Analysis
- max time kernel
105s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 01:29
Behavioral task
behavioral1
Sample
2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 952KB
- Sample260720-bv9rbabw2m
- SHA256 cad6cca5150d7fa2a3b180f2ecc5e92df9e701fbfd7b0e017aa2b55517d7418e
- MD5 567559e596ddb1407140c5f79ca6dca4
- SHA1 2653b4a16e43767e9a43daf501d32e0b7bc48e21
- SHA512 3fcf592269575bc8086bd9d3bab239850e4ba38cd2b54ed3d932dbb54d321f1acb66e784e5d496648240f3ebb3b589813e80da46340f34689adbd1f22d529da8
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jw:A3kMjKJb
- TLSH T16525AF03E7A410F5E56B823099E54612FB75BD621B60C6DF236882252F737C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 33 IoCs
resource yara_rule behavioral2/memory/2944-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c350-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2944-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5596-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c357-303.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e3-473.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-717.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-791.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-840.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1166.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1217.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1390.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c350-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x000d00000001c357-303.dat aspack_v212_v242 behavioral2/files/0x00040000000198e3-473.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-595.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-717.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-791.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-840.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-912.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1091.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1134.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1166.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1217.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1320.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1339.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1364.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1371.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1390.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5596 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2944 2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5596 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_567559e596ddb1407140c5f79ca6dca4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2944
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5596
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 952KB
- SHA256 cad6cca5150d7fa2a3b180f2ecc5e92df9e701fbfd7b0e017aa2b55517d7418e
- MD5 567559e596ddb1407140c5f79ca6dca4
- SHA1 2653b4a16e43767e9a43daf501d32e0b7bc48e21
- SHA512 3fcf592269575bc8086bd9d3bab239850e4ba38cd2b54ed3d932dbb54d321f1acb66e784e5d496648240f3ebb3b589813e80da46340f34689adbd1f22d529da8
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jw:A3kMjKJb
- TLSH T16525AF03E7A410F5E56B823099E54612FB75BD621B60C6DF236882252F737C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 ac44a71788084e6d95ef5d0aff887b93a5dad85c52534afff25e9d1c467aefce
- MD5 aa87527c5f13eec1f76e351dca50e79b
- SHA1 2c341484ce271b5d02654b5281b88a3e8cc6442a
- SHA512 b9ed2243e5ca7f826b6e5f2a276950700902003c0b7862dbb8540108893bd8271a67cfd95d43095d6421ae573eaefa4a77aaad6aef7770ec3cd00dd51ddb1f28
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JI0Le5ji0hmxNrM:A3kMjKJHPji0Aj
- TLSH T1E2657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 966KB
- SHA256 6cc47d6087dfdbb8aafe18932cd27d7e2b35f5a3da06aeb0c1cb29c6a5d3fc45
- MD5 807410c0ca1296256eaa54dfd6616756
- SHA1 b13f7e64d4ab5b549630dd0a13d152ccfaa926aa
- SHA512 483cde1d32e6b1855c3796c9b077c24fa0a253c64adb19d9ed5e3f645c61774e9989265a57fc1a19014b4bd46fd5f4258de855a367fe3baa7c729bb83ff7cbcb
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jya:A3kMjKJ
- TLSH T115259F03E7A410F5E56B823099E54612FB75BD621B60C6DF236886252F337C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 975KB
- SHA256 8da026bafda5071c25a67e2e86694f40879b893862ca40233fdeaf3c89f21159
- MD5 e4d6e2831033cc474496a7b479cbd44a
- SHA1 457c40b8ff15648689401a1324763bf77a80ed35
- SHA512 acfd7cf897cf21318d1397aa46cbb312b2c0690d8828308e5b4d8b98422d748100fe18fba40ba1aad1db60f61fe312a2bd0ffca2b10e14c8d154777efd60e36b
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JuC:A3kMjKJS
- TLSH T1CC259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 975KB
- SHA256 095523d98e28160d06a5a9bd0b65fb042a1b37ded750e0e06b1f0a9c69305968
- MD5 8bf453f171a6216b77ab82122310b569
- SHA1 3bc6f48dad9b77d4079153392b665986a2f6dee0
- SHA512 ee7a778e09b464b29117a481623e7cb771def414fb72d3a7375e3064664c998c4d8091060cbb3abe7825f19655564f44b9f1b8238a30e2a84f0b169502d91ad1
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jxw:A3kMjKJn
- TLSH T1A0259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 975KB
- SHA256 c0e376a823a9aecd30d055b1012a6aa1a4e659812539410e7737ae14c4b0786b
- MD5 072634521b9bff52e0d39f1cbbff721c
- SHA1 60fe27bb87af30ba2c199b135ac2c6193a90e45f
- SHA512 a629bf80a82252b809c5f5a410408e6b511f237d94815a7e493b33dffb4d14a35fd510d367a67329698872c8d8eb31304c3306994a22a7861e62d527dd3e52d6
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JYT:A3kMjKJj
- TLSH T1D4259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 975KB
- SHA256 466d7539b3e08b75e5d57f3d638bd31e85f67df1d3d98963afae8d7205e34f62
- MD5 1ad21ff9ad07ec77db92bc3acbc5b027
- SHA1 d20fd2909090364e1c3754b6ae8819d1e134d34a
- SHA512 0e2c1f3bd164fa9bb47ad5ae8c3ee37734fd98bb0980be7a007f19c76cb40f687da76687afa163406a5136c95f2673a564abb90dcfb98f922810b7b1600601b1
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8J0u:A3kMjKJU
- TLSH T1A825AF03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 975KB
- SHA256 c9a1b6a36d6086df6fb9f857b57821f0de45c34d7cfa74e2ce96f8af9a738dc6
- MD5 831f9660286a4c7fdde2e2655ef0ebd8
- SHA1 f568609c38a3bcb99773c4d33efc0be9193f5ede
- SHA512 ac3f16d60462eff993404ebb6e8596c3232a264f45c5af574f5bfdf5063a1e809c7abaabf1f79bd3ffc15478e1bcbdea7d1a11fd79d1ae927e74f4b16847e69f
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jib:A3kMjKJ9
- TLSH T1E6259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 975KB
- SHA256 086cdf4adf40d0296b2f6f5513c2aed0b77bc1dbe9d1fd363bd4c89faad623b4
- MD5 df3ebc576476c755d5fe20a790cf8a32
- SHA1 650bd6491b838c13282b4c7c2a2cdb83e81e369b
- SHA512 9795ef01a370c90b8fd4df801a66f5543134b1320cd58f0991404969136d0d1048cd86b7a29f3135b87ab2ba2fefe43ca88f78f47e2dba047ddd2c21fd36308f
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jkf:A3kMjKJt
- TLSH T1AD259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 975KB
- SHA256 8df4c6ac9063bd3fa0f8f9e3897dd141786b73902bf284c29ad756a82e388ed4
- MD5 768ef65d6cee7ba1d7af283d60b2cd7f
- SHA1 251924fe02b7577063553b64fcdf8723a58161e2
- SHA512 50fde1f4d9e06660ed5987db3a7cfc8e8d048ba4396fdf1d82e881808b5d03ec4609dd6cab1fd20936dbcdeb89975f899af504291428c88a111c3e4c8ed1d56f
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JBK:A3kMjKJl
- TLSH T12B259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 975KB
- SHA256 ea53c3f025a2d5f5dba3277fc537035605332b0513c20732164608b5ce084f3f
- MD5 09341267746a5513452369b89f04ce15
- SHA1 11d3d9398fb04ed6cd99f667ffd3fed7e5b51bb8
- SHA512 cdf54433a79eea791b14354cc2538f5447d5b39b871464280164805c0d94adb60329186a747204ce1c7006499501b6ffb75ab5aafc85d639ac16acdfde842d47
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8J6k:A3kMjKJM
- TLSH T1F6259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 975KB
- SHA256 e36a328021e302615d753bc52d7a26477899abc0d4a17fcd254fd21436f61eb0
- MD5 aa91a956325c64bd842c1d557593afe6
- SHA1 f79f49b080c21137a6bcf276a95a9e014d421a82
- SHA512 459fe49f346e8014c07c04f6e34a7e730b9c2f831d9679cf0b50fae35f0abb93df993e177ebae654f9e3c6dad3d1eeb3ab38944f60532d9d62d6956a79fff005
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jf0:A3kMjKJl
- TLSH T13C259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 975KB
- SHA256 2d3cc7b3ae37aca01d7f8029b4772c9256bbf81d710b1a9994ca4ae3e0709d5f
- MD5 2cddc907f4e4d32ecfcc13774f477b65
- SHA1 07d02e92ff866a7a8a6b7277c1273a275a927408
- SHA512 76bc9333faaeede3fc0141acb78974911cce7a155f17788c0d4660a67a7593d6f3dd600fa455a57c39a36b9008fd0cda14252da27c88f3f589e3e0437467adff
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jug:A3kMjKJE
- TLSH T1B8259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 975KB
- SHA256 656b91a573327568868a75b1f975f012827f6b49003f50a4940d4aad4ce4b7c0
- MD5 a048adb70266ce2a85585cf0e323d35c
- SHA1 a514738dfb7a945a8ed2476da60e366e40166915
- SHA512 eaa2380d3db351f64a9d96e9140f204ee1ab091fc87cec24fdb1e3586fc2e871d81f3466bb87c1ca9f80221f00be1719b07126f80291ceb6d962dc0f9308e824
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8J3r:A3kMjKJW
- TLSH T1D925AF03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 975KB
- SHA256 b0b5460253f83864f98e88763cf2c173cd4b3679cc43ad6c8cf0a79c7beed279
- MD5 65dbf923f408e4e82aab5bd6c953f675
- SHA1 c2c8ed636f6cc08d0ac600fced99512bc08af25b
- SHA512 05f797e8d3c8b2463b1910925a75ed779e063eb1f0e02e5a05a0f98cdf4ce6a27b643f5b5d878f15338987a2cf13646a786f95dde31b886d5f2b3978594516ab
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JBn:A3kMjKJQ
- TLSH T1AA25AF03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 975KB
- SHA256 525db56387353df93f2b38ea7189402f6685c12a135cd09051ee0803dfcb2f50
- MD5 050cd62f1fa13803297385b3fcde79e6
- SHA1 38417ab97513c8716404a6a848511b448e30f8b6
- SHA512 bd725dcb5089cf9f1ee41ecacab200f029f5d86efbccc9fc7b2a9c7ff2da67701d66271f3613f95b7d98bd92c9df271a8f216ef2af26b0f4389ceae679a7e941
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jtx:A3kMjKJ2
- TLSH T17E259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 975KB
- SHA256 b5237e6447edbd979926f8311506d01506f0a0079c703ee077978298876631a0
- MD5 be2a1a1a900c811411d65e5f5775d75b
- SHA1 09595551642318386e9c4161f8691977a0a555c9
- SHA512 d6a6a4980bf406e8803e70bb678926928428df28b70c835db40805a9ebf138ee293e439fe68f7b7e94ef75a9b6ee42e6578376de74ec7d1e53694672844dca91
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JzA:A3kMjKJt
- TLSH T176259F03E7A410F5E55B8230A9E54612FB75BD621B60C6DF236882252F737C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 975KB
- SHA256 f6fee7751614b5a3a8949b9b80afd64e04a231225ca9de2a6ac7fcd1f6964e2f
- MD5 d07f7176cd1500e36f2aefca1b567c0c
- SHA1 72fc80acb75fbd8c3ce4b380982b5318fb799fdd
- SHA512 3b2041976bb44223557566d29656d163b40120b0208c0dbc3c1376a913dd65969fd84fcc218bd24a448dbcb62efb3c2953657dc698f07486624ac328ba1e7d79
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JE9Q:A3kMjKJ8
- TLSH T1BF259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 975KB
- SHA256 71dd350bbfdde0c7d3ed7af84dc5ce73f4cf21dc060d9a8794dffa062bb7f431
- MD5 131c8acda1325d5de8e250daae67314a
- SHA1 cd4862867d5f4df3e45e518f1d757c93b06a3eaf
- SHA512 8d87640986e8e4c0dfdbd12db15e248ead03024dcfbc64ecfc675d03543e13877dca8216727d25934178f0659edf6569619f69f95765d0cd0b3b9ad7618f3f55
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8Jd4:A3kMjKJX
- TLSH T12A259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 975KB
- SHA256 fd5bbeefd355fb0333348c6b7eb0fdb4e05e88db06d9d75bdf265fd0dc88df48
- MD5 a443383abeb609a6765314fc55c8d3df
- SHA1 a9b4dfe0e67f4fe9836cb57726b27ec522040c83
- SHA512 214affc3c1c5f658bb0e17bc37e2f6198036014b96f7ab770a549a70565a07a7ca4f8f80428585a354d748daab50cd3d94899ae198487f66d86cfc587c61ade1
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8J4u:A3kMjKJa
- TLSH T1CA259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 975KB
- SHA256 4baeb42d9b56e067e8523a3573e433d15e71c7769a660a76f7747d46818a0dfb
- MD5 2e1b06c236b1efb001e6fe2192d79f13
- SHA1 106a7fb1283d7ad4661ca60eaebdb8dfefb640df
- SHA512 7e97220d56fb027c998f31e81f8c44c6faca867675e090f0d2ca7204318de0695117a96760d3b1dbe802e8908a9590aa05b0922fb58ad896c9a5669863fdb9a2
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JZj:A3kMjKJ0
- TLSH T1A025AF03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 975KB
- SHA256 406e75016551747a82480b802b841e531b2a1ee1d240f2b8f5f3ebab2c4b0a25
- MD5 00105f7ea9c996aa621f1a0aaf5dca5f
- SHA1 4b8b1691a63cdc7609d0696ed40aebb5fdec6cdb
- SHA512 01aa006f05f15c41e11b0552a857bf448655222b1df3e3cb5d5a3e777f1df13651b45219c5de6fb622146cb571c4daae143fdd2fcd848da31a047605236a7adb
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JAg:A3kMjKJ8
- TLSH T15025AF03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 975KB
- SHA256 eb8b1a6d2dedbbbc1d8e2eaac5cbcc4ff15bbb4fbf61267bef68d8c6f6d1b5cd
- MD5 9e316e1d3f3f47f24a114d8c2fe1c07f
- SHA1 12f974b9121ef183384cd562680510aa8d015570
- SHA512 8dba8d6819df7ec7b2e966bb8f4a435aafd3eaab325c246eec5e2ae45dff8dcf8b4d2308f089ee073f1b49ffeffbb3afe80a67024066a0bac1b327a1a8251f53
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JvI:A3kMjKJV
- TLSH T1F5259F03E7A410F5E55B8230A9E54612FB75BD621B60C6DF236882252F737C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 975KB
- SHA256 32043733ca8f961ae64864f0a7a5c61bd7790a3400440836b9b3b2faaf57c6aa
- MD5 33294b00d6bf6063b5d7fdf05a0a0927
- SHA1 78134512acb9f6ec2442b5df070bfea75e1dea1e
- SHA512 adb42d8e4d1b51a27b4e531af8b6aa87febd26529b7b4b606ba6ab4f96e0ca1c7af366f39228ba08ac81d83af301a891051202d41c579381049f6faec95ab346
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JVo:A3kMjKJD
- TLSH T174259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 975KB
- SHA256 89dbc9ffc443fa0914370b1e6cd6da218144e7348f680bd6b5ee900ea6c44711
- MD5 cdf99427c257b8f78083bbe3e3b66684
- SHA1 578cc11ca53cf84d89342292f12cd6b50bac940a
- SHA512 c279f92a15accff0ccc0e1e599a2f6784c8334a96a39169745d7b1e541993608a3547cbc533d9e986994f288c076bfca0d25f8e89ff6665adc1cada6ee80b175
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JG+:A3kMjKJG
- TLSH T1FE259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 975KB
- SHA256 e19f827e569363275e9baa18bdf66b76097c7bda9b578429837b38bd25892f28
- MD5 757314ec069cdbf35cf2501ca473aa90
- SHA1 c82ceb3f3134fe53ecf2fea1f88b892f5ecfb196
- SHA512 59f839002eaab1154006cfb5c342659f8c000d8f20d58127fd7a1d2ebebddc25d18016b928b6fc3ff75a122f8acc9b7de97f8ec8252c3981aef65632e268004f
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JGQ:A3kMjKJC
- TLSH T197259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 975KB
- SHA256 3fe54136e794ecce75da5d4d9d74dfea57b8a80c85d3023d8a7750b121049f8e
- MD5 331941881e6904a5021b43ae6e98c172
- SHA1 a9e402cd72dbcb1140d0319b127c15aefa2cb91a
- SHA512 a7746f8fc8d3d56b5cdadfde0f34c14d251b06e535784d23942013d17ca5d77b80497ee82d2b7190f8253a059278946a352563dc7e1d12f4867c4c8e8674373b
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JXX:A3kMjKJS
- TLSH T1BF25AF03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 975KB
- SHA256 9c9ffd7a2a5e8ad8e10b85f8aeaa335a7517f28ad0174b055efb8319147edb78
- MD5 8f721bc94512db97f7ab629a7f045dd5
- SHA1 16200c6f40941426316179a333d7afecee2ce38e
- SHA512 48de3e205a3d41a36637fe9a214183b7e06c623709fb70b2e18f56c75c6fce00e76d9daffa16fa95d6d8fb065da6c7141f631323dbb9ffaff1f95b15b69300ab
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JNL:A3kMjKJ8
- TLSH T17F25AF03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 975KB
- SHA256 36682ae7be24526ef5158373d6fc249e8d9c521d33b9b81baa1603ae875483cc
- MD5 95ca727ed6db059724eed7379981a0e2
- SHA1 26c1208e3e47d2fdf2d877e269afc40cfc1e98c9
- SHA512 8b2abcdb8ff38d53f77afb9df8154e06f5b5e4f0b7b5afc0f494034ae449150f2ca88ccc92b56351a210c44e681992770079dd75ec0a4e123d1a99422401017c
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JLM:A3kMjKJN
- TLSH T1FC259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 975KB
- SHA256 aad36eb0acb9de5886c0bf8de2aa6d27bc051964d15c83a588c61cedd211adb2
- MD5 402d066eea69f95987ecf3661517a2e3
- SHA1 15eb9a32495461790db59c9f56849e15a2a23c70
- SHA512 ca0a701cb85e706e5c20e5c4a9c634312c0a2264bf94641c25101cc5bec2b7cc925d7cf2bc7c8c7ac4e201775113fb2d86675f1bb115b092f5849c1881b55e17
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgEOaRa8JMh:A3kMjKJn
- TLSH T1CC259F03E7A410F5E55B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH