Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 08:29
Behavioral task
behavioral1
Sample
2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 915KB
- Sample260716-kdswxact2s
- SHA256 8f7530d01ad15488df509697227c5eaefbcb6e0ef045f7b329e0d509068dda47
- MD5 026214f4cc2bd5be16df85b66836857d
- SHA1 1b4eabedbf9c8844796a331d6b13828b19202210
- SHA512 2c5c85bc7382dfe8fd8fc8aeca5703afd0fc01b3b6246129b2300b01d864a208a476a5e665d387a77cfe8dda4c1f691bc32104796b1b993aae13152500a44fc0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvC:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvC
- TLSH T16815AF03E7A410F5E56B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/4180-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4a9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4180-33-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3552-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018992-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a6c-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-568.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-636.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-773.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-835.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-965.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1064.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1101.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1165.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1191.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1235.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1358.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4a9-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018992-210.dat aspack_v212_v242 behavioral2/files/0x0004000000018a6c-211.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-250.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-251.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-270.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-367.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-568.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-611.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-636.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-748.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-773.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-835.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-879.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-898.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-905.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-919.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-933.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-946.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-965.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1014.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1051.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1064.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1101.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1114.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1151.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1165.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1191.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1198.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1235.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1338.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1345.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1358.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3552 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4180 2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 3552 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_026214f4cc2bd5be16df85b66836857d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4180
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 915KB
- SHA256 8f7530d01ad15488df509697227c5eaefbcb6e0ef045f7b329e0d509068dda47
- MD5 026214f4cc2bd5be16df85b66836857d
- SHA1 1b4eabedbf9c8844796a331d6b13828b19202210
- SHA512 2c5c85bc7382dfe8fd8fc8aeca5703afd0fc01b3b6246129b2300b01d864a208a476a5e665d387a77cfe8dda4c1f691bc32104796b1b993aae13152500a44fc0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvC:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvC
- TLSH T16815AF03E7A410F5E56B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 e1e733b6181aab65fa80deb49eef07e569fb349f47bf96e2eacefda7f3d3b454
- MD5 b97c8f215f6f6140ec834b8d1972ee0e
- SHA1 f590d73f5d1201fe13aa7d0d28a19e3ecb061049
- SHA512 71109307c042f5f0149d3e1a4f492f4d19cff8cc447c1effb78899287b39ca69a91ab7e78d46dd4698cebef79ab847100e8c83552efefbf45d2367fd90782395
- SSDEEP 24576:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvC0Le5ji0hmxNrM:A3kMjKRTPji0Aj
- TLSH T160657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 929KB
- SHA256 9dc6d3621040374b87d63ae7572f7af8d16e73520954311a4fbc5fdef1a38618
- MD5 dc245c0ca422f1ab9dfce32de869c703
- SHA1 bd944cf3312bba7a9b351bcf2092c8af40f0d445
- SHA512 353503e3c3fb5a214fe994344142de8b9f6a5cc3dfea034bc002af007d798dc8542573cb8aecb2e892d02c078955ec3e2ea8e66f798c9f85a7819ca7593dfa3b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvMa:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvMa
- TLSH T15815AF03E7A410F5E56A823499E54A12FB75BD621B60C7DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 963KB
- SHA256 789cb8d264be87e9b5ccaa215b9ec84713bd19fd601c15a53aa540f4209d0076
- MD5 b807a85781676c694bebea2171df163c
- SHA1 3d19932f78332dca1ec464d93d59723269fecf66
- SHA512 f62c97a1a7daf7b4f74af01da2bc35495a27f4a71ce3378b61d65dbf7dad4b49a3929b72fc0ac68589bf1035d857fc347e0fcc1868055f6de22017d87bf4223d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvnb:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvnb
- TLSH T1BE25AF03E7A410F5E56B8630A9E54612FB75BD622B70C6DF235882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 938KB
- SHA256 fded57227a00f2ff56ea3ad73c55b09a809e2d4a172ac2ec02318e98f873580f
- MD5 7ca548aa436b100d6a0a942ba32548b6
- SHA1 dbf38dc022a9e6746434682bedbc722d55437d49
- SHA512 282f2d244d34f6a80786cb0991816261913a302d19e502c9a231ba3f0bce3e3b8b84eefe8e36524d7c8304411d2d3493bce4852e4fa079afed39449d6298e150
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvGZ:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvGZ
- TLSH T1D415AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 938KB
- SHA256 39cfa7e97beb4e569b4aac0418701617486d09eee8f7c3d412cdcbd42db0cc0b
- MD5 5d5529f0ce46e7327411a3817a37e735
- SHA1 23b16f35f24cd29eb178ace7d86f59b5f6bfb4fa
- SHA512 6ccfb09e1a4fc1ff5905004f19d69377cd04148c69f3fc0f83bc46a488111376aa5a5c383f4c6198c08c317e2c9c034c24dd7261f5af81994735339a4de5934f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvx1:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvx1
- TLSH T14215AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 938KB
- SHA256 75f2378cbe9b21f5b0e65e79828ec0794d64605acacf4f4d933af58bd53c92be
- MD5 683a1ff8e7f84e8e95d50de8f8c49b2e
- SHA1 2b0320a1e4d1b08b7ffaa477a9fb3e8dbb77f979
- SHA512 b0e8c72c767765ffa7776ed7a8935af4f71b7d22e9d293bad00a81880a4a08198c6fb041fef356ab89d7e0a491e85cdbdbf3d5f1275d600d1a71047488f27e81
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvl6:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvl6
- TLSH T16B15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 938KB
- SHA256 f5220a86bd72ba1b3e3e0194c82a8886665ba2f3e5d08bb24bcced031c3aeb6e
- MD5 59ed3a3e76bd47bbe74bfc2060277982
- SHA1 e4d840283be7dda5a00402918f8b7de3e1a5f2ba
- SHA512 d8ebe50a9f6432349482541ebd659ff653bc50eec440c1205488dfc7f076bb7e9fdad77b613007cbbcabf296c4b8c8819bb59c5c1bfde474e00779201e0271bc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvbo:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvbo
- TLSH T1B615AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 938KB
- SHA256 a2f963404b2648565051bbe0fd0af1a64201296a6d173da2611f36e7bcb0f57a
- MD5 cb70389c9d8ee01b51903d1c7cd7ecbc
- SHA1 4bd24fa69cf6447b155accb4fac2e53a87350008
- SHA512 0111f571a083c4d6f9f906f9f1565ab6d21dea4465cd8880b2e67d089bf995ebe9315806a74c0d0880de48384cf1ea7dc14fb5f5304181a3d72aac1bc6d64c58
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvPu:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvPu
- TLSH T1D115AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 938KB
- SHA256 a39fc9b6ef06ef0474f9b73fc9ede98ceebac7d68b5a51257041c32ed59683eb
- MD5 f823188196441c9d222c771fa38e85e0
- SHA1 28604a7b77f1f5c24be5689b4b107e8ac15bb78a
- SHA512 08ac201b4e190a52913c4caeefecd2d810200a9f123706e4451d395f81ee5ff35d6bfaa9aa5eaf8f485ba3ba385982083582df3f035094d392ab76e6599552b1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvd9:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvd9
- TLSH T12115AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 938KB
- SHA256 e306eba0ec25b3c58cf3625b0c1f4ba08daa76e0daa3337c96222e71efe3f42c
- MD5 714252a1040983d62a7861860bacb845
- SHA1 461ee939e16cfe691a289e8d954ab093b3525eee
- SHA512 9256c2ba76e695560c27e755fb349f53a14f3f441a846d45cea71742fcdb763e2ea63a052815b3b4c1e360250f153d54627d15bb7be1545930d8f173f54b7092
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEv5c:A3mnXoZjzyaEFyKUlEi/wzy5ldYEv5c
- TLSH T14E15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 938KB
- SHA256 6f2b6496281160abb0f0441567ad57c8d0807a0710065a34364aef63b7a019f4
- MD5 3c8ef0d4a8dcd55cbc178e391df2cfab
- SHA1 1d414cf821cddca455c704a8f96a64fffcfebd94
- SHA512 4766aa7957b406241a4a4788e9441d4c6437da76efdf9cfeb13a45014aee8ac727c8a365ea6246a8406c1cc8005d4ccf4cbdb6d5293201cae966f4c38a70e9df
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvyp:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvyp
- TLSH T1FF15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 938KB
- SHA256 bb6571bbb71c181928036582a7d5f2d419f8fba70db306c245f689b5c42f6a9a
- MD5 37835e47fed1bb2ec7682917a07c24fc
- SHA1 8ae2266c2f2b2ee7268868cf8b192d94d876f011
- SHA512 ca4aea0480f0e9ce9a3d5a782554c83c757506abceb6b6cfa626a7d8a9485b3f59dfaf5a800236920a536d7e4f76a2f7cca5ceec81e5ced1d1defb35a0a9ac6b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvF0a:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvFN
- TLSH T1E915AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 938KB
- SHA256 db375e03b38a6d8752bc49b4b74ec87983f39a8a090bfa15b6596ef1a50c1a43
- MD5 f7546eec4c2e2f34b399abd5c4d1c430
- SHA1 cae17da07ee78c42ebb82b98afc47b22331699ee
- SHA512 84ecc17bb35675e21001ab206f7da8270177a0c15f45983a0544287dd644d4279d6f9032ace9e5779ace0e27dd3bf9666c821528d7f08335af73a87693e8871e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvXF:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvXF
- TLSH T11D15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 938KB
- SHA256 7023d6800652ec3b1d5b6a8ee24177f227f9f09a758825fe104b53a615b056a9
- MD5 09f370e88c127ce6a48d8d28100d1b73
- SHA1 0c819defd00638c2ea5133e937dd30048a1e7366
- SHA512 437504c7e0ab938ee051a183dee356d91349e8fd5136af4a87779e57d5c62bb537924c8a13aa352145a387789f8be3db2a0c66a446858a78332a2c90a7b8def4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvoC:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvoC
- TLSH T15715AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 938KB
- SHA256 379e7cedbdd62b19cac0966b33cf8169580517079dc5e64e7fa62167e85d7984
- MD5 8daea1653cdc89c13e915726001a361f
- SHA1 c0f23fb644a9aebe1c9720a932a9b7b001a461e4
- SHA512 58b443b80b370cb28c723dcfec9c0511c3003940ca318a11a2780233c0fec1b25c97a0adee2c91bab8c3509590f0fe22c614121f3acc3c80cac8ccb0c1a43707
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEv7w:A3mnXoZjzyaEFyKUlEi/wzy5ldYEv7w
- TLSH T14815AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 938KB
- SHA256 4f993f3d4a74adbf313c254aad5908ebd66a246278fcebc37f3fdf00080e2a02
- MD5 5f61d7127f8a8b05346b7bbe448e5448
- SHA1 9af96aca7a94389e4951c4b97406c451870fe047
- SHA512 db282d90c5ba2dec1df77274b585b61bf41b570ccf83f97528ab7a44a9d40089c17b506835f127f02dbf9fa9311c3321bbeecce660f1b648313fe9d1e218c19c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvCT:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvCT
- TLSH T16E15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 938KB
- SHA256 7b9987d7fbe7d7b50d87fb5d6335c8285b181dc08b15331c1a646cf4a07a458b
- MD5 7e7a86d3f0ec850ff2f9c4dfd5080009
- SHA1 dbd62c074739d88589b6e129d0336af48d0082b1
- SHA512 987a4ea9287dcf3b9c487b1e7f81b9e681a80e23dbe4692dd6412f6a935ca68e390ecf49f6b198b426a344f23dd5f84938ed7d55ec3ce5131d1936089a4692d2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvSu:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvSu
- TLSH T12415AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 938KB
- SHA256 1402849e97dfa0466955960f808f00cc029a3a96197be46fb484d819466752a8
- MD5 6a6a345f3995295888c359e95a13b972
- SHA1 804b355a4d0513149ea0f834efc6eddc33ab74ba
- SHA512 941e7f6be2e0dbc10145b959abd7f8158f98f9f8f3c3d872f9779f3819d074a630b934d3793b42b922c38ab05305146a34cdce71c6f123dccf06b5542d926d40
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvMb:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvMb
- TLSH T15D15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 938KB
- SHA256 c5f52ab154b624aad96a1f1c2ba77edc90046c54aeabd2fb8c09b920649cba44
- MD5 da2b0cc8a8a4b782dd7cb7961c241288
- SHA1 74399bb9ad1bd4628f04539c0d997a4458f5f8a4
- SHA512 ebbf3b1bb40b9fd2036b853430fe8e31f52a0d0b228db27a3aeb72d294a2b9134e8de34512a707b72cb955cd1ca4a98e14aa90df59a76e0625b2da0327805c4b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvyf:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvyf
- TLSH T12E15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 938KB
- SHA256 1b711bf4a1498f03741d8750a64a7a1e73eb597386a4248ffaac232d1317b214
- MD5 b4335ef3e8407d195ef6a1f48cc05804
- SHA1 2f1e010ae14339e47b9c04688b4421e291ceda9c
- SHA512 0fe6fe3883ee616298992db42acf9c739dd30ff98e5b25bf56b8cefd665f4306fe015b007d7930f06a9dd785ccf3f21beaaff4a5b607d176b2a7e31dbf33bcee
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvfK:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvfK
- TLSH T11015AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 938KB
- SHA256 da36c4de9f71e252fcc6bd6bd322ca6377542fdd4e44f81bbc8716c4161cd5da
- MD5 14888108825d25576475cb9fd81e3a20
- SHA1 e4ac9da80f2ad0349a139a364759035e93b9cd1d
- SHA512 dee2841e94f62d71c43951e266ee04bcc808bb05b58843115f68c2452fea51f2e60d0be3d694e867cd7361535dd460e8264f2b3063ec830eaeb87aeb632c84b9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEv4k:A3mnXoZjzyaEFyKUlEi/wzy5ldYEv4k
- TLSH T13915AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 938KB
- SHA256 58342e7191dcfd9c1a7063dbf2fd477af63c70a9eaf4399f5ef4f91235abdf76
- MD5 254aff70c9f10ab8c8a9fb24e9ab9394
- SHA1 bde639215d371cd6363988ff6c32c4331c06c302
- SHA512 69b8ff0d8be3edd9e31d09c6b14cc6bcee1b2cdc57fb3452a067f54a603a10ae5ce0459a7bdacdeacc593643bb611cc237dc37bc42f48fb0a1f9f8abe25f6a3c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEv50:A3mnXoZjzyaEFyKUlEi/wzy5ldYEv50
- TLSH T12315AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 938KB
- SHA256 859fca96defc5116602d06478a0cd573173ca4dbf08fbb2ada642a4d701cdf19
- MD5 fb51b43d3a5361d59bcd89e7d8bbab49
- SHA1 8d55a63268d1ed5b7f69ade27f595f94d3f9d7ae
- SHA512 6cb409ccb8318b1364e339b1e744b01cb826ea08884cc408dfd609a89a0e54476f6bb0561237cdeb734bccd95d5a45165bbfdb2d812c3c6a1574de23389a2799
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvs70:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvsg
- TLSH T1E415AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 938KB
- SHA256 23e680119bb328209f0e87a948d1af302ea315174721815194af2749a2115ecd
- MD5 41c4f660b8457fb35565cb8d966617b8
- SHA1 9b673db5b435bb285cf70a5c9c50e49430953e27
- SHA512 47cc27e07e2dc18883c4ebc7af440db9e68416dd3a1e6cf9c97b1233a4b1428cc2c824786015a7bc50eb71813ef44fc323ec86f40a9c0e9ce51fe216e57b6404
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvJr:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvJr
- TLSH T18115AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 938KB
- SHA256 5e94c4a0221e7e24ba851cd73f11ceab731e25a71abd0be51b35e0806825d020
- MD5 a3a1ca8de549b0087afd23e34a902dab
- SHA1 efa4ca981b73abe928e6949f6acf64e1778abe03
- SHA512 41dd38446bb147059ace457313c8ed21ad96c5b87b79c334578df3dedf086930151815cae6ed52a25afe46ac3eaaa86559a4eec281b148d24f6df8573b4867de
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvrn:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvrn
- TLSH T19915AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 938KB
- SHA256 dcf8d71168af5456432a4a11bcab2b99311e8d1820d69e439eac9fb402d7aa6d
- MD5 5c80c0a8be272c4feb94f070efc2293e
- SHA1 e58450494311a92e0573adafafd99f77b6d442a8
- SHA512 ad265d306d7d0ba1e0c9223108146a3c7e5c57846e1576035eb4586a18b27b9664c7f2d49ed3d2bb10cc64a91fa504003149de04642390dc7348f4c422c8476e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEv3x:A3mnXoZjzyaEFyKUlEi/wzy5ldYEv3x
- TLSH T13515AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 938KB
- SHA256 60abcd3e3c09bc912fda830297b5c42e300efe99118a513c9f9986bf472e55c3
- MD5 e0b906597a1a5c40a9aa68fc4802aa85
- SHA1 1f3b64ca9ac94e0ccff74675c4a8ac482129f829
- SHA512 f14d5b48d8609ac064aaf53978d0b1038ce4e64f7ccc122f2176f5750f2f7f32aeebbaaa6590e6706f3c121091b6021520a29395324def7386c25f8f958354ef
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvtA:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvtA
- TLSH T1AF15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 938KB
- SHA256 66e59c2fffd57959975d8e207d24407aa3717edea80a2e6fce433558d8cf318f
- MD5 60b8e2e45552a7d6836f9b5f898242eb
- SHA1 d760c6a684022ed0d655b51243849d8219668c9b
- SHA512 ec0263b52aa25c6911c4260c1845acb9e9bcb2cadf7d58478d23b2a0a8cfccbabd15311ad465ae6a48d17dced354153bcf085af507a2c2e110ccac30d3a49829
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvm9Q:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvm9Q
- TLSH T17315AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 938KB
- SHA256 4da8ee13e56485465b4e377f29062eef540dd7bf597a3450e8020a8b323e8b97
- MD5 7be8d307fbc36c2417b7922f4d6ef6a6
- SHA1 fe30ecd49d747ed9612ee88490f39ff45af1a5a9
- SHA512 6191da7e150787c6dd707c4394a4a437e7965d7700cbc0c3af631988f160356b32b82ab7f13c82415e5291522d3f9bd7fc02c225046cbadc15f34fa1432fed94
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvD4:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvD4
- TLSH T15115AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 938KB
- SHA256 c4ac367dd0ecef29f3aacee9778ed4903a2133ce68b0ab44fb5d6ff79862bb56
- MD5 3943276c329bb54730e6c6e977ac9f9a
- SHA1 ba277ddb06fdd4b2cc9039a26879f06aeb3f61d6
- SHA512 35c28f43081daaf6364a198e32183f715e57e70d0417f975806bc96b51e277eeb96267bc0944f3f9cbf40ce80107e2b14a807105c7b3b7a3ec020912488b1d23
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvqu:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvqu
- TLSH T19515AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 938KB
- SHA256 d1f29f6d4451b45e43dc692a725ce49482e0889808078755a0ed66258d7c08e4
- MD5 60bce0d595fcc5cf18e656a2284ce045
- SHA1 9d869983236673e25459503247768ccdd17b917e
- SHA512 082e9d703b7a2153c928fe26fd506bab0b8cec87be9d00e2ddf9aec8e3ee0250604046e19e22b83b2808fc46680d7594e1684826e46cc26f7120ef4a93b10e7c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEv7j:A3mnXoZjzyaEFyKUlEi/wzy5ldYEv7j
- TLSH T17815AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 938KB
- SHA256 606edbbd52ab3526e199fe953dd1c7bb96cddee2b7e1f699a6f94ac523209b82
- MD5 19dc92644d049f4f884cf8fa224bdccd
- SHA1 24436d4f8e10719e044065797e967b3ff0c8a3c6
- SHA512 131b44760b9d3adb8d774e109e8c0ccb916cfd4d4cd3bbdd4c5e65629e3ef73c93744be2e4325e35de2f7d70c69945ab3ccd5eafcb572d8dbac5693fa0a2ceb0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvGg:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvGg
- TLSH T1D315AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 938KB
- SHA256 fa3ad23ddc1cdcfc6d4ae99ae205d0d9b7b4d962d3a1ef5e45c8e35e8880b57e
- MD5 eaac72d8c9c6d8f37cb672709eb2cea1
- SHA1 2fea6f4400c72438516604485ae5ac891191f554
- SHA512 3f565593bdb4174e957afb8b2cb4d41226067df3e146e92553e6145b3105f0beb6023b4677b5361eb04c07b2a004540d4f3d843578027c9a2422ee24c90e533a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvpI:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvpI
- TLSH T14A15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 938KB
- SHA256 733939416ea77eecc859a114bca39b5e0c17660f4e1efb87c9afab82a1bcfdb7
- MD5 e583c0f575fca0b1200d3bfa876c21c1
- SHA1 70f2a1b5a103091cca0b60ffb8caab9356a41b5a
- SHA512 89907d74ac7885e8b543080f82a2b8202daa4a4896d72a47401b4cabe6dee26560d6e6a7e1615c7b1414fb997332fcb9c68010845a847ca939ea5867cc176149
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvLo:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvLo
- TLSH T1BF15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 938KB
- SHA256 877321d4acd2594d666001372d5fe95a43526ba206b5209f96278204786ea632
- MD5 2e3aca7e79c9820ef7c5a175c717ebf2
- SHA1 81374f0c84791a6c8ebbb6ed556eee167f89f941
- SHA512 d0d968d4ce3d934482c379e998204541f51bb6781c0c36b4e81114351db131455ade362a238031c2226a292457bc7a7e36fe4f2df1419b2e142fc0a6f0403c21
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvw+:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvw+
- TLSH T17215AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 938KB
- SHA256 fffae6d80bd09ea6840c49e99233689e075061d26219e8611b80e5b884d85f9e
- MD5 325dc6b71f0c1c9aa6e8b25e9920020e
- SHA1 08a2ffe30540e9bbc77b6fbc246409f7e1d6d9bc
- SHA512 86cc2e7e89790f28b09dc11cfa4b434f33d8a629dc7ca26ed50d785bc2a4e6b508f8e231573f3f9f2ca7385a5d14b14e3bb55ad00d1700f960664c7bf990046e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvIQ:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvIQ
- TLSH T15F15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 938KB
- SHA256 2b439f276aef4735045de44b5713b56e16cf6d81498969e5d6c86d5241c41534
- MD5 37cb8e2102c3b18e0bea3c67384f83d6
- SHA1 7329715bdc8a68de7a7ab01b2b82f9aa334ad96b
- SHA512 fd1b795bfd657f50ca97852b56f697341c11626e4c67b44b20f7e8d7f6a85d81412b34df3d6ac500ce3e81a64dc28a599c4e83ec9d7c9f34849cffab05e08581
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvBX:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvBX
- TLSH T16B15AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 938KB
- SHA256 8b1a80a5a7d52a783836d0794e75ed15d43a4fa2f0850d3aae1057fdd3e09a29
- MD5 2634bf717e3bd7144725b12192963371
- SHA1 8eea2d4bbc6b1433d171e0231225e08b005e360b
- SHA512 40b82ff7a62f6df42ee46d0a4f5afd4bdee34faf9a00c38762176f6472cdfe6770c4ae08a91e003b40affbc8714ccf8660434f81d9abc5eea20df44acdc7b47a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEv7L:A3mnXoZjzyaEFyKUlEi/wzy5ldYEv7L
- TLSH T18015AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 938KB
- SHA256 f07ddfd8ee237a56b2e5f6cae0c04c9ad8b1cdb81640954849489bef91f3b1fe
- MD5 06fc73fa6bc39b8fcfa588c1b5715e84
- SHA1 a3f32ffe4164e455c0b1c9ecfa1c4e6f5e2edcb9
- SHA512 d96d32c5157240e9b46d7ecd27403c7771b3993e03e6abe1d64b6dfed3461657cb6f45d45c3881962b194d5921ba284c2ddfc8f4039d78bd1eb510f7c36700eb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvBFC:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvBM
- TLSH T1A315AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 938KB
- SHA256 ea3bba6e07b949389e538f6ca51f13688ce5a9fcc47e5a198751c0fbb6e0de53
- MD5 7f961f7611bee7ac06e293883f648dae
- SHA1 4ff1fb8fc2bdd8b45d205daea1e3a0a9ea9a45ff
- SHA512 7ffc6fc9f476d688383c2599cb2b2074631593b3a50b9a76474558d1439aacedda3bec89250ca07697fbc15e0be6d72fda4ae783a886ca70962abbd9faec9406
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldYEvqh:A3mnXoZjzyaEFyKUlEi/wzy5ldYEvqh
- TLSH T16315AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH