Analysis
- max time kernel
103s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 14:04
Behavioral task
behavioral1
Sample
2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 905KB
- Sample260716-rdgbfaaz2v
- SHA256 2c9aaeab97808561e1c5ff41ad1ab883aa7aef2a8f910b48191c52ba03d43525
- MD5 81613fe8c774e065ffee2d1e009519d4
- SHA1 0d9c814c8946be4d29403e1aba3a846e1dabbee2
- SHA512 a111bb1a4e871f964ced96ab76cf21cc1b68d7780785bfa39c21ba1b19011b50d6738f3740fee3329e9bb052a049deb488ab51fe2de2a26df5ee930c3059a39b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8SGoOaRaidc7Z:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Z
- TLSH T10F15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/5156-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c5b4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5156-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5420-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-35.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-273.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb5d-473.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198cf-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-590.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-688.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb65-786.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-914.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1050.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1081.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1130.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1243.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1396.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c5b4-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2de-35.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7b-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-273.dat aspack_v212_v242 behavioral2/files/0x000300000001bb5d-473.dat aspack_v212_v242 behavioral2/files/0x00040000000198cf-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-590.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-621.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-688.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-737.dat aspack_v212_v242 behavioral2/files/0x000200000001bb65-786.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-914.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1050.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1081.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1130.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1174.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1243.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1329.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1348.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1373.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1380.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1396.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5420 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5156 2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5420 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_81613fe8c774e065ffee2d1e009519d4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5156
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5420
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 905KB
- SHA256 2c9aaeab97808561e1c5ff41ad1ab883aa7aef2a8f910b48191c52ba03d43525
- MD5 81613fe8c774e065ffee2d1e009519d4
- SHA1 0d9c814c8946be4d29403e1aba3a846e1dabbee2
- SHA512 a111bb1a4e871f964ced96ab76cf21cc1b68d7780785bfa39c21ba1b19011b50d6738f3740fee3329e9bb052a049deb488ab51fe2de2a26df5ee930c3059a39b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8SGoOaRaidc7Z:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Z
- TLSH T10F15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 a490f40c0a65c10060c6f5b5238dbfdde233a6ee25b8f0542e64e5f7f9e0576b
- MD5 0ce065627f63177206dc6aedbd9dc24c
- SHA1 ffbcbe3d94751ac066b330e19689edd413681305
- SHA512 5e25145c73d43f4853f27f0f4e32a65749aedbf48d63f04067067b53b95cce32dbf8ce93b8ed3a96426a55b4c4953543e7960de7389d31ffba6753fec83d65bf
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7F0Le5ji0hmxNrM:A3kMjKJ4Pji0Aj
- TLSH T1EF657B17F6A402B5E077C178C9E2965AEB7138521B308ACF1398C7692F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 920KB
- SHA256 81c28cb18676ae1db4370c4e47902b6ae2aca1c3f2432af763c2bb4af3536c5c
- MD5 10e6d17e418f1e773c3233a31d14b677
- SHA1 f435a21a6956091fd1fc9fd740a9cc3dcd4be5b6
- SHA512 f8ee246e1bb4781ff983a97cb619136d1cac2370d86fe31035f787b3ea951bcb64c14e0818af2f914b909294ebab24bd696f878461d075af0b94dab6f265ae31
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Ha:A3kMjKJ
- TLSH T1BB15AF03E7A410F5E56B823099E54A12FB75BC621B60C7DF236896252F337C0AF3A765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 953KB
- SHA256 9086d85237249ce606ee74626525e0400f5bb4c52a61105ad9e39028e55549bd
- MD5 1bc0e281583bd7df3dce12ac92029619
- SHA1 d1081be24d33fbf54644fae3ce457adace05ccca
- SHA512 ab5169fa26de37924cff0eddf34c05b26b9378c5a266c90a75a79ccf7d08675fac49201653ce19f814319acbe29e897ac9347a1ccc87978cfa0033220140deaa
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7kb:A3kMjKJBb
- TLSH T17925AF03E7A410F5E56B823099E54612FB75BD621B70C6DF236892262F337C0AF3A765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 929KB
- SHA256 5fc0f3b03a107a752616f4d235d5e5bb55b5a8fe56bbc0e6df50a75a075372ba
- MD5 9125ac4758cf2add8e94552969c05e0d
- SHA1 4c3253a1d84bcd03ce6fa0c41bd934ed3d317ae8
- SHA512 f87a428759b46dafbafb0122d6a166c297f1b5165b95ea8f0de81c6e79af8f33a5b7a906d14d46d13a6bc9c68e5ce4580eaec73fec1b473dd4b16d7b9d09d413
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7G9:A3kMjKJx
- TLSH T16615AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 929KB
- SHA256 9748774398a10a2c00f9ec2414001f81bca9b697c260287c07647a463b480c11
- MD5 d8041a48600b881d23a01e1364392983
- SHA1 513659090a616f60deb5a2b2e3710c78488f251c
- SHA512 ea5e7a29ab23f4c90d2f07d802280ee4c4b6ed46ee78f87aea23a88aba6998de1b9e0fa49a594eebfd05fd2bc7cb395d45b04c905f40e588cafe07544b3f94f4
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Gc:A3kMjKJE
- TLSH T1F515AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 929KB
- SHA256 c76618e29e194c28da9b1fe0c37e4ed0d09466ac8930e27bf9ef54019b88771f
- MD5 9bec5790390cda4d0d5b489f71b93e67
- SHA1 8afc9edc00956b5eeef937ca6921d28d530db67f
- SHA512 92c2b7cbacf71dfc071558a8e3be455085bc9bc67731121e8320649bbd500798baf5770af131b045aedf60d9671dc19cb5dece8283756d5f6873b519ed0f722d
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7/p:A3kMjKJS
- TLSH T1FC15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 929KB
- SHA256 86529838ba3ea3c9ab14f351ad83ace5c9eb966793dbe4903d6831292b862411
- MD5 fbf08d3e619b83bba7a8d9111380016e
- SHA1 0d37afaeaeff759e8b74e6a59d38e0734907d432
- SHA512 1e6bd11bda23afda58746bafb5692a27e5fa7099c541e1d31750696e60f4b2a7d6f33c2dc1f787916c07f2c8b1a252c2d7f0ef63b7ebee422756ac8d01a3ea8d
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7gN:A3kMjKJV
- TLSH T15D15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 929KB
- SHA256 e64d7a411326e7fb24c89da0506269f913de518abc649e933c00f1678760c0cd
- MD5 b5db5ceab791e26652de840e742f7dba
- SHA1 45ddfff2593a4e5018b9ee7f34c7a516a9de4a97
- SHA512 1c283c5a6f9c4487c7dda3cf35179c52362a1d2fed1e4415575f194eb7a8f4ce13f9dd9551f3399bfd21e079594d160917666e1e21c680e2b5decafefce03c25
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7oF:A3kMjKJf
- TLSH T15315AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 929KB
- SHA256 528266f33cb0936e89885b873d5521d30003214f451cd22262242235f39ee72e
- MD5 d0531c1784ef1c12472d0b2dcb24d5d9
- SHA1 8d1a1f66be0673c7b305119cbb1e8d1560554821
- SHA512 1e1f9b7e530b55aa73fc126462d3d99732d876c5df16442442a3a4e380f093a640034e1c13852b4d72b371ba89b11e70e6b63f1c6c17b92f50e176f8b30f4aa6
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7dC:A3kMjKJT
- TLSH T11C15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 929KB
- SHA256 8a5bfea4199de4bb1ff7ccd511a332a3880fce4314aca8d776b43938581c4e90
- MD5 34928ec146e06b94fbc6608e4ad28625
- SHA1 3734fd6147d58c6ec1db3df5fd2c089a64732007
- SHA512 f2d4fc5738585624f17425d0ed219c4cf823cc05d7ae3b6c883e1079b87d630d86e6d735a0cff7c4d6a920bca14917ffe43106096256520f9411a479333ff506
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7mw:A3kMjKJW
- TLSH T1D115AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 929KB
- SHA256 3344923f940363a704de69685ff7c3e0d1e1e0b57039f85a19cfcf06bead95aa
- MD5 0c9b094bb6a7035fe68f53a2a3ce473a
- SHA1 fab6c0fe461b216783bde8f553fd71b50ab81d51
- SHA512 f072a362f04ff98251ed8c0912d50b3bb10b47169beddd6dd9c629669f2c06db931115d69749a0bdae67e110fd8afadd592feaf83d12ec849e8649fbb560a27f
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7VT:A3kMjKJW
- TLSH T16215AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 929KB
- SHA256 9467c3fdf54a1a99c7d91c7b65830bc49e4c952a68b360e2bcc7c9021ae6ece7
- MD5 f57e81c7cbd1a7da61e6d1094d9432d2
- SHA1 62d57141a444d4f5b677cbac7dd1f8e3bcf3afd6
- SHA512 3182bc7fa0d9893c18f83467d32dd66770db2a5719613c709e1491441726f5e6c5474b61fc8be5aa1b4491071ba1ca6eb68c6aecba1d059d8f1b69346be1b2f6
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7ru:A3kMjKJx
- TLSH T17D15AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 929KB
- SHA256 6dd510a3d79ed8bef34c3e5699171f1dffc691a5c95c5243798ea97f230d70aa
- MD5 cb123b23eb93842a6f377f858c2c97f9
- SHA1 ecac02fb8f9ef6f1649b84a21dfbd0a0e4031618
- SHA512 c18e5119d5cd32b4e07d35f0073e41e7b578a669bf63d47d269d1744a935f46721930a236cbfb72bd2bccdfc891b3a09dfbfb923c6f1db270a10a55ab1b6dd92
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Pb:A3kMjKJQ
- TLSH T15015AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 929KB
- SHA256 360627f3ff9a50978403b9632d3411334648b40d218c88486dd9583b2194f1be
- MD5 47b9e16c7fea9623a26e1f7f846e8ddf
- SHA1 10e446c65f12fb47d7128b8d40c52fd19a1ccb97
- SHA512 d3ff415907a0565a0f499c8a85ac33bbfa80c7a8bd08651c33bb51e571a5d7af37c679dea0c0a29131f95320af1ff0a9f5e21b5e7e6db0b6646ff5df2339abaf
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Lf:A3kMjKJA
- TLSH T19215AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 929KB
- SHA256 2414860d54813dcd1d8349d26d9a34a4457d68cbddc9f1ff2a5876f2265cf520
- MD5 d79aa9fd45b717cbce50c02d66ad1d47
- SHA1 a45201a37e8c8848dd39ca6682c78d1fa4840e27
- SHA512 52d68bfbbe2f9cbc438ad814784807a730b1291362cb7e38f33ac3c149b2e48cb8df50ab7cb25a8259c70d0f7838e3a10af34813b0d3a7dae1df031f35e1efce
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7EK:A3kMjKJg
- TLSH T1D615AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 929KB
- SHA256 fdfcc537ef7c1194dfc95d8800f0ab40be93cd65b085bed8897c4891206f4763
- MD5 aafd695c57420ddfcb6af833d229c356
- SHA1 8e133d7f26e0091e5bbcd2a4cff15fc9c99865be
- SHA512 3375d41f0b350dacf676a4e650244c3393b8145bf002d1f544c71ae379cdff0e9c9aa172a11d012b50cf9091ba2dfdf5340cd295746f6dea1f6aad0af37f3842
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc75k:A3kMjKJJ
- TLSH T15C15AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 929KB
- SHA256 f6f2da3646df4db04d9739c2064d6ccc751c0655a95f9d512284177ab861f1a0
- MD5 39b443df432e14669f8da42f69eff95f
- SHA1 b6753eb6ffc7c5e9d8822f60171fe56c93339aec
- SHA512 744cfb350aa774cfffc0eef6e353c8b208239560c1b3477114978e09833a0ae1a578a32b46d7325690814dd3b48a13e6a3ec8d5f6c2f3d57647aabdc0df63e16
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc720:A3kMjKJ8
- TLSH T12A15AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 929KB
- SHA256 48fc9c540c4fd6e5dc94f0f8a03f531b07e49b1b97260948304712493699d12c
- MD5 5cb828c77d9dae5c1cb21f251e63407e
- SHA1 0b1ab5e8c3449484b9dfc5645a11081c5f6be1e7
- SHA512 1837008507ede531f2cf3fff36c3b26db9879cd0476e8b413a8cee9641c284cce393ac931a4f3195bae0a291ccdbbf807171c70d0a22d262b9bb9f04673ce1b6
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Fg:A3kMjKJB
- TLSH T15C15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 929KB
- SHA256 395f2bfd286a052d846f24f0ccd713a895e596adf4076e3c12807e02b1e04165
- MD5 2a39795c30d6941cb2fdc342c1f727a5
- SHA1 694188b8cb13c28c3656041c6688b933a6caa571
- SHA512 b82475afb081d6deb5261efa65b48d0b291e2b847de9bfebfad54fcef90a3a2f61cc530181faae4dab0ef169e89509aa84d5a8aa37b8defbf5776cff8e073e72
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Ur:A3kMjKJr
- TLSH T10D15AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 929KB
- SHA256 74ebdccbb191c7029cf898561cca0fe38e7c02c891e0841ba2fda6916cd5a457
- MD5 1b67fe219ca1c70278d653d1e4a43233
- SHA1 755d6d2b049cde34d7d7b085969ec3e4a424eed7
- SHA512 e8d5faff35915767a9d85a471d32007141e9f8dfd672250a16d20e0d7a46b389b6443dd1a4a1d8001f92426bdac7a3f79105fae0c031158416667e2f5d65a05d
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7qn:A3kMjKJd
- TLSH T17715AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 929KB
- SHA256 35eba034c220e5c5ad38cab4de8190c8f993436d4686039727113bd05bed7246
- MD5 46f8524f4d9f47b8b86dce97a8a714b1
- SHA1 93ce407ce18a56c4b6da2032d71ac2d2d894222e
- SHA512 b0f579e5fd03951a8d1d9e9ab8afe29f52b8201269448a09c2b3dd3c6084751f0e66fe34277cf30a70742ff27b9e329ba3d888eb056297e64b927f1034a45c49
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7gx:A3kMjKJj
- TLSH T1A315AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 929KB
- SHA256 70bc301b23d7bde6086a9d731ac524233f82bec08958a1317c4ec9946e91651c
- MD5 f4b8fe97c859c5e9bedc18211044778f
- SHA1 d462c40ec511dffa6d2b33b3a45eb3eec7651069
- SHA512 4c1f92f015baaa859dfa995bed6279324b947461ccd30399bbb633c60ffca3874e7c6622da4e04ed678a74f2f5f4246313bcc1d861839401b9070820b1dcfcf2
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7iA:A3kMjKJ8
- TLSH T15315AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 929KB
- SHA256 8fd1ec5ff503e9962379d478bb361017fcde6caa4b63a50cc0add71c653c2aa3
- MD5 9d6b03b189be05ddabb57f360ba5c4f2
- SHA1 53deed5d4cba376cba0187c4c39bf4b1c0c6115f
- SHA512 a7f16d9d5b15bbc90c309c0b80b2d703f33aa1f0e048d83873433581e7f0bb9fa12c7697858a7d35405eaf3c7449240b1650437f9d4dda37dbbdeff58f4b5821
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7b9Q:A3kMjKJ9
- TLSH T14F15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 929KB
- SHA256 b6510de5900cfacbe3c4c8268d66322890823946c11ae27e6c148749bef8749a
- MD5 5aa5362c7ba2d7cb0c9ea5110b09691d
- SHA1 c79c467e4129b17b118d160ee390713fd63757c8
- SHA512 26323d7c1a1e53ef8e20462d3f44113072b8d207f43ef7904a4423c6b02afc8585b302120aa694843d9ca8a3ea2c6a04c96391c8e7db2b00c73177a37be085d4
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7q4:A3kMjKJi
- TLSH T14E15AF03E7A410F5E56B823099E54612FB75BD621B60C6DF236882252F737C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 929KB
- SHA256 7d3ab02923f644b3c73b617069de70b769d7d312293db499523c27fdd59bf8b9
- MD5 47f4fd8823ceac346d4913b2f60002bc
- SHA1 88d2166f7aa39d55673dcb7598dcfcfbaaf9038b
- SHA512 1260cec3b1f6f733d2aa1e5fe90b1553bc4c2f5cc6ad4e5c082f2fb3f53b66da28747f1919bdb5e5164fcae35cdbba85c1328835194793194fd2555a5a0d1788
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7xu:A3kMjKJT
- TLSH T16015AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 929KB
- SHA256 8621426d0ec8e88053759065feefdb06c3cd53c8e84f6220733b428513582a7b
- MD5 5303ba27d73979cc17c21c7197fd5509
- SHA1 9ce80fcf1131b2ffff99c9caf5eb238b3a98da33
- SHA512 e99d62a2856a9c38e13c6528e7bf788ff5eb94531cd32785901be2e28191696316cc9fe52b6917007a1d395aa76ec01b88b4310cbacef8e990edf451c5625b90
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7Ej:A3kMjKJd
- TLSH T1AB15AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 929KB
- SHA256 371603f484bff82def708a7ab6e839ed9abda3d810f06a41946c43a23fe10ba5
- MD5 4fbc6cba13955eb215379c60ee7da700
- SHA1 35aa24d0f7b7c74402c514d5effbc51d3268ecaa
- SHA512 85ea05b47c28630fd4c18e06812f1f321d9eaaea8f494325812d4a2703dc60e272068a493f772da4efe47cd349588400dc332d879018cd67a004219b3b9ee9c9
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7lg:A3kMjKJh
- TLSH T10B15AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 929KB
- SHA256 c27db7e294d3a7195142da339f59d9da5b52ad67a9c0a94f7bd277cba4089178
- MD5 96fae152ed5cdbf55b3e074ea0d53c2f
- SHA1 21c070df26cf78303e31121007ffd491eb685c35
- SHA512 7347b71b9edb5c93a170490d362e9db2b39fe18f047767a5e3ccafd12ead7fe5077297ee3afcde990161b09915e974bc1d537e726c00a2708db57ac17af54c73
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7EI:A3kMjKJw
- TLSH T1E015AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 929KB
- SHA256 13b65a384741038d4c5bd590dddbd740f11aee9e99a3084c41b621cc4dfa59c7
- MD5 aa3588163c1ab3bd831050d9f914e4ab
- SHA1 175e578958fa7012d631543ac0b0769d18c86c85
- SHA512 7c67d8710b249439cc0f8b70081741a8136ae83eadc66d2de14937b60bf67f25e676fad11806c13fdd3d22b8d03d6bf1da1769e79f270cc87cd8a6b35bd7ebfd
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc72o:A3kMjKJS
- TLSH T15815AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 929KB
- SHA256 c6321cdbf1f6839f336ecad2a47acac0511dbf930987fba717558b9c6eca6c68
- MD5 b67f71475a112422f87b0628cfe163b7
- SHA1 62c49cddc006dc984d2cb4f6f8de5dacd43a1abb
- SHA512 168e84e0858c7e8e1fc22a3b2489339479fe9a8a6e6e872facdc0b8932d25422122e63bfc29da0195e05fcf6e26f6a5bd83c736e1e34acc86f26fa1ad3e79452
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7d+:A3kMjKJX
- TLSH T1D415AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 929KB
- SHA256 ff25075ba077143131aa10c5a3b23dbc5575964da075576606f2c2902edffbc2
- MD5 cc7fa7e6e2fb977ac29d85e6ee81d35c
- SHA1 13974cf89b0b5a1623f98c27377b7f7e620f9507
- SHA512 ba1d5046ba5a5d36d44de347a5632c3a2cfac001777c8a29a4cc94efff4fa8b8126b25ad29e0463e51d0f2f1e4e03402d18f5c195f9c745867211e756a0a127b
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7LQ:A3kMjKJD
- TLSH T1CE15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 929KB
- SHA256 4ff99dde39dae99312389f823a75d9141d005fb060327f7c57abcbca52df55b7
- MD5 6a6a740f44342b35bb09db42671ab1b5
- SHA1 2037c32517bc148407cc0590cff01180d647ea96
- SHA512 5cfdbe3d5df9744cc18ddbcacf12654614d5fe928a64a5e46cad1ad97ddf32baa5251428a3e996aa0daaddc4b72eb72a17a5cec7438b2abae80498c4d0b641ea
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7AX:A3kMjKJX
- TLSH T15315AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 929KB
- SHA256 14f2461331ebcfb580f909fc93fb0705c6c4f75cc833312389d425e8c62e702e
- MD5 0da6c728f08d87b8fa93ace4925c727c
- SHA1 785b4b87ddbbc40094096393768c86059332c9ac
- SHA512 2fe2a904c697819d03b0e8ac7b138e41de9d97b053777620b22d28218891c918b232443b3a9bed91cf3ec5e9522f8c354799070df9df464f41356512d3fc4842
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc72L:A3kMjKJ5
- TLSH T10115AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 929KB
- SHA256 ae162bd8678fdc498295e931e49688e72ce53e5a3971c49834dece3f3035d05d
- MD5 02541b0c0950b74bac3c474570ccc4af
- SHA1 60902141120e7cf85c2394173f1ce4e6b46f1831
- SHA512 0a334ef242987d2321c0cb710292abfb5ba28f9bf975f7f5d226663e9470b55c383ab99fee69e1985af6cdb64d9c4a1e32b8b023f6ee7fcb2d6424c3285f8d71
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7KM:A3kMjKJA
- TLSH T12115AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 929KB
- SHA256 368eb153a93370b65df3df37ff401c2a200ff77432d11a866a7b64f24acce455
- MD5 48ed42f170ae82708068216a60b5749f
- SHA1 a459184f21d54a122db3519ef0190e453c18dbec
- SHA512 4bc8f3888b6f51d5104773b26c4bdb81211d94812e339012a2c30f05a625955a274a46cf5dfb6da0e25b63c0b95e17627be3ad699e05776ad4d7a0b4a389e9a1
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidc7bh:A3kMjKJy
- TLSH T1E315AF03E7A410F5E56B823499E54612FB75BD621B60C6DF236882252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH