Analysis
- max time kernel
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 18:51
Behavioral task
behavioral1
Sample
2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 869KB
- Sample260724-xhg2esar4y
- SHA256 09fbbd3f493f323d19152c3a0c341b6d82d9a50bdf13598ce8c816ed791d203f
- MD5 d0046ef97172b77494571fdd54ca7dc5
- SHA1 a58a1416b10b67483225e3bb3965d48f18a1da89
- SHA512 544131538dd5bd393df76f6c8d20f315ed1762544aab8de6bab4bdb131773ba3ba790e7dc70326ab32e889e20ce4e88f88fe2b63ed9736f57bc19cd26087223a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/:A3kM+
- TLSH T16A159F03E7A010F5E666823499E61A12FB75BC221760DBDF136487252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/3116-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c448-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3116-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5736-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c3-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c85-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019845-222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a56-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-449.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a55-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-602.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-627.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-664.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-731.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-833.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-960.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018923-1525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b0-1864.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c448-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c3-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c85-60.dat aspack_v212_v242 behavioral2/files/0x0004000000019845-222.dat aspack_v212_v242 behavioral2/files/0x0006000000018a56-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-327.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-449.dat aspack_v212_v242 behavioral2/files/0x0013000000018a55-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-523.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-602.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-627.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-664.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-731.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-750.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-833.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-960.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-961.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1018.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1074.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1105.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1174.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1194.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1232.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1336.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1356.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1381.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1388.dat aspack_v212_v242 behavioral2/files/0x0008000000018923-1525.dat aspack_v212_v242 behavioral2/files/0x00020000000066b0-1864.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5736 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3116 2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5736 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_d0046ef97172b77494571fdd54ca7dc5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3116
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 869KB
- SHA256 09fbbd3f493f323d19152c3a0c341b6d82d9a50bdf13598ce8c816ed791d203f
- MD5 d0046ef97172b77494571fdd54ca7dc5
- SHA1 a58a1416b10b67483225e3bb3965d48f18a1da89
- SHA512 544131538dd5bd393df76f6c8d20f315ed1762544aab8de6bab4bdb131773ba3ba790e7dc70326ab32e889e20ce4e88f88fe2b63ed9736f57bc19cd26087223a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/:A3kM+
- TLSH T16A159F03E7A010F5E666823499E61A12FB75BC221760DBDF136487252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 922KB
- SHA256 824befe6c43b8d9c3c0c6449b43290e0d15368e1272e4ca666a277ff18a2eee3
- MD5 d825faa7560511d3dda6b8ffe5d93358
- SHA1 d53c8a590535bcad954c866d9afc36f6e5671e15
- SHA512 4030b114a318b2bca747555675eb86efa98a41074dfcdef1aa714ad8f86095733ee4fd33feef67b7a1d771447050f180f39bd043850d0a95fc4db29663b55fb4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/6fj:A3kM+9j
- TLSH T1F315AF03EBA010F5E656823099E65A12F775BC221B60DBDF136487252F727C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 968KB
- SHA256 dfeedf009f94965b0a357577ceb1d4398865ae8f716bc43e7fe4d18194ac8bdd
- MD5 8640b545c99712511cba5732b2c6ca3d
- SHA1 3dff66c4beb37e368a3e10a7df23af6619e3f3b7
- SHA512 9089db1791cccee89cfb9137686f66c7d7518944d59bae019b2d9a00199fc67e18bc57e7c9353b047e779e6b460a50e7a890521238b741fd6fd8b241e007c9e7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/82MqDBxc:A3kM+gMqlxc
- TLSH T11E25AF03E7E010F5E666813099E55A12EB76BC221B60DBDF236497251F327C0EF3A7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 a81759e4e21130f8d799e9aba5d3fd03711f6c9a28d6f7a845ed0db60e351107
- MD5 877aefcb757dd55a6286a2ffbb24dde8
- SHA1 67949e0b330ed185e5a1e55984f135ac288f62ec
- SHA512 e1163bef65a2e274cd8397f8e063e79120ccbd19131839c4183fb83976d558c90c52b445fc8bd3c665d0b35aaef3d152003faf656f953d0f70a258d9da12c168
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/P0Le5ji0hmxNrM:A3kM+KPji0Aj
- TLSH T190656B17F6A402B5E073C179C9E25A5AEB7238521B308ACF1394C7692F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 884KB
- SHA256 fd88689623a048513999d0e494dbbac2f8e79aa2b60c48214a4b3eb8a47b676d
- MD5 6508ea9327c72b792d0097ea84f895a1
- SHA1 0d31b0356947d883d79e4e22c34e7222b15c4f03
- SHA512 16d01dac573720965db88a5c6c8431c3c2673f2bf4cfc31a8a5bde7a28e6eaf41f1987cfb38a1bd159a3813fc7b7f41cd7b956f893095ca2d3923bfdedf2d3be
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Ra:A3kM+
- TLSH T100159E03E7A010F5E666823499E61A12EB75BC221760DBDF136497252F327C0EF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 917KB
- SHA256 c3497b3193dccb4c9a0285cec217cf24b660883d111e2e152b209a4f39d51cb5
- MD5 439e4bea1c253b6100cf9816a3ec38ef
- SHA1 26e871306bdfa27d19c6990bb48369dee4d53d0f
- SHA512 bf62f907701e0e57f67fe9941c8e31f8fd47a3f8be5d4638fcb088bfbe201d058c79b40703c480ac081d17d3e08fc29d72121444ad4bf29ce05ac3d3886bd79d
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/yb:A3kM+Pb
- TLSH T17E159F03E7A410F5E667823099E55A12EB75BC221B60CBDF136497252F327C0EF3A7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 893KB
- SHA256 34e4812edb5a01914389b882e3b37045d6018f550af2a3aa45c4b795a9fdab4f
- MD5 481ee18e5aca1c5a7e83307c336c00ff
- SHA1 1c6094317fdc3922ac53b806ffa3ece2c18e88c3
- SHA512 5a09c54536b7b855d598c1a2cd50ede7e8ece442c8600cba248e3adafaeb313351140a7f026e0ccfe3f98a2e5792cb792c46009234000c641ed1f15d5b84e13c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/o6:A3kM+U
- TLSH T113159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 893KB
- SHA256 fc9319f13d9fedb009b9c2d7b8d5c771568c1509c1bb22dc01d33590764fcb69
- MD5 9c8227e2e6852daf8c8d89ed80859432
- SHA1 6134796798f94792b99a26e54fa8791670c3013d
- SHA512 302f8fa34ac6c4801e2281658c0881330300ba702cc64d6b511b9bcd07ff5322ee10b617bd90f3f7af9e0b0b103a1d92bff63ccf97e63a6e7686bf1ad47951f2
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/sN:A3kM+p
- TLSH T16A159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 893KB
- SHA256 5e3f05a32a5a2a333397a94cae2f099280dda06f10199051bc4a39e65ed379c2
- MD5 1487e0fea9bddcae60b7223ae5834fec
- SHA1 50674182929e647be84a900522b022580a03d5a6
- SHA512 578a4e67898e0f7010a7121c6cd8cc037eaf32e41dddd5d0a08b1fc3813b4bf3d59b93b76fe18345a5b646388de911ff4b3258fcc5546a5e3d1f7eb95d4e6181
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/if:A3kM+p
- TLSH T1DA159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 893KB
- SHA256 ce80209709ad105d591998adf04e77936260ab0501f8094e103b10581f1bf336
- MD5 40574d7ae8778ea0ce260d18e1c3b874
- SHA1 8d8335d72bf871fea70a23b1bb92aa6dce627cea
- SHA512 b62a94cef3965a7bba8e52192c4fd9a24f8d4f83269d2cbf1471f7acedc068d4a883d3876804ce48586d166e1d1503c302a658572b0a5819d3da7212bf89129f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/8o:A3kM+c
- TLSH T174159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 893KB
- SHA256 a62dae4576fee527340a4253bcb1ebd9a319897fbf229f51c14240aa99fc7141
- MD5 2c4d78f88eed7a50bfd3b403dceea612
- SHA1 dd98d11aa29c80f1d7b6b7d2e3e0de891918b106
- SHA512 f05b2e7cfbb5fffe4ff9b651588f866947cc9784d786b234167f1abdc7cb9fc94807decad299eb7e55230dd06729bf0e140d995e41bc7c3dd2d41d60287527e8
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/cu:A3kM+e
- TLSH T15D159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 893KB
- SHA256 d9a813a952500f4597e638b3c067a68b9337df4efe4258baaa17df97da93f3b8
- MD5 7a0cc9888ef780955fd44bfa9b0fb44b
- SHA1 f36b90dfcecf1859dd62dafcd6781595d352ccc4
- SHA512 e3e6ebc52a8186256de6cba5629e9ab99dcfed5ac2bd7599a628d81e76f40bab075cf846420c12efb1b86deb751e38f5bab786f07a605c0b10439a3fce820850
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/g9:A3kM+f
- TLSH T130159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 893KB
- SHA256 75958ef080263d00d276371a60492ed8be2974b6af672eb8880456f55f409148
- MD5 6991ccb0818e88e6f9d0d595e4f1f7af
- SHA1 1adefd4e8517ef32282894f0c436a3af36d57e3d
- SHA512 fcf800d6d62d5e5a4249a248aee78acd77b749843dbcae5f51aed5beed897a963f0a05352f31e0414825cdafbb3b559277bc69a848b3cb9ab30a5d773e0a3057
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/oc:A3kM+e
- TLSH T163159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 893KB
- SHA256 c2fba811297c343a79fb97364355ff78ce1a499c8daf8cf042e65d0fb60cd186
- MD5 68e2c9052e09151cd7fbd386bae762b6
- SHA1 3b98efde52ebebea576e8e5f66a794f1ec01e9bc
- SHA512 878056471e3005ea219c57e7e3ac1d5212c0208f2a1f273203b31ce8bd82240a1d4d5e1f9955a6cee0981a6ac34f1dcdb17c540906a4e216d2b087035b09164f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Bp:A3kM+s
- TLSH T163159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 893KB
- SHA256 c5b7ad6caf9cace9a4846e42edfbf5566a9b279040f0528baae7545b1fb05dd4
- MD5 69234a814fccb4c14c2309ec5a5befe4
- SHA1 016a9f122ef7c47a6275b7d652cd4ce44f85fd0a
- SHA512 80e8e1c46af656ab193008be0c3a33c997b27463f052de1d1432cd757687d204e39072c9284a40c8e5dc8b80f530a440bb6e8f32773132d39f5ef6cad2dfcf4f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/WN:A3kM+r
- TLSH T1C5159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 893KB
- SHA256 6ab31cadca80cd93385914ec89d23e838adad9a6518a1869430e585b9d10c00c
- MD5 abcba9f4082a3ece31028fb14ee9f3c8
- SHA1 07614cf10c0cf995c0930c40230de62b92f08959
- SHA512 1271e49122a8d331fad30ddd7819654b8f5c4aab9d8f368a35965fd9a5e0d66c95730c4661c13dba8c6653ffe56c88bfb394d7f2ae8ad6e3b23f2dfb96408f47
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/aF:A3kM+d
- TLSH T108159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 893KB
- SHA256 780cddc3610a84ce98e9a953f14d578d69a632ed74052cbab466df2c6c8397fb
- MD5 fc22bb9278374d1e7b88298f68a8bfe0
- SHA1 13aab00e8f366bd2f69f19f160a5f5cff8e47f1e
- SHA512 c2a4c2ac5088758ed36428aef4e6235c4c7d99ee04202712f8e124b5868473d32756e6f94a1529a43d03f6a7cd9c257642d1c4b7dfd0e871a4380bb9ef79ff77
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/vC:A3kM+B
- TLSH T1CD159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 893KB
- SHA256 b8c44a0009aa23ce753006f3b9352c42d356d75f866b7fc3e5e7351cede3f2d5
- MD5 e3538b1be9d1a74b677f70b5630df5e2
- SHA1 468c963725c692e7ba319a60b322ad0876198201
- SHA512 4d94105c51056f123e3586066d850e73cfa46de99e87fbfe3182438a98a1a974eb9a6024897181dc34674e2f7a5f56ca9a324b9f5032ea631c9100709bb21725
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Qw:A3kM+M
- TLSH T11C159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 893KB
- SHA256 9fc188c6652ed928fd632bf9defdc83c01d5d307d01363d5e9157c3e695cd82e
- MD5 99c4eae0fa72d1508a44a072c53574fa
- SHA1 09a8d07d1475050d6edc3912a88b62bd0800ea15
- SHA512 179db342f99b94b6051ad9480f14825281da7caff0b6c174bfadea96d1166dfacfd542f305b3478558c0016d49a3bd6b04751be3675b226bc48f0004a3fc7179
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/vT:A3kM+0
- TLSH T12A159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 893KB
- SHA256 45cb8ecbce837ba1fc86fcb6f958655a737bb79b2d782c1318a31229d7b41a96
- MD5 4d3c5975f34662318add1bce02892b16
- SHA1 8b1dcf610517cf9c05b50bb4c1d2a96561fc0db7
- SHA512 fdba3b590c1f4c4322c0f7b9189e66f623654d7766a9f234890c5a61c6599959fec66ad6d138805164403674ffecf6bec27c8e8ff7add5025f900c9c491e2656
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/pu:A3kM+j
- TLSH T1FE159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 893KB
- SHA256 c2242c973f0ed59180f4918a84118dee050c54a89b79b0eadadda6d281de6f87
- MD5 782ec7185b7483cdf98223bd0222e539
- SHA1 eb28d9a66ec818dba5a3ba00fdabd14c24af8765
- SHA512 2be749a45d28dee38f7aac05d06058cf8d1e7b11231128be223eced2bf52467e348c94a170c2ef9cb06f422ae5ed9abbe2a45d97e50a6028e95bea1235234950
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/hb:A3kM+q
- TLSH T1C0159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 893KB
- SHA256 8559580c499f9ea68f2543df4c5b2b958943f39fd2a73c363a96afde34ca3633
- MD5 0871621801b89cccaf2ded094b7331d7
- SHA1 afca4cae5fc4c6917e259a2e6312d0296bdf4e60
- SHA512 9e558ea3cb1e8faf92ebf86e74f6550d406ce8cdb395b30bb2bc84782ad87f478846ace3e4d4c3aa8450991a1cfeaef98be38e6ebbd973f7ca42b46dd6cf6748
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/pf:A3kM+6
- TLSH T1CB159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 893KB
- SHA256 293e64b7f6ad838b6476e0447b1dee2e394d90caa812d642698241e4b3bebb9a
- MD5 27ce7f604c9575af24d8080f75a5be5c
- SHA1 f889e02480df74cc948e595645ef8c57a9e2a360
- SHA512 f0286a042a50928089140b026c55cb2c597f9ead5731e7a2d80b09820ae816e95a58ac150940c2c9f88e9b502a43c8c0d8939a19617ebf64352a09e432642713
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/SK:A3kM+6
- TLSH T189159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 893KB
- SHA256 831667f616eb9d29c5131c465d225cec682813e9d45c83cf2f04ea123195c9f9
- MD5 6e7635dc234d576c50dd496d6d8d5a38
- SHA1 abc830b5ef3b068efb6bdaa5409a02d1a2276a18
- SHA512 f8b0a2b9bd15ea5b4df711888e6e0170ba4d438f86a30e1bbd23608d8ef0e2ad50e7d2b1fc0cddc53f7d773c2b117a7f4e73db270ce315481c3b865eaf0b84bb
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/3k:A3kM+f
- TLSH T131159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 893KB
- SHA256 bad0aa3f4bd8993963cb26af49af2cbedd2c1a30b1e4a56f3864b9c61b209044
- MD5 25e6650b8b50be4f130dc6c90b353be6
- SHA1 6b6629a06aa8ff561c1e85aa4f130fccf76c26ba
- SHA512 7677288158867183dc8e6f0a98a8d24eb6eb2a95b4b0dfdd63ddb094289d3c187413e02ce5dc3ae31217965bf63b419a9a5364ac6a6b32ffdbd2bb488c200cd6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/A0:A3kM+u
- TLSH T1D1159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 893KB
- SHA256 00504b4ae818f8eaa15616117ffbb274a65576225ebfd3222a3e1080ceec1fbf
- MD5 a0dd6b935d1ed47ac96401f5e857d500
- SHA1 0adbba6ee4c25937f7750fa8e69308e87c4e8f56
- SHA512 dc9e352af6eebd54c9c2c74c0e627eb5c096929fb5a0337bab3919de661973dcc76f952b729060bae5e8273a9d6f1a6365d9c0adae2037098dfd3909a071e674
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/bg:A3kM+3
- TLSH T188159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 893KB
- SHA256 81b48feaef7ea3e696c4c565cb1696cf1e36f8e24feec43138ef4b3ae4be84f6
- MD5 ad3ca8bcaba1718f1c96cd4e38e88a43
- SHA1 8527e4ea7e8df6c404b5b0fdbd1feb75c835bfec
- SHA512 e8b76cf8b8498f1b03cbe006813d82b6d0bb375824b1854d49c5662094a349b6eacdc9a152b85e8a45f075febc0853e38e3aac29544c4f0559e47e9f6db06714
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Wr:A3kM+R
- TLSH T158159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 893KB
- SHA256 6b442edeb90beca4335f0826ea719ec9b1a378c8f684e669183c4830d48f489d
- MD5 0d993821e15b0303ac97b1f1092e27c3
- SHA1 7985fa1d984718b2ebb4a8bd8870f5774dd943f1
- SHA512 97ac90545be655b38a809a2d50fb75e5329a7c5fe6311f50b5700a4170e29d2542708efc736543297aa5d7f01a038b076208c2fb82bd668718d2d153a6bcc851
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/8n:A3kM+b
- TLSH T155159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 893KB
- SHA256 e0f61f4d324ae3e0d0ab19c08e4c8419a29d1c0242df8394284d79ebdd8d895e
- MD5 a2abd83c764cd05ef990794dd7913b52
- SHA1 b9ef9dcb750196d85d09e97999165a1f158dff6c
- SHA512 eab48f8d16e9eec39cca4074a7176e1da4acaeb245d83f7b152600e8758464112b3ab0a91b217f72329151d093738b9e3ea836212d42e660c8b94e828e9e793f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/6x:A3kM+J
- TLSH T1E9159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 893KB
- SHA256 0bad129ece0f64be40e377fe5f6ed9131e7cd60ffeacd043cb804cf179ca36e2
- MD5 4b91ccde81318a193975042a2677862b
- SHA1 34218f8353cbb39227da3efd2a8cedaf2cee3627
- SHA512 c2c44561763e1713b77002ab353d3ab55b754e88d6a64055c99ac0d0bf9da359b7e4d8031e980f7eb53a44db21d4cd8bdf544ed986ca2926af76bbbd1b8b310f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/8A:A3kM+W
- TLSH T1C1159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 893KB
- SHA256 93d69265175f0a1e4d8b5ab05dfc9b2f20c58ced4e40bbf5700f69800098b915
- MD5 43fdede08a583a98125c4dbc1d10e7d4
- SHA1 95b7590877d66f05aa7719bee412ef46583c18e7
- SHA512 146d1e234fd61b2d5cd49ef3351245d8c17c675c65eadceec9f34fe2cb66816ce258fb071d298c068261af5932cf48ffc3a5440cad813c3b09735802baea01ef
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/l9Q:A3kM+L
- TLSH T15A159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 893KB
- SHA256 2cf8465a17676cd41ad1b1259c49c3e1b1eb57fe4b8e34c33b0af86af8042116
- MD5 55d4f844a49e852d410ebc0852a1fc25
- SHA1 27dd4c123ada1eaaa01aab1ca8eef8b4448f966b
- SHA512 2b7bfb3537551fab0e5e26c175e3efd2f8c4e3201eee741caa48b9dd1a965e86dde4452bc90ba60675908331ab78ffa5a8b236ab7bbf149732d110b6f92bbc84
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Q4:A3kM+c
- TLSH T1D3159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 893KB
- SHA256 b0eb5b6e6c2a913e32277dc55c95cfbc4a4ab40b490a5f29ab7fbd351b1d99c3
- MD5 25a368f5cc0b22e48895659c980b8b8a
- SHA1 01ffc00bbac29787f5b245cdb4c540308b3e0095
- SHA512 d98de0dfb399321f6f951104832ed3e5f4b1487fc4690df33f7432e4a27910884de4d5c5bc75a0cfdd8a3a1558bb9853925968e87048a07b09cffc6c24cffb19
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Tu:A3kM+d
- TLSH T15E159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 893KB
- SHA256 06d396924524926e87de867a87134da5ffbb5fa40c6001fe4c8a148c761ae390
- MD5 71a95497d7fe98900bcdd1b70232ad36
- SHA1 f7f9932e227008157c5c1b5ec2b5c8bc646091db
- SHA512 697ee4a0de96e556cec1cccc39f853118a8e5d305cdc9ba36e91959598d7e474050d02e0d238d0095222e78965754da439d3f6a3aa27918705593b6ff7e97d9c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Oj:A3kM+f
- TLSH T146159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 893KB
- SHA256 be61022e52bc7622c512a665e3a9658f98a9206aef7563f01f4b2a538d9ebd76
- MD5 68871e311bdfa977177eb92a09eb2118
- SHA1 804d8bfc2f918992781da6d8c8b68c4d16df0984
- SHA512 bc59e31765eab60ed2266a366eb315195a8a4ca3ed329174eb4c08948b4a695a39aa833fb6602f414b5959c5a3463129ad7e67f305fba3b6406896fb9334b853
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/7g:A3kM+X
- TLSH T173159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 893KB
- SHA256 faee817677ba7597cc6d07e3468ad1cb9e1ec0829b22bc8a7e3e8016aab587c1
- MD5 e816a6eef8e96e99dc032944d11b5a3e
- SHA1 12d3141e63366396ef415b31014ee76aa253846f
- SHA512 89f0a1de9586d42d113507d5ae6603010b6ccc3b1ef68a0ab839f379b18bb03030356abb582a93b03ca7212540ab3332630c8fa38ac5d54f95727ae3a4a707de
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/mI:A3kM+W
- TLSH T17D159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 893KB
- SHA256 f74d38f85c3630fcd9e9027ebfd69620447be9bc714ce4cd88e32133ca58acb8
- MD5 2377da33332ab20044b9269d67cd1abb
- SHA1 917d681f6613d604b6715fb52e3854998148cab3
- SHA512 729905fabfdfcf4796a0843a73168e9f313a80318ae898bed27601fb9cf79ede030bdc89825ff80b6e3fed63f80d544f0412045fe21c0b549826cdb8c76c3b30
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/Uo:A3kM+k
- TLSH T17F159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 893KB
- SHA256 19af9086e1dcd60ed9ded0ba5d3601888a6a4e6f5ed788af3f72e05f18f46445
- MD5 19675251df87bf16d54e0f591f9d9485
- SHA1 1acdcdde022ed947764c5f48ac71718594901911
- SHA512 2f55acaf6bf36ff35c81903361d4bdfe5ddad9c17c0378466e9e8dd29bf82ddfd71d6211724eca51c7575124e23c1ad39c076800ca06dec6c095af537fd575f2
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/3+:A3kM+5
- TLSH T139159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 893KB
- SHA256 5b9b01c59c97faaf0519cab3d2c48b9faa6a18fb314951c7c49d28d3a83a561b
- MD5 d70f7068eb31d5e0015d3687e68ca065
- SHA1 4d84d25424d660411995eea67e178f56944ad63b
- SHA512 744ecaa95f75b2c3cb51644b28bd43ae8909dd15ca2ce4e946cf986888519c84e0dbc8ecc8d8f38485fa33cc9ad72e34e2793a3dc8aed379f85eefeea0a5958b
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/NQ:A3kM+J
- TLSH T1A7159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 893KB
- SHA256 d42f6d87e7685840b5492684634bb7fe4aff2c24ebe5640e932c9c690f5b8bfe
- MD5 062f86329926c321bb32dfe1e772cbf3
- SHA1 c5c05587977612f31f3fe14f06ff53adbbf417a3
- SHA512 256419cc9f7dbe643aaaf648338f4aa0aff0c5fa7a5b8579a7fd0f9ae6c9e246f8b709379300ea4297dee62782f2e9d43b9adcf1ff70dcac66bf80f2112cb832
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/CX:A3kM+V
- TLSH T1B3159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 893KB
- SHA256 64e080fc673e38f3703c0bc8e6fc07623d4dd7cca54edf2918e03c1762545a7a
- MD5 5d628b2fb1297fa35a9a42e1f059969a
- SHA1 3062c2b595f7e728b47051ec0623b412ab7582c6
- SHA512 79278d8cc50363a585407f351f6a232d491ed5b8c80da8d146a9657728f61a00b98949fef89d307cc8ce4b453010eeaee3a8615959b5586a2d0ef84f17283564
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/kL:A3kM+H
- TLSH T174159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 893KB
- SHA256 7da1ae5d112b76bcbe9b49dc8893bde8749f591e9a455ac254407320b6f7d0a3
- MD5 2580b382c76187d5cce9e5784aa90fd7
- SHA1 18dbe7d8426b65a243ae525aafa5524a4cc2ade8
- SHA512 ba7a1b900cc950d16f698f56fdf294c193413525043277f21f50c96ba468d692147f7d9e59f867084e73b80799ba6656b468a33b7a7294cd6a35034031643614
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/AM:A3kM+C
- TLSH T15D159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 893KB
- SHA256 8afbcaf62dd01586332139d9ff4acaa9904009fdf122c981c5039fd532b22598
- MD5 c38bbe9d976d0aa35bade402e99dbc0c
- SHA1 88ef53fc8a98739b491e95f2f3fccf22ff6225a4
- SHA512 b71b86a60bbcaaebb8479340b35b5b202fc14fdb73bc9d2a79fa9e937c44145e23540b3154f245984ad6419ad57a11771688e4e98699f2a79e6a5403c1b19035
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+c/hh:A3kM+8
- TLSH T14F159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH