174c2a2573cf686ad09490139daa7178a75fac42d4d6247a75876f3efef5f02fef880325496de22e95
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNb2MqDBxc:A3kMjKJMqlxc
- TLSH T16D25BF03EBE404E5E5564630A9E54622EF79BD532B60C6DF235882152F327C0AF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 acdb504884d364c6a52131e11098d5441ad8b1ac0d0f00a6c7b198f3d33c81a9
- MD5 c4d3f3ff086803198f291ef1fe46fbaf
- SHA1 18ddc30891f2c98193977db83cc70b2f7c0987c5
- SHA512 9dfb68edb8206e017b9f0737b929afd78aa90b7dedfbf8bfcaae8398ffc4f9954c6517a20704455f8d6226c51a0db567330fe8a754a5a44623102b543ee2d381
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNw0Le5ji0hmxNrM:A3kMjKxPji0Aj
- TLSH T18C657C16F6B446B5E077C174C9E2965AEE7138821B30CACF1359C3282F63BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 886KB
- SHA256 deadd817384306e323dbd638193c0cc1893084901fc8331d4b454e41942e0e4b
- MD5 9f7d90e59e1d77ca6c6e3a0f8652739b
- SHA1 62722501bdf4ac2ccb683174a458fcbbb7a98a3a
- SHA512 0906075249ca948a4c73f8ca8f9e720156b58a7848513d6ce108268c97667b5c9e586c49a6e50e997253c203509e90c1c6d4737885fcbb4f69d9f7cc224d4f4d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNKa:A3kMjK
- TLSH T16315AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 919KB
- SHA256 af115cda9e365aaf3e80c0f5c00bf33ce89aa58b73fa9a8eacbab19606dc3690
- MD5 d54aca6c6dcd5b71cae37a78795f389f
- SHA1 05c2998ae760e2c060873029f6c77867bb247c2f
- SHA512 d9d077dd66f0eccaa394ceef8415d4125596cbcc7f1dddcea248d02fe5b2333587b7bdb12f89e9ceebaafe13888f620aa127fa9c618cd7f129181e37dee17702
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNZb:A3kMjKAb
- TLSH T1E515BF03DBA404E6E51A8630A9E54612EB75BD532B60C7DF235CC2152F637C0AF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 895KB
- SHA256 56d584d1910324da2d160aef0402dc9ace55681136475c12381269c751a6a317
- MD5 85a50c77c6d45d9bd89145be18fe9499
- SHA1 682da8bcaf9657a95d14f9b688541ba4766728da
- SHA512 e05aec664daf9d221435b2313741a17c848980a36b1ba554345782204f5793aff82dcd9cc13c7499a667e82d49839773cfd3244f5a88fde34532fd1786731b0e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNr9:A3kMjKi
- TLSH T1E315BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 895KB
- SHA256 9990d27608be822625804f47614296495e2e32bc246537eadd251d9ac332217c
- MD5 11b64da25b3944ba768083360c99a15c
- SHA1 c5f0cf82d1492e4a28978f225d2a36a65707de38
- SHA512 2d300833750739c8d356959d56256c64d5ca464b6a131c7d81274d952b030219b8b2f7ba59236549e97e293bd9944a6f15519ff4b9fc0d064a00501fc4ebee2d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RN3c:A3kMjKP
- TLSH T11D15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 895KB
- SHA256 e6e31db97b71d40badec1139bcbba960295abdf54c23c3776c527922f355a812
- MD5 490dbf6eef4743a62c7f1017f7ee192a
- SHA1 1524b35d307298506fc28fbd7267dfad870bdb48
- SHA512 81afeda3f859d19290d5a271f8b1ae5a938401321dad68df4dd06a070b61200efc9632376b4b3bd1ea942e7cbd0b259e3c65e8bc8400460fb18ba8b3ca695472
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNAp:A3kMjKF
- TLSH T17C15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 895KB
- SHA256 e2cc99a58a46e27a1ac0cc5cdd8d81c78bb8d99009affac00fa7f7742b4d2c8c
- MD5 714428ba57299efc1956ae25f37833d6
- SHA1 f6fd9151f834e3e1d629ddc84cc9cbb1663cc993
- SHA512 70c9517161825de750b23bb158657297a94bf925ab60f2308a404a5eddfdf968a8cfbdda951f3f4cd21a3d9657853d587d73d9750196927976b51f86ea6c2672
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNHN:A3kMjK+
- TLSH T16515BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 895KB
- SHA256 8068f4b512a3bc128d840780f6b7a333f7cf6dd18fd7ff82162849be428d94a1
- MD5 59720d7b425accbb1b58051e382e6f36
- SHA1 88efac55e2a79be0f81447d294a77c22b5962cfd
- SHA512 2d847990153d8824229df342b2865152068a2faf04ddf7a0dffad29475c7bca308edde6ee4503cb16723cf4708b6915258f9626f22d4966b415d0ce412345929
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNlF:A3kMjK8
- TLSH T18E15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 895KB
- SHA256 b70f61ca4962c5b82a4ae626015aff439933eb063218212d11b518d1574a84cd
- MD5 9fd14c4ece281f8952a6d6b3f2d51912
- SHA1 a42f4306b96d2138bcef29f69c1b63c57d0841fa
- SHA512 53e143a37fa981957851e575de445e1c2389b0a642fd139d5eb77b085519fcbd8bb1971d104f65fa0500d4e972fe9a7eea612943f63f7c5d6e411f5325231283
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNGC:A3kMjKI
- TLSH T1C415BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 895KB
- SHA256 f23da8bef23193554ddaed686e3117dba8d87877f363768eb1423c4ceda24bd4
- MD5 bd13216c79cfcdd279bfddd6df4ead82
- SHA1 faa4fa99237c185b32acba7a3f5e053b17009757
- SHA512 e9d0d5a031400e436c99af96288d6e5781cb6a7b9ca8251699617540e1728ac96c63a0270e6d006e342db593c1d69988ca7b9d401c388921a19bace52e465682
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNJw:A3kMjKl
- TLSH T19815BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 895KB
- SHA256 e0a050986f98977440272c8af66a0f13414fc6308ccc034d0a251c19ee427384
- MD5 2551aac62d2ea400a570af229d6907da
- SHA1 ffad0c41e8a81e3a5cc3e01350cbceb12f9b1726
- SHA512 91561452eb8d7965ac9b98155dd828e77a4c36c0a0fb41beab65d123b516d36fbe4a860415cbc0635d8213c9d2db1691057c5e9b419d7e7f8a29fbd85d72db8b
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNQT:A3kMjKZ
- TLSH T14A15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 895KB
- SHA256 b4256fcdb318724d1e22fbc7663f9a001b95f674aabd8eb98f0a6ec9f73c7094
- MD5 4611e4d97b97af0ebbba095c3b113fac
- SHA1 dfeca2798631fbccd03f60741c9149f7d337e4f4
- SHA512 035dea91d68c9ecdf51db69503c9caf217998dd4699042d9a568d056a14ab2aa004ce59f344da521125a350bb5ac5c351a79836feb0e4f93494be1ff98ce77d0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RN8u:A3kMjKe
- TLSH T18E15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 895KB
- SHA256 d27c09f7f9bc5710d39242d93e198ba5c76b22903a235b7f904766976132bd35
- MD5 277b7b9daec414706fc30a79c1a592a7
- SHA1 20cc004f6a50deec01c4a889ab3d7c167990f9ef
- SHA512 8879c8b5ba9f9de8291a61765a333e0a1a98bd1a050436cd6882c71af629faac95ecc4baafaa040c0f6780b8f83dca4fbed2505a905ef90d7332edc47e7d5bb3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNab:A3kMjKf
- TLSH T14315BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 895KB
- SHA256 6a4b574a573ffb26d92b8476868d4458e22d1c621b2acf5ab95d6d7205df60e4
- MD5 2622fe192f6ae8fcefcfc4a50c8b5a4e
- SHA1 6b3629e08896cb28c8dc6f44c971cea6ada0292c
- SHA512 867fa4106779179e575100fb3b72a7f446e978472b4e50bc10378e01339dd0fa473cfac08b0c2133a2b3ac420d23350be0dfae6f21c6d1f625bbddc7d7b98262
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNcf:A3kMjKX
- TLSH T18115BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 895KB
- SHA256 1182731e10226e4c74052af25d3a9a65baa4e1037ef7cdc7cde82ba5b3f7c05f
- MD5 36622e452bebf8e9d5863e28031457f9
- SHA1 7d286634e418416f656d80e15633439f2e841d1a
- SHA512 a5731ca2299f8f11b353258c67c31b8496343e821b749dde30334436ab98a39bf74602aef5368ec6c474f8512941db45f645d72ec3ab8fda5be33f9a5e431578
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RN5K:A3kMjKX
- TLSH T1F715BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 895KB
- SHA256 2a2e05a89c281c0f98dafaeeb6030fd537298ec9b72b83e2edf8ff021fd9588a
- MD5 fd349ca8f57de7a0088b7a546541553d
- SHA1 10d39342f39f0ad283beb604ad421518e73e89e9
- SHA512 ae5d6f4bd84baa106cce89eae2a82558e613080d88c75685c477ae90cb4b9125fc9321f641d8e9c53d6af028acf6a7885f4e096b5355cb7415e40c3fb5cd2faf
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNik:A3kMjKy
- TLSH T1D215BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 895KB
- SHA256 d741d78b59f5e0bd9564496adb1b92cb4d6b7d5b0ef3efa390ffdf5d0f760a08
- MD5 490a95acb030a8e2f9ae1f275da1327e
- SHA1 1fbf5fdb9c399968977223e1a5506470f318aa8e
- SHA512 4deeb438458c762984b22a9245f5a8d3dafe6dc11935fc2158d262e7aebf94c22177c656ee51b6fa3cff23f03f9adcdcfa4b12dc61008a9e8c9ad575bd0fd154
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RN30:A3kMjK3
- TLSH T1B515BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 895KB
- SHA256 d8a58c7d62a1baefbe29d2fc4e6397342f41c02208959a7aeafe8eed67366207
- MD5 a4503b5ef4be6a0109490bef67af9e0c
- SHA1 148555c45eafd21cb5e98184eb810bfcedf691ff
- SHA512 a6a730a64c074c1dd819df9f56b248df3b38332691243e53b61395df8d2b81b7c2a848db030903605865784bcfc6900aaf363f4ab59b7ae072a452bed2104ad6
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNmg:A3kMjKK
- TLSH T11D15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 895KB
- SHA256 74dc0b213680f4f6a7323992e10eafed9c6b87db88315b5ad311c07e96948243
- MD5 42fd3fb296ab7986b34eb3f372ac2862
- SHA1 6fb4f5ecf8d0d38f868b1995888c352062bb1d48
- SHA512 e60daa6c8e935e3d47035239639acca05af9f4ed3d65753820b016d90477089cd0d94f1923ad498bee8a5a0fd154c2836f4a7b235c935583a5fd2d0327bc473c
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNvr:A3kMjKU
- TLSH T11815BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 895KB
- SHA256 b00a207996c9fe534b52f43748df74bd0e59f7e8a2ab28adfe601a44bd56a432
- MD5 72de52ca3e38b957aa4afeeb80751549
- SHA1 d8498488adcfbc433559634934373d1e0026ba21
- SHA512 932cd8784fcd2e599f7254b26f33154273b88dab4f22845e7e189814f6692c065b69e758b13139150e1befa5cee4183b3707c7e7d70a934b9aa98068c9843a59
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RN5n:A3kMjKO
- TLSH T10C15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 895KB
- SHA256 7c175e87fba62dec38ae81e4138312f9dd0f981f017d357dda53ab5587354b90
- MD5 346105e4d3beaa6f3232dda3187145ab
- SHA1 c8847f080c0c5e07f5656d4ce8b16cafaa83a583
- SHA512 bb35716a74e2c26e32b5374e1003fb877a60a36ed4d4be0e6a73a30ac356ca14ca8f4836baf29f42a4a4dd26cc8e05348257b8caff1a92f0cab3294375443d22
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNVx:A3kMjKU
- TLSH T14B15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 895KB
- SHA256 1cce2ed230425e49f21fc7d7b35d2acea53d82baa852c142efcec277f11aef81
- MD5 68b60bc1af4a292d4e91418977bdd429
- SHA1 fe7199340e0c5e2de995d2617ce3a1a191a8116b
- SHA512 ca52536837f9efb9015e820f1f550771f5d0e4dfab1f335aa696f5934d964488f2aa6f8ee3389e7f0bac7188f18fa579ab86f911a77d6670e22daa0b2eea062e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNLA:A3kMjK/
- TLSH T10415BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 895KB
- SHA256 53b378a908397751b866feaf7f386670a318d3720940749a62d285f4456bd1c8
- MD5 cf021108ff265d39bb81676285bab92e
- SHA1 9fd74d5cb6c3ad5ca524e8e49d4193832b808a6e
- SHA512 1f0a03cacaaa88645017a97178d460fb96cf9534ea4cfcf4a3b1fe87ad28d175753d723db4f1afd400f7c8dff956f1418559eaae9abd2feb93d613ed15b422e0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNc9Q:A3kMjKS
- TLSH T1C915BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 895KB
- SHA256 cca676a17406a5554a6ca724b72530f035b32e63caa1fbacbd7b8a6ed3b203e6
- MD5 c0ed6bea6140bca2a6755ef331c5122d
- SHA1 3e9d18198c27410a232f310ed5e7c88258fc86a0
- SHA512 7a597b4024977dc82fd3c5a69c83fd7172e7f869539feb44a7d7d591e611fd2ebedc4e09eae81d071a8d086e186a94894ec4dea4b08e5da9add7cecdf773984a
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNF4:A3kMjKh
- TLSH T13B15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 895KB
- SHA256 cef67ff71a2ad0876ea5b5d88ad8ca28146b73254a0205249e3a31862118db97
- MD5 a876c84e58e917ce61163290135e2883
- SHA1 d355df52390216c31f4fc8aea647290bf07801ce
- SHA512 163e09933983937e92b8ca05a6cc477afaaf1889117e6e47e15aefed3bd78116f013be0da02a400d0ac3ec033c2a8bf163a064953df1a8d376e15594e686d852
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNQu:A3kMjK8
- TLSH T17A15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 895KB
- SHA256 6eff59216954364c054963b083ab9ee83a76843c3f88deee7fc09caba2771f2b
- MD5 af0dd0e4c87f2de92fcd89fc5f7049ea
- SHA1 128260b655a320ac1c1e3b9c0789e10be2de828d
- SHA512 58df5eeaf58a4117e9b7005cb8deaa27a0f37803ba4fc6a1b4c27a935abd13a987abfec0a99b61908cdeecbf1d71914cb42908b4e3a667a12e9dfd87719b9c27
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNRj:A3kMjKe
- TLSH T1D315BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 895KB
- SHA256 3db6acd5ce65bd9f94d794137e4c1923096ddd0d9e52e35491108879eda42158
- MD5 07ad0c99d60c4245c72c44f67f18e787
- SHA1 a3e1ec045cdc454f11522281f8608a139093a0a9
- SHA512 0dd2e47032cd2cd4086abf9fff2e23beb50a0bc02b80f38b7a9f6f3797cef6359c0b1fce33111d73caaffd81c66a8f3a940b3a9de761ae6abe2786665f817159
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RN4g:A3kMjKS
- TLSH T15F15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 895KB
- SHA256 cd0c47120e030349a8f92bd3322d625767486a1df5dd35cec9ac3988acfddbd5
- MD5 21ec4cf986fb92a48dde5f29788506dc
- SHA1 a81035020803604350b158ca95561dd6fadd9a8b
- SHA512 c34dfb42014c384e074b1464274ebc3bbc8f37ec42ae362d9ba068fc30aeb2b129dfd5e120cd44bc14ca1fe3255e34d53f0f9d07da6311daa510e364a148884b
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNXI:A3kMjKj
- TLSH T16C15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 895KB
- SHA256 83c2ee1a51d41a105e978dea7409010c38301a2c023a69a5f1492aa9e7dd58cb
- MD5 80a5125687b02de5f39e98beafe8ff8f
- SHA1 cc22218caebece950255f8b63616509e1262f594
- SHA512 801d29fcb19ffa0fd4027b125da95962d8bcdfc5f277575c15a270ee29e0ca97b09dff1e96ecfcdefd5da677cb2469ccb0fbeeed94247259f5fdca248c0f29e5
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNdo:A3kMjK9
- TLSH T11615BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 895KB
- SHA256 0dd9832286ab09bd2d8546fe8651c66c40fc6c1dd36684170f8cb6cf6e94ae79
- MD5 fc136c58354456f6db4173245b14b2fc
- SHA1 0dd600e5b6dd40479c28a109fdb6220182639ebf
- SHA512 adcbd5d46a00a1c464a77d47c21b50a74d569062780da9d9a8f2852e7cdf59520ad4e51662b0aa0f8d51f077ace10dcdebc82cb90d212b26579d6f1b9ab6a4a3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNO+:A3kMjK4
- TLSH T12C15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 895KB
- SHA256 6812d513f6c0bcc4247bac35491c13d7dc751ec401b5e8b9f38137245cb935d8
- MD5 00860e4edfe1e8d0102355c3f7d96c75
- SHA1 3908c213e89773f6c9f92014267bb357b2c93b0b
- SHA512 59e25d4aeb641ec8f0dc39396bbe2de19ea755cd8ba3b00b9c6f7c0735e5beaa48f9f4d1df23dd600031cb7c89c353b3a47d11d2aef58cc1a85224e6d90bae80
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNOQ:A3kMjK4
- TLSH T10915BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 895KB
- SHA256 62c568172d0d99ad73ae37e6ececedf33a0f4933b171229c5964063c0e75a2c1
- MD5 5fab7d4ee8fe2cd16c63961ac6a67349
- SHA1 016e69d7708f4e267c725a9edcaba26b39351167
- SHA512 2e179c9b7d80803b0519758af2a8e41be1707e5c48d8494d0894443bbda2866a4ae2ad3e3569b7b8caa182cb56bd89f088678ee86b4f4e3e4c905fb5f48d3e41
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNvX:A3kMjKI
- TLSH T12015BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 895KB
- SHA256 f0eb8b2ffa4d35496ec7e523931a01a27ac4c93543f501481b09f4f35c67d549
- MD5 c097b585f0fe07ba9a9b40e3098e61d6
- SHA1 becc03fe7a8a004d32a0777fae492ac4709c2a05
- SHA512 3149557326f95056ec8de6c64f2d115864c7a9ea218479e208b82fd1414503beb00399312838854a330739220cd1a3c66610074dc72aac4ffa81e44905b3d90c
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNlL:A3kMjKa
- TLSH T18415BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 895KB
- SHA256 c69c75c52dd01cbbadd5ad9ac02740b93667b57277b67ee32c10131957a3083f
- MD5 744c50ba4c29ea811a268d6fb8cfa03b
- SHA1 205943f1cbaf2b2adeaf7a2310b4eadf1368f02e
- SHA512 82c952bc7190abf5902b6c7d3ec65a03d43fca7408b02e01522089010e7b3558202d2df09f290841e600de0af487c06115f4d781b4748c83884495ba0f65d5a8
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNDM:A3kMjK3
- TLSH T1DC15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 895KB
- SHA256 7142312204d77dfed74ea80b12b539215ce27672a0c7b91a56a3bf7647d2e77a
- MD5 4a8d6be2d683f8719f167674411aa132
- SHA1 dc878a1f9a64fa448d49aa302fc43e43ef9eed50
- SHA512 9db7113d2da0957abb7d311976b84c585bd90906dd648e0ecc809f8c058d9f112d0e5baa6604834fe43b53366bd40cc8da7719570d6dd796c59a5a4551b7e219
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNEh:A3kMjKp
- TLSH T1AA15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
- Size 876KB
- SHA256 4e9763e9ede2634b3a79ebaa1cac24ada5ed65aef9ea2d13824739badc43c9ad
- MD5 0e4a070c17300e7c665f2cb4af807fda
- SHA1 8582cdd785b39cd2fcf29948df7c7c153dd4e754
- SHA512 51d1d751e8b88ddcf270901a6a197d6c3b3c17188efcfbae62b3c29bbdc6ae1c145dee56d81b3d0c57723d87b662d41371f84bf88738fa3bbedefa900e1881bd
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5RNv+l:A3kMjK
- TLSH T19B15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH