Analysis
- max time kernel
109s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:06
Behavioral task
behavioral1
Sample
2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 930KB
- Sample260718-dl46kset2j
- SHA256 a4c12bb0a542495a03de61ee3df30d219036d0e080bf6ba8c70896a06eef74fc
- MD5 852833e952874b0ad9fefa3871ea1333
- SHA1 de2eed483cc0fe95aadce5a8d0efabed85287791
- SHA512 fa102979790d1d1eec6245b9413bd69d6bef081a19d60ab50caf323ab38cadd0256b10396c6fb180e27847d8ca1b408d44582b8f40d979be82ef257b878d3355
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusF:A3kMjKb
- TLSH T1A615AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4300-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c536-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4300-88-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4448-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb47-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198df-427.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-592.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-668.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-723.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-841.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1044.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1088.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1102.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1159.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1339.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c536-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-57.dat aspack_v212_v242 behavioral2/files/0x000400000001bb47-270.dat aspack_v212_v242 behavioral2/files/0x00040000000198df-427.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-495.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-592.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-619.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-668.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-723.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-841.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1044.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1051.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1088.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1102.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1159.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1186.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1223.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1326.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1339.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4448 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 20 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4300 2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4448 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_852833e952874b0ad9fefa3871ea1333_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4300
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 930KB
- SHA256 a4c12bb0a542495a03de61ee3df30d219036d0e080bf6ba8c70896a06eef74fc
- MD5 852833e952874b0ad9fefa3871ea1333
- SHA1 de2eed483cc0fe95aadce5a8d0efabed85287791
- SHA512 fa102979790d1d1eec6245b9413bd69d6bef081a19d60ab50caf323ab38cadd0256b10396c6fb180e27847d8ca1b408d44582b8f40d979be82ef257b878d3355
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusF:A3kMjKb
- TLSH T1A615AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 2bd80247cd8853a946d0d1ab4bf8db79b6e40b066cd2bd760606fd4eb396124d
- MD5 453fc60538c92bb78675ab37b062bd5f
- SHA1 d5396fede6707a1e7b8131960b14122adf223a22
- SHA512 238497c43c24daa0ec1808fa4d08daf31fb5d5f9b7ebeb260658e918dab05bc2178741036918ef44428268621a552be0dec23e8539cf6dea6ae4ee88c5d4dda3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusB0Le5ji0hmxNrM:A3kMjKHPji0Aj
- TLSH T1EB657C17FAB446B5E077C174C9E2965AEA7138821B30CACF1359C3282F637D19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 944KB
- SHA256 005f647ed30fd732a3c3173ddc882618cb537fe6db57388fd72f06a206007d87
- MD5 5f5fc26de9456439520b317b2cd89365
- SHA1 55cd77ad322623cf8cdf19af72a727efcaff0754
- SHA512 a88d4511d9ce3bd317ed0a78632f7fd69e0965036a7f4f394423b1be741dd753c1bbc93db59f1a027e8717d68d6185a7cec08d9b8d54025ba26951ba78183996
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusDa:A3kMjK
- TLSH T1C825AE03DBA404E5E51B8630A9E54612EB75BD532B60C7DF236882152F727C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 953KB
- SHA256 78a25f3a0b0e39ea59604db7776664ea267a64e96768ee3f1ba4d69e5d8ce708
- MD5 042e55a10802394a53772aac2802ab85
- SHA1 60c37480b77d51b1d95c8b507328b96f226583ca
- SHA512 179e4e1dc76c308fc20a511de5945acd911dde443650d0ee0d0e87d8d187652d311d442e5e9b7d518e2b8b6971717acef0cffad4cf1dc545739676b3e6e63f88
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusC9:A3kMjKc
- TLSH T14725AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 953KB
- SHA256 ade3bbd4b12b054fdadc8e1158de1dd59e6eb510cd530521a4c0e19c7080c1f9
- MD5 22592b2c764990b854db677f19c7ecc7
- SHA1 8bab90ff8625aff53854691fd8290863caf7925f
- SHA512 832dc77b52155ab636e5366bec5f6fa32cd8d1027eab774a626e65e7a3e3afd15aebfc600565467c547cd18510d93e4d747d48700b0fdd64bae6aaa20ca7987a
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusCc:A3kMjKV
- TLSH T17B25AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 953KB
- SHA256 6496e9f69536530ad32c2e5fb45cd65aaaa2699cc04822c2a7a7df19b4654c2e
- MD5 d3d99c77b05fa2bd57f30b88cf8bba43
- SHA1 512d8d0f42f06fc5e7b35db50ce9cb56178c540b
- SHA512 9967ae137de1818e439d2a7ac7781e9b4e6ce548baf284bf1552e086e838dd3be85c916f741333d5f640dbafd2371eb5dc6a0084a64e199b03e6d0feb5f3bb27
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusLp:A3kMjKb
- TLSH T19B25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 953KB
- SHA256 553d553b9df46e1aeda00b79a1ccee430d2e031075122e565b2c11636dcc48ad
- MD5 ddfa999b146dec2a646ecaf7b997c8f2
- SHA1 1d2fa0833c6d2c276c5af0528bbe0949ec11e37a
- SHA512 f0e3cc2e78cef99523cacd59fcf65f1b80aaf7237ef97ed3b656f2ce37f7fd5cd335269b22cd8bbb3515dbb779af84ceaa84921b06f57913abc68f6a78dd49a0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQuscN:A3kMjKg
- TLSH T17E25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 953KB
- SHA256 5453f05ece84434215adfaa5fee34e3736d6ac718431b5a52e98425c3914d556
- MD5 4bba3cddc968f7a367a39b8f38a1d439
- SHA1 98ffe8c5c3451ca8972f2f5fcbd0905d40705e3f
- SHA512 1fa2df5c02765332abb5811ba9da3d4b5132af42cef58e3714a611ea6a5a78aa064d3bac2fa8994923dc8cb42fa894499758f717306bba5df7a32850f443d031
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusEF:A3kMjKW
- TLSH T19225AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 953KB
- SHA256 4e6ab488e8bcf9bfea1df09ea9a502ddde8b19f25f16b16e1e131445f654cb9c
- MD5 f7c8c7e8e81b5003449a0b895d6be9e7
- SHA1 dd6a7182d71a3b5a287f226879ff605a1e9f5f00
- SHA512 ac48979a8d8a466bf051a6adea3504d4bc8d8a7972bde84c8e7004408530da45d5c800337e767ec75092fbcef6e01be744723f2f5249f02d355bef01e79da744
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQushC:A3kMjKS
- TLSH T1E625AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 953KB
- SHA256 a9dbfda6dd113a5f08f22ff68ca7d13e7a04af057469b74fa5f0429e7bf2c7b4
- MD5 e7ab1fee02b59e6ef8a09df4decb53c2
- SHA1 8bf41261c58d332b46d8f754521ed431fef77976
- SHA512 c7aeee67fe04c60f3268d5d8f7ab24ddb376e4e6523cc219484d80ebb37312603e327767c3db3f1cb041615a4f1a2b794c58f741e39438d937e6d2af25e50585
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusiw:A3kMjKn
- TLSH T1A225AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 953KB
- SHA256 88ace276795fe00c95403d7b7a534e1ba20735a6add8db2fef8b3d4a71013526
- MD5 c623d0257b3b3fa431f2a29d74e107f4
- SHA1 d12e44b8da000fc747df460294a557478fa6ca49
- SHA512 6881382ade425a2709c2cd3ddd5fc48374f46e6342f74ff1f2c6e01fcc360aad9304bfc94f6d2195aae74237a74e996269b3044a6ef0f988efbe5d7ede60893e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQuspT:A3kMjKj
- TLSH T10625AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 953KB
- SHA256 03d26d6e7b1bf71dbfa8aa11740155ed78be0da1383211a8ade2604fe38a4a09
- MD5 9bb569bb46ec887f3d2abbbcf34d985e
- SHA1 51de5712ad5cfa7ab290510d1e1367fd1a850e89
- SHA512 f1891c0d1b23022fe310a547e691c2156b3de49cd46b318e1827310852f381cd89188b8a039a9c53ba92862c183b240ac5ec3049bb46f0d8ffc5a5f0e4ced151
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusHu:A3kMjKU
- TLSH T12C25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 953KB
- SHA256 dd722b3b36c2ee8a25e92a853c3fc930b8323ac3b885c4dd94b72c44ebed5ee1
- MD5 f0076d28cd0f91e663cbbcf34266dcf5
- SHA1 5a2b914f23e94eade8cdec0667c19e5e3c1bf3d3
- SHA512 17da65c01fbea89ffb9440a98ba4e6e19030bb1e60b5d8441b816044e9c018f8d619422174707640c8e55291d09a1df9bd16194990e8619e770ccf5761684ada
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusbb:A3kMjK9
- TLSH T18525AF03DBA404E5E51A8630A9E54613EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 953KB
- SHA256 812e5f9a3c2d9d4fb39c39d3ceaa4851ae6b82de9cb93eb0e0bcc53421462dad
- MD5 0576ad01d5549021129df47adfce8342
- SHA1 400c14c3c6fc1ea5d13c1eca65514c59e52e793a
- SHA512 537f34b7a62e0499d035b72cdec4f6a85ed6ba5c8efe9062a9de2ad2640d58e2a528ff116bac64109e88125ddb7ea7cb1ac798aedc2a402d6467eecea3cc5b1d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusvf:A3kMjKt
- TLSH T11D25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 953KB
- SHA256 2bda752d0b8073f0f453417a6e1b0b18deff5a1faed3916f8f7ef2f90b7ce82b
- MD5 b3731401d32902184b6fef6ae1422a36
- SHA1 3a2457bcaa8aea2ff502818f0ffaaf6808e595b3
- SHA512 db2ce61878f5f1a875dca00e96a8f315ea54432488b7516684f5eb2ce9b0878961b7ffed407c4ae9c8017c331f37223f1f8310951297899d5bdd7d95c408381f
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQus4K:A3kMjKl
- TLSH T12925AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 953KB
- SHA256 208a0320ee3f34c4edb7c1e84ba0023d563fb2d4ce7c224f28d1385b77bce2a9
- MD5 346670b395cf95a0517c03d7431f1a20
- SHA1 a8b845cb08855b34e690d9b933bff7317f9531d0
- SHA512 fb22b43452eaa6981f7654847568e0b0652c8f24f146819a9362c38ddf20b56331cbac018bc01f9a4007ae69e289f8a526f5881a3a7b301c48620d41aaea3432
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQuslk:A3kMjKM
- TLSH T10525AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 953KB
- SHA256 bb55d105615f6974021a7c56c8d808c05b5501f7206ec400ff1e4feda3f83189
- MD5 713ab89f2d39183ae7e09744a0e31589
- SHA1 9b293e159ae482c1a0b30f3f7a625f7bbaf7db83
- SHA512 d0232e759351cf9e632eb7fcde3ce4fa5dc2e9aac424271cc976f0f4036801901853fea7f5f7a44054994812d6fc72487d331de1f512a440594bcf2b64032e99
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQus60:A3kMjKl
- TLSH T15E25AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 953KB
- SHA256 07ac9fb64689f468c9f04822c2c4327b4e57b589736e6a1d7208161f9c28389e
- MD5 afa1af096ab96640ded9036b69ab99f9
- SHA1 6079f9dc3a67cf32bb20876a641638379451a32f
- SHA512 df1b4d74f9e3349f26f984e6e008accd3027402727b1231567e24b7143c0b474d9fe7a1640913012324128e1e84d0cbcc97d0e3d4d3351fc55c7c09d0c103733
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQuspg:A3kMjKE
- TLSH T19E25AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 953KB
- SHA256 0dcc5f70f12be0bc857a1f8b1ab34c7474ca25c39e3f0fa37930b8bcbb329330
- MD5 5d75312615a7586c0b4729d60ff0d3d6
- SHA1 29ba832c0d94b398712429fee51de8a87d5cf259
- SHA512 e703aa60a60cbf7854be1fbe55f0d8a83baa49257ee320f0d8307390c9ff805ef8f5a4c2e35c23fc99c4158b0d3e5e8fb408451ad7f2ced26b4d447862ae431f
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusQr:A3kMjKW
- TLSH T1FA25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 953KB
- SHA256 077c689a71a50aa51dbd1d3542c6c36862c0e8b0b235d6d4af2551bf5bab0ca1
- MD5 290c6513d9b38baa6ee7799c600a0810
- SHA1 e0eb75d9966a06bc03e97b5b489dc6344bd6374f
- SHA512 e9bfd65b7835daec501ccd35c9447ca71707e2c141e77accdfac1d689912f7809794fc99d281df66871c8168dfd9488f5e03c0ba01e115ee7e8eb4df3c91fa43
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusOn:A3kMjKQ
- TLSH T14325AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 953KB
- SHA256 eb8273a4331ae228c12c194c45fdfd854554d341d02bf3a85958ca3666ac2e05
- MD5 89b2a56f0cd769b60f065cf6e9579e44
- SHA1 12a423bee2f0f6e0d34e2891420a2cc66714d975
- SHA512 382d02b6834907af4b1cceb178c46294e82f5cf5707d86c370a00738f854b9c703b3b0f21976ad9b4e2a476f684bebfccfc48bce4263583ff475a772ccb7e35a
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusEx:A3kMjK2
- TLSH T14225AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 953KB
- SHA256 59eab8a64c000c3ff6a21da86cd97d6a34596b08d002e2cd51efab6eea4fe76d
- MD5 782a13d1d25619978676abc6887bbf6f
- SHA1 a9d8ccfc440285a0c4f1e021dcb65c735cad0ed5
- SHA512 005c1c1391af6f35360e3aa06fc66adec1c86f1a16bd2e63cb49970e5eb7d4e270be4636d2d561cce7c38f879714f4c439f51e9316a91a93253a3b7c12de63e6
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusOA:A3kMjKt
- TLSH T1F925AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 953KB
- SHA256 b36dd41c4ecf5b2497bbb2d260813633e8056c41aefb0c560b322e29db49744d
- MD5 678fcbced3b0e7c62364f7195c2255e4
- SHA1 309cb998d8c896520e7ae87d19af0ae762427531
- SHA512 40e7146c8cfc64d9723b1a0ae35b42c06585e568066c370d79dcb2ee44ec569f99b63946fbaa4693091503ef8b3db624e1e4ac4bffabccdbd90350f8708d7c04
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusH9Q:A3kMjK8
- TLSH T1AD25AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 953KB
- SHA256 5afcb8a1368a70a502510bacbf1bb55cae2629a882f0b3a22f220213f27b6c90
- MD5 3a024a33b94e2617edf464a15b168520
- SHA1 4f0f668e87d0842a08df151a2d39c6261b5468f6
- SHA512 e4cb6f8cada581830ae40f7e3746d5ef015e6fd07597ad142df5daa43ae377718d576d1a4ea5f75de5eafc8ddcea4562d8dc9c2416d040686c63ba2254e4853b
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusO4:A3kMjKX
- TLSH T16125AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 953KB
- SHA256 3d969e6add935be20017df6e5136c94a48f487df7a417aeb1488e77096918383
- MD5 b7c2bad43dcf3e9ee1a1b16c1b2a7d9c
- SHA1 fad356422fa5016efe98ae7264db78db778cb564
- SHA512 7243a6815765734052c14321d4af29cdd39af55a20eeaebe8077b5bebb6acd0f1295b13afa64e87102eb9b9c75ee3327fbcd06ee4761f4d0a00035565a9c407e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQustu:A3kMjKa
- TLSH T1C825AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 953KB
- SHA256 80e03ba30392dd2c939077311bc8a83a46e583f342b69f9784230d9149c29161
- MD5 264274b5b4e217ec8620be4869538d37
- SHA1 1afd8b6a86e702bd0885dd48bf6f66609ceaa919
- SHA512 19563146306542d3273b8ccc65722f7ad2c27a9d38defdad75b8bf9a6a8f623d3d2c0308cdb64aa7f6ea2f4c1d64577c1ffa1f104f6687531df8200a3e73f722
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusgj:A3kMjK0
- TLSH T15025AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 953KB
- SHA256 7d6d12e0de98399ef98b6479b40bf219375b12305d50ced7226dbb5bdc3e6c20
- MD5 007b0fb3425ef8fa4dd7fe8c6758f9c7
- SHA1 6cc1ff56d5b1befee108d65dd158611bfdf6824d
- SHA512 ed9da4bf0393bc48b088b62d985c0c092f4e5dafd6937a6ae02b4df6c46f8e5c7560e4bf12ddff410249e50efaf7b4eeee789492875c824d25fd16c978c55c7e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusRg:A3kMjK8
- TLSH T1BB25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 953KB
- SHA256 23d29a585335185fa788d39806fc5d7a01becb1a63f8060e62b53893f8108f41
- MD5 55ffd7e434a150c7364b044f4fe847ee
- SHA1 141f0fc2d4668bd6f0dbbbd57e5d07edd4eb45ef
- SHA512 2e899609fde430d26b5254f9b13077b95e30cd8fc4ab868deaf7af88dd2cf0110373adfae75403c56c475ae89d8aa9da026af5028374e16164c8b131aa7c8d8b
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusII:A3kMjKV
- TLSH T10325AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 953KB
- SHA256 5214679d10e427557b0553669f9917ac65101f47228588bcb24987a2af808e70
- MD5 e9e98b797f472cc2bb8215d67b23b56c
- SHA1 7cb4f9cfc18963c959e0303811de070b71e553ee
- SHA512 0f08bdbf7fe8e044c548ab4e0b0fc417b03cbea7d641046ed8a0311663c0296daec9e36fdd6daf34f919cca093ba46326412dc7f3a47f858d5eb32b041ae36c5
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusqo:A3kMjKD
- TLSH T15725AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 953KB
- SHA256 38d32082a0621c32091a3d18c09629a9b4e8c7529e5b5022d64b252801f6aeb6
- MD5 363e4ad9ff2e73f2b09593172ced1640
- SHA1 2d04eacee4b746d26a15a52005870646852b9094
- SHA512 d06b79a1625312a21624621590fc8dfa8ea0ace0f8b66965adf9cb22381ca1e51e307e36ce5ada4852a1ec070bf700b7e33eb34353a50a90afe086d9043d94ed
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusB+:A3kMjKG
- TLSH T13225AF03DBA404E5E51B8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 953KB
- SHA256 2f4dcbebccb049fda05ed4948f8595d7dba192fe75f60cf1f62ffb47549a85ae
- MD5 11677a7e6daf83d2f6465d98d84049d5
- SHA1 e3f456830e25acbbfa49fd472511214d33a08014
- SHA512 4391bfd67ce5884ad36cad455c72018ffd783192365bdda37625f767575ebf84afb96b1d2585160c8bc781da7f443771ea344521dd91d9e455ed0b9e2f295880
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusPQ:A3kMjKC
- TLSH T10825AF03DBA404E5E51A8630A9E54613EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 953KB
- SHA256 ca3932266067ad480c6584ffd03a5e36323eb991d8849eb11311d7a5871aae39
- MD5 d13ea5953ff7418956df68b7478caeed
- SHA1 97836db225f48c3880cd54cc67407ec106e6fc52
- SHA512 67548374c48c78831c027eab545fae517490079e6e5ffa0430caa0c84ec1a47f28216b18481ae2be72634b962a1831fea041e2a470a152fa31abaad27bfabab0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusUX:A3kMjKS
- TLSH T13925AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 953KB
- SHA256 822b90ba5a9cdcc7f51a3680c2ce8dd136f0876d35c4e5e15eec68dedcd88c33
- MD5 3b4ece0cbfd127eb8bdeba9bef5060ca
- SHA1 df02ea8d0b9f71983f19e4a5840e16615c51d239
- SHA512 2b5315802262ff71394c3813200aa1268dc90da52d7eaec57bc9cc63b541e6608819ff2fddb991c866d0aaca8957fc0378f7dc126efc26695a38276013000edd
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusyL:A3kMjK8
- TLSH T1DE25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 953KB
- SHA256 605492dae3565341aff14b96afe7ec099ffa391dfbc6f03608d983f2d0a4925c
- MD5 ad09863bf0f5144fbf44b9f3c1126a9b
- SHA1 31ab65a3bb098d248b674f41f55e3ccffe7a1988
- SHA512 d32a548b6d29c5870c7881348777f4f4bb87c657b178b494f2cd2089d05d31a01b7d31a9d239ced60b7a66cdb1af69da57a93f385e5988cb750010d078f97657
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusWM:A3kMjKN
- TLSH T19025AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 953KB
- SHA256 0d4688fc3bc598fc40e979bbae954db3e8b14e009ffd2ddf3d475fc570fee589
- MD5 74284105e754f634d575b23653e69676
- SHA1 401290c28b3ed0b091b6f4409cb3df286cf98b00
- SHA512 732441bd126a2c87c1617d14ea4ae8c90e324864b25ac5feb3e8eb32c7b8e9043a77422da94afe82fc60ec4b14d062bc39ac3ee5303b7f609611a1757e644fa5
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEszHaQusfh:A3kMjKn
- TLSH T15B25AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F627C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH