Analysis
- max time kernel
116s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 17:07
Behavioral task
behavioral1
Sample
2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 925KB
- Sample260716-vm4d4sdw8z
- SHA256 8f296d7d107646d439f9de2b4bf0b060c90f5990f152eb4bb81fb61cad225b47
- MD5 0361482f1fe2fff73e36813d9e51299a
- SHA1 059ca97596dbcb7b4ebbe7498ac3fddbe5ccb45e
- SHA512 2ed038d05b14a38f048e5561478b8793a983713398886039a7922212c44e30022f892150e1a1101f00cbc8089f46267c4c8701a439c788dde61129cf2990c188
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVE6:A3kM+m
- TLSH T1DD159E13E7A014F5E616823099E55A12FB75BC221760DBDF236883252F727C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral2/memory/2116-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c52b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2116-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1220-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c94-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018985-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018987-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a65-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-305.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-519.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-604.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-635.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-690.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-752.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-809.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-943.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-962.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1017.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1075.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1131.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1150.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001891e-1491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018924-1540.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c52b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-12.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c94-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018985-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018987-211.dat aspack_v212_v242 behavioral2/files/0x0013000000018a65-230.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-305.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-451.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-519.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-604.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-635.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-690.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-739.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-752.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-809.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-853.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-878.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-943.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-962.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1017.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1075.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1105.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1131.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1150.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1181.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1188.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1195.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1232.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1335.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1355.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1381.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1388.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1389.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1396.dat aspack_v212_v242 behavioral2/files/0x000800000001891e-1491.dat aspack_v212_v242 behavioral2/files/0x0008000000018924-1540.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1220 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2116 2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 1220 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_0361482f1fe2fff73e36813d9e51299a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2116
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 925KB
- SHA256 8f296d7d107646d439f9de2b4bf0b060c90f5990f152eb4bb81fb61cad225b47
- MD5 0361482f1fe2fff73e36813d9e51299a
- SHA1 059ca97596dbcb7b4ebbe7498ac3fddbe5ccb45e
- SHA512 2ed038d05b14a38f048e5561478b8793a983713398886039a7922212c44e30022f892150e1a1101f00cbc8089f46267c4c8701a439c788dde61129cf2990c188
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVE6:A3kM+m
- TLSH T1DD159E13E7A014F5E616823099E55A12FB75BC221760DBDF236883252F727C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 954KB
- SHA256 7593199e339fbd0b53a5e3fda1b92ab5c76b948ef67de34cb683945fbccb6b9d
- MD5 e2a1c8fb74909bf27ac79ce8b70ffb43
- SHA1 29e997ca9364c1043b2c561a0f4ea66cfddfd37b
- SHA512 ad9eef545b1482056dd24eb0e8868382304f1bfc44e5e9501684f096bc927b5da3733cb9abfc4ee3c48436fbedd29a4641f0339482f67c3e04a29b42a034e716
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEMP:A3kM+m
- TLSH T1EA259F13EBA014F5E616813099E55A16FB75BC221B60C7DF236883252F727C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 971KB
- SHA256 8e51e58f1bc87131b417ec290064bc9fec3c4345ab96a1ce4221f7b2a8f4402d
- MD5 66988265b1726b006ed18ef80c1ee026
- SHA1 8cd8aca37ee00be0e98fdc9e4650a4484c180dfe
- SHA512 3b0db2ba2d5a721a0b3bba7c9b333e89b76031b5b4f2f97fe48559837b51bfebff2572aadc06093b1873da154f5184e74763e5f46db923f8612406ece38dae72
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEb0:A3kM+30
- TLSH T17125AF03E7A014F5E657823099E55A16EB75BC221B60C7DF236883252F727C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 cf29143c31d8c8e3f5dc6126e86e4af65a1ea0217c6482bf49fc1069ae80d057
- MD5 0100e06cf8c1656a8be8f36a8fd03ab2
- SHA1 dfa0913e190895355df4f76c88c2ab152b0e8318
- SHA512 0aa9f3a7929f5635f2a81c51701a69f457b4d8c9adad580ea66d066eccc37c1f38325926d46065011a0b88a6063789607632aaffd48eb56daa4f10afa63184a4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEK0Le5ji0hmxNrM:A3kM+mPji0Aj
- TLSH T1FD656B17F6A402B5E077C175C9E25A5AEB7238521B308ACF1358C7682F23BD19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 939KB
- SHA256 9496e4b116d2f028545a3418a19426558ac246f14d6b128efbcdf2ec00aca654
- MD5 a285812f76f4e573584a051da0f3d6ef
- SHA1 281267abf6c3d92c569143510a6a5055ac86ce6a
- SHA512 ba1469ee49864068235ba19b21d44894364becb9030978036aa3afb1a3a51419e7f1c9333d8df8b0a274f561ba0fcd8ece3c1b66ba2263b45b5c37313c1fda48
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEEa:A3kM+
- TLSH T1ED259F13D7A014F5E656823099E61A12FB75BC221760DBDF236887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 973KB
- SHA256 5fec27bd87a7c2eccf2f77c9915b3c82d605ddf59a0ba68d32a959793a1762b6
- MD5 9810311e4e94de078c82442c4f59a57a
- SHA1 16d9918e0a36365fe20885e315a3446f4d13df61
- SHA512 7683c5f9896af345a9a53f00caa1b5c3263e92b4cba285fe6b12cc18eb92c3a42111ccbfc12d5fc61d27d4c714941fafcf0df924ff1df18a4c2b0a7c09ca0ea5
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEPb:A3kM+bb
- TLSH T16225AF03E7A414F5E657823099E55A12FB75BC621B60C7DF236882252F327C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 948KB
- SHA256 132ca0601d9696b80308179ba7011b2d7ec662315f110485e1b878cd3fa3550d
- MD5 ccf2b29de2191c99216142d2eeba96b4
- SHA1 4c0745b17874e10ab31419b90e9281dbe95eb9b6
- SHA512 a2ec60e6edf26846afddf8c587d179e91e5f76b1b27228fd3deb55f4280d1574c92dd46f1eb59f32759fd8b1ce69c9b55fe909e0a5e96a2e09504ec8bd2da0c9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEeZ:A3kM+E
- TLSH T1B7259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 948KB
- SHA256 dad4739e87e6cf8f500ced82cd0f02653030b2129fe6f76c0666836e6de38b53
- MD5 78c83a3ba777c2166653149237b89475
- SHA1 2dc7ed1acb632c0eab773037887ed7810df7de00
- SHA512 e76403cc180d76cfd2d3469fdce5bc3f63ea2bf1b07ff008544b26f71d10854106e11ac9317ca835fabff41e65a8ee81f4d2e7091b64afd1d0849520bea5e587
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVE51:A3kM+b
- TLSH T166259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236883252F727C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 948KB
- SHA256 52efc338941fca9aeadf4cec0e7183482dec26f8a647d334a6637998ba72e788
- MD5 f24a4d6179693206a5e3189cd8944195
- SHA1 1d6007d1d12fa919271eaff8381f5c40faa29fdc
- SHA512 52469c82ad37ce09d08351c7d664d333d66ab7e3c29a8d90fe352da0d378e6019f684e18ccbe8dfa4125d8994f35a84b1cdd1eecccbaf593d77176444e4e7af1
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVE96:A3kM+Q
- TLSH T166259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236882252F727C0BF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 948KB
- SHA256 6149d5160b0ac4f936fef921e588faefdf283142cf24b9f2c447dd4e2dfef448
- MD5 1e55f7ffc4c7fd8ef6ce481bbf437802
- SHA1 ee059ebd644b9347e9fdffd683b5937676f12d06
- SHA512 4689e37306546f9bb14da1577ed51aa7b933c384d6146ff5eb74a9b1a0512d782ab7926e174db7d7694a9f190dc4fe194e5a20fa98b30a202e112e8ddb2e89d3
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVETN:A3kM+N
- TLSH T158259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236883252F727C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 948KB
- SHA256 9b9ac04d38b44263a59ef1ec5b44a6e4bcfebc3644a037fa547e748f3c1426b6
- MD5 499240c40f8f84513fc4eecba1223b78
- SHA1 fba72de65bb60cfe505c4da2e76634b46138363e
- SHA512 cfd4c6dc16ac727d7479afed9f6801023f8df2bfcc94dacc372a61892fe88052c68b4f6c422ce07e23f3655b09da9ec287fd44845e3472b4684089955642212f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEhf:A3kM+l
- TLSH T19F259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 948KB
- SHA256 cb952f34d2ed00beb8bc2a33ed9762b7986444aefe3e3665b851e68b75fcbada
- MD5 5d667ff103444499e9a029c29102996f
- SHA1 2b2d8f968d5152930662fe8052386e70c5e51a1d
- SHA512 6172584d743677c54c92c6172b44e8bb19fdfa3534b0801de512d517738f208b2351aba033071bdf53e7edc5e25447f8e3d0b5b6ea42e141d6683028f922ef57
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEDo:A3kM+w
- TLSH T1FE259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236883252F727C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 948KB
- SHA256 4e2f1c262bec301035205ae5984769873c9d71ac30a45a15a48b74a259254283
- MD5 663f96be38307dcc850b51a4dd2d3e8b
- SHA1 5d34c65cd4d27bc351faefaa2c45737393b1f101
- SHA512 04b603c5c332a8f7d84c64970be84241a8dbd54fbf3c8ae69c45ff3788341167f82bfd619b8c1e8d6ac0b15a4e55f4ec995d681c3d99ed9e42861d2312a23eaf
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVE3u:A3kM+y
- TLSH T14B259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236883252F727C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 948KB
- SHA256 49cbe3fc4622e05a7af07ec4096b1ed820b78557eb603acf8424eaca0ca8a9e1
- MD5 713dc4d318f0d66a7d2265be4c053df2
- SHA1 c34383389a0f39d6d3d36c0b4274ff71ab21ac27
- SHA512 8735e3045a1915327155384e403cbc81dcf36133eff5a93e9c7ae95fdcdf3d6f17dd128eb0a96787ea5bf90830e0261f72cde49d7090372dfcbd1ccfadee9e29
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEF9:A3kM+z
- TLSH T169259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 948KB
- SHA256 5dafa9d2c034d765dce4bf2aa420a1ff3e688330baaa626cf0a933d71c22b4f5
- MD5 f87810776989cea34628ad47b67e0fe7
- SHA1 03f14c5130ea2d2ab854de01e455716968f615f0
- SHA512 38fed3890144137c33763fc3bd87e7eb131bf88aecbfc30bb547db3a198665adc40b7fa344808d63c8747ae8c1f1b1114b212eb69cf1a897ef62d327bcc84397
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEhc:A3kM+a
- TLSH T1D7259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 948KB
- SHA256 d670b7b7caad01eda0e3b91a4e3b4eddb41d56515a7c4c2141b4ef71e6b4ce33
- MD5 3689e6b247ab5b33d770f19120cf4775
- SHA1 e1e76993024f6d20335231ab12b75528c989dab7
- SHA512 7682346222ba4dc2a8eed270f2d4c5c286c03654ebc631ba1b62ad1736bd897662fff98b6a3cf5862571b6f454f7a587dbcc91df0cea494cd456fc9b21ef4546
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEKp:A3kM+A
- TLSH T10F259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236883252F727C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 948KB
- SHA256 3758d6cd6c72e9c940529898e21a4419295e13ab7165bb825989793ec4f864f6
- MD5 1bc0a411ccf8ef1b2d9f32a4b77f3988
- SHA1 d3b18dbcd5e1a103509d3ec379a1547b4ed41f50
- SHA512 0b408c1f327a778ae258df5ffd07fcc44bb6617ad41888a72754e3059aa7ed3ca800bee01080ab58bcd1507a57211962e38ecdd7ff030bb7cc8b95d0a2232684
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEtN:A3kM+/
- TLSH T15E259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236883252F727C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 948KB
- SHA256 94fd1d5c1df33d4ecab0c3037960ffacef7eff3c945add6fd681787069265b6f
- MD5 6e8d12f79468ab15e9c28a5108ae53a7
- SHA1 a171842cb571d309d1e4cdb044d3b94fb8f25505
- SHA512 8a265349accaa924a5cb849604d13b2868aba1ed8dd8011b29af3dcdb36d04d195c8915b42345787ac898770bcc09ca9cd38210cf1db73a4ef483c9c27838967
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEfF:A3kM+Z
- TLSH T147259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 948KB
- SHA256 b5a11a14396ca043ad67a46827e72daa9ccf1f8e7c8356bb441d2ade7ab70016
- MD5 9cdb51b961b6ed9f4df8bbcff7375a32
- SHA1 1768f60002b1bba22cb7102564c14a138a4063ce
- SHA512 4c3dd393df2703c0ac47886ab68b69b307b860ea358814dfd04e4786eb5bd817dec1a9dedfe88615703b4c83359c238224cb3682c0e255784bfd0f7a4617e520
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEAC:A3kM+l
- TLSH T104259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 948KB
- SHA256 08a1b7ee4daf4feb03655a7fcf66a08fcf6d56cca9dfe7a2645e3e9ba88c561d
- MD5 f30f14971cd91d72e9a702b058686950
- SHA1 9aea53d550109f1e77688404f27a1fbe20e71ccf
- SHA512 53949531e4d23e183c22c89a340d599bf98c3e65c6b54dbf684b812c25a1f12fa4a4471553887bc7a72c13968106273b94831b77560d313eb0cd01d352bc058e
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVETw:A3kM+I
- TLSH T14F259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 948KB
- SHA256 ef09b3d44bc58abd5a69e4380f4a97e8f706a4537c503d8e70659e660750b5a9
- MD5 05aab83fa46b4608d25db1435cc72e92
- SHA1 e84147a7c52e67f250c3fc09b8d34891b0e7fe45
- SHA512 420381bab9e1d367ba3abf75f05cc969938c574d2f529484188bc647e77381d8957225ee186249525c752d534cffd2247a7e47dbd504fc80edf445e456f90dd3
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEaT:A3kM+A
- TLSH T1DC259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 948KB
- SHA256 56d878fc0d7ef579a94599717759928ed3e5d9fa5db2460b4e1b37a3223ac151
- MD5 b63fcce0a4e7bbb7c298d5d22f907fc8
- SHA1 42fb9f19f62f761ed5ed871bd9e47604fa6eceed
- SHA512 05f4df764f9897f62291a611385b8d9223e391dabac4c541381dc051304b1f4b89315f39ef32229f349b4fb443733d8697d0b71a1d95111425e51682dfda77c4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVE6u:A3kM+/
- TLSH T161259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 948KB
- SHA256 b43f74ab5423c13287e0ef6c5e4076c7a912a04d409e695c1e1b765b2b5ad6ca
- MD5 3d133a6fa1f8d820e48f1770792ba3af
- SHA1 597cc7ef7847d0c9cefcc9459dc6ee150dcd04d6
- SHA512 b2c4ca1b1a3930266bd1e5904f7718d18649a49bf29f5c417cb7abf2cf52676cc1a11dddf9d2ec49cc2ee61bf9a9f38a0acf5c2d0b226b47bc6f1159c644e6c5
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEEb:A3kM+m
- TLSH T18F259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 948KB
- SHA256 e81c817855b449705f835e0f045b727cabc3abe142eae833a6be13e23001b6f0
- MD5 af7567fd2046f59c891c35d24c1a5442
- SHA1 0be37f5bd15ead615073a8b37c994b717ecd7899
- SHA512 ce68dde3a9a9f4d082d8f33ccf694ca1b1f93594dc8e0b000064c27dfef3fa778af4466899b130d60f4bda6487b2aea1dffd6ff71e2714028dcdacb255af52d3
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEKf:A3kM+2
- TLSH T153259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 948KB
- SHA256 098a6ea23a3890bdbaf87516ae2ab7a44fa01bdacb4deec2a3a171552c7307c0
- MD5 1b30aaa191ef2444415c09dc146cc1c4
- SHA1 d8969a9ad589d125ccbcbacc07bb93a2dbbc7dfc
- SHA512 7956c0ae11a7fb7acc8a38f91880eaec973e18e7b64038c0ee6894a07d95e0a2b82e27b4fb62e11b353bea68e4b83e5c58ee704a58bae0fc0a8dab51eb92f9f2
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEXK:A3kM+W
- TLSH T11B259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 948KB
- SHA256 a27dc88e1edd4b8ec30984f4a81a428719c249cf2cba5974945afcb408fbe9a5
- MD5 52b9427191a6949997e2866a3b0a19c8
- SHA1 68e2ee93f0bbca3752dc8c5e1eff94509bc06d36
- SHA512 15f6092a4a9e4125722ae177e322b96ffa7f9000473f21f593fbbcaf93f4873158b149af0151e281c54400df2e02026b68b7de90a2e14fae7847d37da75197b4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEgk:A3kM+L
- TLSH T1E3259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 948KB
- SHA256 a2791ae4b5fd1d6a929f6b09d1d347031d4a3e628893f22704ee837049c7b98b
- MD5 9acb2e45cbdd9ad296e638118adf0aba
- SHA1 8a96b4c65e863a80a136318b2c53bf53c334873a
- SHA512 0bf16bd2abad94aa2af817aeb34fe705730ed6b0a921047914432e32c0ca2675336e020a8fde1c53af927022ec423d26bf83bdf222f503aa24d01da1b6151117
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVER0:A3kM+a
- TLSH T11C259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 948KB
- SHA256 8c4cb962daa90d66b89212eb37e3c6f5fc13157c336fe61f654d47c9db638f08
- MD5 3d0d65b5ec21754d53ad2e2fa1c928a7
- SHA1 54e0f2636a43e83899e0b18192906ca3fa697eae
- SHA512 a00df9b03eac9cc5adfc614ed5c28dc769590219e961236834ce060ac2ac728b08b473a4bfaaba37f1a8ae01c3d27fb8a7c5189875a5c12b0ad8e66b672e8e02
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEEg:A3kM+j
- TLSH T1C6259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 948KB
- SHA256 5cf8385dcebd669f487ec71dd2b105c0e939866cc7de858cde69dddfbd56880f
- MD5 d5e1bd0f54c5e5de0f264eb66de1c8eb
- SHA1 7c2d4291bfbd8d4310c985cc8b6603b8b77ab7dd
- SHA512 688203a5e1951dd3de2dee365534cb0d2e129233839ff677bc4e312d8112f363229da6c19169833c532f547d4aebae6fc66cc6dfe3bb7583718673e43361f7ed
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEhr:A3kM+1
- TLSH T18E259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 948KB
- SHA256 1b0fffbcad273290e2470759f726b2a35b2f2c77ae8601385f040ce235becc78
- MD5 db54d3169362e6968a166700facf4ca5
- SHA1 5534ff6bacf8b016420df28a5479e1fab8609371
- SHA512 f7a193bec12f4a333337ea13cf7ede1d645d397ea42c0dc20b3aa31be32512ea12b0e1671e0a57e50e96420cdd7545554ef73d87aeb48f838fcf74c80e367951
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEjn:A3kM+n
- TLSH T175259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236882252F727C0BF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 948KB
- SHA256 fde6ed27b3b118c3d5123078da72ae1aa160d7c085697e66d59c106a931c5080
- MD5 934c89ecf0d9ecb6aeb952dca0c55b33
- SHA1 4b9b8b0e7a10564a2a43db992088f242cb53e52c
- SHA512 32803df483c0c38648e5dedd75249a57bfa8f9b80fefd554e0ad40e23df5cfce48edd128f2937e9b50fda0d057d297e65da5736aa402ea854671b449008d642a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVE/x:A3kM+9
- TLSH T1C3259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 948KB
- SHA256 bb407051f7e0fe2712bbfa0e7bff09f4c537f25590cb99304ee14f1ee39faab6
- MD5 7dcdaad649f1b6a46e93de56c620c5c8
- SHA1 1d409127450d0f8d03a6572b336851045a16d0d1
- SHA512 8275ec0e2b9f7e84d2991c09ac9848ec635034140a8aef1f79b53cefd7503abf7b305a63274deaa279883576aa6040595a19c3a631980c5f66f57a2ceb91438d
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVElA:A3kM+i
- TLSH T144259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 948KB
- SHA256 af8424abc8c79e1f6ce25a447c964a8de84df339ffabe757cfdf5edb9714916c
- MD5 e97da0c7280617a33a312c3f460d95ef
- SHA1 b4b2499f2add098eda7c78161ac46fe559a160ea
- SHA512 45d352a696c358797c2c5c8574d14f3b606129b0d78f511a8992e0e108cd5f536ad75f32bd33fb8eced48a20e0dfc71339d049e8c89b54fbca83e54f9ccd8797
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEe9Q:A3kM+/
- TLSH T1B0259E13DBA014F5E616823099E51A12EB75BC625B60C7DF236883252F727C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 948KB
- SHA256 5bc54461f47dc83b9abcabce461936f07651233cf1541bebfb652417b8f8b188
- MD5 f38cd1032b5968838b9a55448bae987c
- SHA1 2a0a5136888b4b510b15e8e0a5a76d9ddb196472
- SHA512 bd9d2ace024c921e08de9467cd73b0c4c9c5568f760b404a8bc5419988ed56958ea8348b39c986a7086d75a92f644babd7876b397582df5a258a0bf873fd19a9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEL4:A3kM+A
- TLSH T148259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 948KB
- SHA256 b149548105cd4d53edbcc88c88508ab971cae57f1a022b4cf75a9f9ce4d9fb6f
- MD5 6658831b420f79ec1e31f87e5b0105fe
- SHA1 342e9838656273b21167fd022dd87cdad1d1db61
- SHA512 d12c65b896eeeb1d5fe0a95a87486a7766af68a381bd861a993f47743d23cbf0435263f9ebd4270fe06ab5babf74cd9a0106d67b9d3a39bd01554aea3f3108c3
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVECu:A3kM+h
- TLSH T1D7259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 948KB
- SHA256 0b43a795f8006cffd826f6b5b81d8f27bfa56e8aefd29dfb95950d42677c5086
- MD5 aad39bd8de2eb52b2b28d4067637e5fc
- SHA1 b7333dd821ed92cf7983f4218ed1ab876fa2a9e0
- SHA512 07797d6f7ad74990f4ebdd6157b89ed116c58ec7cd5a74c0bf52511cc67897bbacfb488261c133fdaa037197326892e9fb37833b64f9708a8b3353353fa61f4b
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVETj:A3kM+L
- TLSH T1FD259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 948KB
- SHA256 fe6ae61120e94e68c96a23d124c9df5b7abdbb25c1e173a0687cab4a4d932f6b
- MD5 6124a9dde698fd70aaf2101ecf964680
- SHA1 b20ea5055c14fa07a74db17d5dd502c22f466aff
- SHA512 2381c6c4646feac962954c5d6af734429237e379b87c202bcac334b6661f2042db8d27aa71fef50418f247b510dfe27254616ada5ef0d20a1446defbb3587325
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEeg:A3kM+D
- TLSH T101259E13DBA014F5E616823099E51A12EB75BC265B60C7DF236882252F727C0BF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 948KB
- SHA256 194819ff1d1b07fba9c8fc6c9d37bae8d0f58700107305c76b2f663661e4038b
- MD5 c8e6d889fd77d29d5d44653e03e73f40
- SHA1 842826323ffc6c1eb43bfb33eacd426c60c1a11a
- SHA512 51784f527633ad880922ca055daa088829bf14ee039fccef8b0395958b78e3763dd1bca7410a062522118c69764147464f820e6e6ab847a3770b60ef0251a45a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVERI:A3kM+K
- TLSH T19F259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 948KB
- SHA256 00c2b591636ce0e82031058587d0c7b11f92110f2e012fda4267923f6b6e33ab
- MD5 bf90a8882dc305a71ead07511700e442
- SHA1 200b484ed58650cc50d80e67a103af9963668ca2
- SHA512 eb6e36ae02f3c9b82ff28db583d091a26ab372b7998401668a1158b08395a4827b0f538bcc1990a23656c22fd4040bd7ac2d578e1a6925826ef914a147fe8bdd
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVETo:A3kM+Y
- TLSH T105259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 948KB
- SHA256 82cbf8636373c1dc5562c4df59a033b81fba3ffcb7a36b1585017a08d9c90aeb
- MD5 755c6d2b60baa1d2e84da6fa91d1d647
- SHA1 8782837bf8443ea488c84823b6dc7771432e76ef
- SHA512 eaab3e8dbdd201fc5901eb39d720131399ed67ae1c3fbaa99cad535d7cf7747a72686d4b02a2b7e55e5ac44cd8cf7209cc0e9ada15ada219bf5c1e8ea4308709
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEY+:A3kM+l
- TLSH T1F9259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 948KB
- SHA256 42676a889b59612ffe6ca12d0449466d4ade913494c7732b56f255a5e6cae1d9
- MD5 279d865937b247e6c9c3f9e5a267c8b1
- SHA1 68d4595d07542174777a488e4d8443ce100c9d97
- SHA512 d75091be493092837c91e8df3d520754ce0bbd3560bbb55f3bdc83d721c4dac8f037c992685d7682a98a725b33a8ad8781698cf3aaf89f45294e726795817933
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEwQ:A3kM+t
- TLSH T140259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236883252F727C0AF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 948KB
- SHA256 e15aef36b2b74babef716dc1ddf80da7eafd695cfd295f88ef34c520259bd148
- MD5 6e1b2122b28b25b7b57f4ead92143846
- SHA1 c5190743096524776825ffae9ce5b51c3940fc8c
- SHA512 c4b4069738bbe589827931fcda2d869143b4f170db1d6844de026cfee2bad8df7011412d2e2a09801decb7f3c7d87753b7bbed11b075c9d854cc7ef3bf0e6546
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEZX:A3kM+Z
- TLSH T134259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 948KB
- SHA256 5a6faecfbded61f88a21901c0e377825033743fffad0d779d33a474962c0d36b
- MD5 68972da09d1f0fc3174dbb41f9909f9b
- SHA1 0580d99e2a6d1387b6f9bec36e3509727a3d1745
- SHA512 6f919a28c80c06add280a8bfe5f363171e1a8755de30c50bcf69b73800c494a5102b622778f44475064f586a8ce516ef35e47921172f36fafc9992e687227caf
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEzL:A3kM+T
- TLSH T18D259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 948KB
- SHA256 cf5162c3f1d2526eb0a8509757a4b884e833b97b81c0870e6fe8f32d1b5f361d
- MD5 3e8d033de080b25bcbd19c57f8e730ac
- SHA1 e3715c8657c76784f1f718b7bcbba801c1cc383e
- SHA512 3c1e17b3aae22ba9a797b29e823fe4736d4acb39bc834f319e0f09e2108b4e6e8623e4ff189f06d9a9df4dbbe6ae8a899e1783bd4b0e635d8d33fa9d122ea8bd
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEZM:A3kM+e
- TLSH T180259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 948KB
- SHA256 cfe0fed3516e48a13fa2a97b2e88e8e6ac2c4dd355df11e67335e213cc4f9cc4
- MD5 b0c52c097718f39521de234e302fb5d5
- SHA1 1d84da66b601565814cbe24f74125adbfa295fc4
- SHA512 350f12e367941168934798cc02a7af50d83e60f00745b513d57a35248ad1376e7b7a843c8d6ff7c55891aad83e128f5660dda593295637853688e761d1df0de1
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+QNVEih:A3kM+w
- TLSH T10B259E13DBA014F5E616823099E51A12EB75BC225B60C7DF236882252F727C0BF7E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH