Analysis
- max time kernel
99s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 20:02
Behavioral task
behavioral1
Sample
2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 745KB
- Sample260727-ysd8ysda44
- SHA256 57b39b5fb0af46397a75e7728b61276ec29b64c62cf4f3549dd19c06ea126a10
- MD5 7e1288a83955999f13e930fbe16440d5
- SHA1 600f932fe48a5c64f09d48d17774338699234465
- SHA512 e31028ffffeec37c403db5aa930354ea3eec404b3ba4eed373802a616a8f7ee0ea8d74bed3c91b87408f62598533520fcdefa17f3fd68d734e434c9e79e721ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvN:A3mnXoZjzyacNVOE/ZxUiKiYZacvN
- TLSH T122F4AE13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/4588-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001c458-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e5-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4588-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2020-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ba7d-237.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198d2-257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000018a52-414.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-469.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-604.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-721.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-784.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-846.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-865.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-981.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1050.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1081.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1130.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1219.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b667-1876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b669-1991.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b668-2004.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001f00000001c458-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c2-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e5-39.dat aspack_v212_v242 behavioral2/files/0x000400000001ba7d-237.dat aspack_v212_v242 behavioral2/files/0x00040000000198d2-257.dat aspack_v212_v242 behavioral2/files/0x0014000000018a52-414.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-469.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-573.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-604.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-721.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-741.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-784.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-821.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-846.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-865.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-884.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-949.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-981.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1050.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1081.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1130.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1174.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1182.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1219.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1322.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1342.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1368.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1375.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1382.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1395.dat aspack_v212_v242 behavioral2/files/0x000200000001b667-1876.dat aspack_v212_v242 behavioral2/files/0x000200000001b669-1991.dat aspack_v212_v242 behavioral2/files/0x000200000001b668-2004.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2020 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4588 2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2020 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_7e1288a83955999f13e930fbe16440d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4588
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 745KB
- SHA256 57b39b5fb0af46397a75e7728b61276ec29b64c62cf4f3549dd19c06ea126a10
- MD5 7e1288a83955999f13e930fbe16440d5
- SHA1 600f932fe48a5c64f09d48d17774338699234465
- SHA512 e31028ffffeec37c403db5aa930354ea3eec404b3ba4eed373802a616a8f7ee0ea8d74bed3c91b87408f62598533520fcdefa17f3fd68d734e434c9e79e721ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvN:A3mnXoZjzyacNVOE/ZxUiKiYZacvN
- TLSH T122F4AE13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe
- Size 844KB
- SHA256 dbe8df3d38b00bd3a091686f7e3d849cbc7bb4b4c76a08781db0fd7ff9153e0c
- MD5 9ca2bd0a810985aab67caa45555a908b
- SHA1 74fdd29cee0b5d9bcf3f2df510d2379f4ef9a435
- SHA512 9a580058d193664aceb376a7a511f2e8cccee1402ea548c2c35d00f8a6425876ef8c4638f37cb2e06a62ac77e734add6517f51ea1770d3130e7b7203599be570
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYZacvOIxITB1i:A3kMnxI11i
- TLSH T19D05AF13EAA004F5E516853099E54A22EB75BD635B60C6DF335C82252F627C0BF3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe
- Size 961KB
- SHA256 15470d2097460adeccd469d3d647e3c6110c6fd082c066d3e55a735071e1ee7b
- MD5 d5b37b3c6e35112d58220a7f80cb0fea
- SHA1 6daaf18cdabe68b74444439c0148e98b226ec61b
- SHA512 05778862f4dae0a6f758796cf878d0e6787a024cba160f58e9727efc3c9b5bc6789f4fbf3044f7ae7ac3d53e8d45436e4104cf7cbb34c77c4a92ece899039f79
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYZacvMGmFyHUj:A3kMnEP
- TLSH T165259D17AAE404F6E116C1709AD14A13F775B86367608AEF535882151F23BC06F7FBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 844KB
- SHA256 2b0372788d220b34eb8c3293cf845eea8026b9650510b8e4d52605826691e087
- MD5 8f134708a2d9c45a0b044a421d95e8c1
- SHA1 4df353cf1c9c63713872028768f6b91aec298e6d
- SHA512 441c971fe273d8dde00eac12df265dfb1906f75b244516d0871d26b56d34f65ca3ca4c65caf39d0513496018ec20a3864b821d955aa5d4ee0dfbbd6b76910583
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYZacvHbBPzBAU:A3kM3BPVAU
- TLSH T1FA05AE13EAA104F5E516853099E54A22EB75BD635B60C6DF335C82252F227C0BF3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 97bd4fc5bac4629624b71ac5d0b0be4a578e4c051d5781b0e43c8c1f2fd770c5
- MD5 007f1a2eeaad1e39227bd5acff5ae258
- SHA1 282664f0dcd5595ecff3ab30655a5c382221e2c3
- SHA512 95fb36c0b4edacb578cc170e62d64c69c91715814bcb718172a99738f56edcf99c0e706f526c8a00bfac40f5bff61f8491109a21e8598fcd2a7dfb480187a027
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYZacvZ0Le5ji0hmxNrM:A3kMFPji0Aj
- TLSH T1DB557C17FAB446B5E023C1B5C9D2969AEE7134825B30C6CB1359C3283F63BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 760KB
- SHA256 dfd4f88424d04ac1a8cc12f37af945b51123c96dec636491a3e3aab7f28e2174
- MD5 42487758d005750d56faae68e5ee7fca
- SHA1 7cf0d039346e81aab228221396d8dabded5a0722
- SHA512 c7cb14bc51699f627249fd2bfc4697a15454d52dd95691f1413061aa4ef09a3e1681a13d813002aec48b095ffddf373609d684830eb5a94c56776e017785a2b4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvLa:A3mnXoZjzyacNVOE/ZxUiKiYZacvLa
- TLSH T16BF4AE13DAA104E5E50A8130A9E54626EB75BD675BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 769KB
- SHA256 5567479df20cc87a14ab3bd64d1c2427aa099c5c314049ae5861b29fa9f8eafb
- MD5 a5b2ced0d61acb0820059cc0660aca53
- SHA1 5f0ca055f79367894153a0feb88132710542ece3
- SHA512 7eaa23e3eb2f35d5cdb0f773236aa4f0e5fc5bcf3144db144d3df0ede8fcc84b386cfc0da2514eb91366df5468eda4a2bbdb2f3a5a330870313e76dbc9cba281
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvK6:A3mnXoZjzyacNVOE/ZxUiKiYZacvK6
- TLSH T14CF4AE13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 769KB
- SHA256 dcb09cd68409ce55c7cf0181d8b8764ec5735b9887a66ccb309d9054818499ed
- MD5 476409f0a8b93eb1fdd3f15870ddfc5c
- SHA1 9eecf0052a7b2f90c320292333eba35d7aaeeb94
- SHA512 d3c626d835a468cabcc466736a4d893878e10b5f0c5448f2b8076eb17e5c42cd5d2f0c49e71b86da3c65768ea1dc52b4eff3dc25ab184bec11df86e44da86d59
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvmu:A3mnXoZjzyacNVOE/ZxUiKiYZacvmu
- TLSH T1DBF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 907KB
- SHA256 db072979c8e5bf5a62b9df984248be4f693468ee59d8cfb0ba0a6be07b447f68
- MD5 1243ed5f705abfaa14041bf99b83c02a
- SHA1 5e68dd53f850ed97d35d9a71686cfc53881bf2b8
- SHA512 b60e58a59a09388ae0c5552093ee7c9df2989e1d10a6399e2ed7bbe1f5a74487748f807e80df247cfa63cc338adfcf79f2ea23dd29730009d8010a067699b6a4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvjyPz5L88:A3mnXoZjzyacNVOE/ZxUiKiYZacvOzy8
- TLSH T15A15AF13EBA114F9E516823099E50A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 769KB
- SHA256 f890f88f8ed0959781379402346e07198aebd9109aeb63ce210c5f8e46ac1050
- MD5 48ef4af4b8199dd2fc5eba450f6abe8b
- SHA1 24c26e0344162172b2991daddd290861356ae8d6
- SHA512 2a35822d1ae33403c93755bf8f37827d4ce79f24205b06c7a67b9c574b5d6e906b2805785275e1346eba29496bb88aa5f2881651a5fbd4cabfced2c22ef75116
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacva9:A3mnXoZjzyacNVOE/ZxUiKiYZacva9
- TLSH T194F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 769KB
- SHA256 7e38d9c1a17068b94898bfe3fa95e0131b03b7d8df7dcc920f5fcfe67a45c10d
- MD5 ec69f84366569b0a1d6875798345c821
- SHA1 c62ec5fe5a291d67b05c457bb0344eb9e4d2a519
- SHA512 59cc64fa71aa39d29e3db92dd52cce1bea864ba3fd82b091c0f9c11f5290975783b9882d22c22fb77c70cb68f70dd04bab1657faa60894fa5f7519a42f1dad79
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvac:A3mnXoZjzyacNVOE/ZxUiKiYZacvac
- TLSH T185F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 769KB
- SHA256 c50f1f543e4c8d3f261d292f0fa384761e683122c13b611b7e373325959217f4
- MD5 0e826e31552d466759409871a7dde2e8
- SHA1 091ba0d0911cb2591f9d8d30f26223d2864c5a49
- SHA512 49733e647b646ad2bb81193849fa22524d71be95560865bb2f7b5bd7f7a0087f5ef111d77165938bc12a9f5cbe86bac35fee1c2aa8d105c957cab58ab7a51115
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvTp:A3mnXoZjzyacNVOE/ZxUiKiYZacvTp
- TLSH T1B8F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 769KB
- SHA256 7a69348e97bdb43dcaf244ff82c87bfe49b60c99fad09b8deed733afa9dd3f20
- MD5 b6fc2f1856eada3fc3c5cbb07d7d8bae
- SHA1 9269bfa20a607c410b842f43ab24a10df4896242
- SHA512 f1610d47f464093663874b41653b7110b0b9b5181acc18744e2b500fd94017df9bb478b7a1454c577a484b1b08809b4a8b7055e5b247176bdc0feddcf5c257bd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacv00a:A3mnXoZjzyacNVOE/ZxUiKiYZacv0N
- TLSH T1D5F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 769KB
- SHA256 3597036ae97254253047147e1b90c967b5d03016655af0ee623fc20a97aaaa6b
- MD5 13507cdfaf42eb5b8b12f836326937e3
- SHA1 be6c227b0b7f88544bfb348a7f2fd2c5d905ea3c
- SHA512 a932cf22b03106d01f4622ed5f1f4222298c76aa5388230815e7cacf646a03243aa5c6a11e2af43fa3d253b39aa9798024cbd872a2872d508460beffc2dba57c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvcF:A3mnXoZjzyacNVOE/ZxUiKiYZacvcF
- TLSH T171F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 769KB
- SHA256 2f5fef411fb89f822f22c950791977936e073b38e5bf4f3d9e847936176c6d7d
- MD5 7556b989b7f0139210e34014bd821a24
- SHA1 2b1120c71ab431b0093ec60775d58045149c5f50
- SHA512 d53f6b495679b41fa188c488c8a684095b1c775292e14293a9afd242247b84d208d71dfb5ec02beeac4b563e418757f39d33c400e1c7a331624b6e03ccb062ce
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvJC:A3mnXoZjzyacNVOE/ZxUiKiYZacvJC
- TLSH T1D4F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 769KB
- SHA256 21b06afc57b0db95b8116d1cfea2bf5b2bd8f9fd49eec09dd2c9f0e263d1b961
- MD5 77e60d9cdaf7d1d00b451aa1de973216
- SHA1 96e0222e6d3c6d3ce065fc2be15a8e5216d1a22b
- SHA512 4e4dc8cb2910138530f7b93700d9998fb613d3299e188af1b9172393780f1405a2520fa66b764bb1bbff63265fe188fb21c6a266b7078d8a68ad768305486ef9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvqw:A3mnXoZjzyacNVOE/ZxUiKiYZacvqw
- TLSH T147F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 769KB
- SHA256 ee0b12d9e61daaca99ade590931bb2bb6fb5ab6390dfccb470deab9be7e1dd70
- MD5 2266c6aa05d7b9f27701e948313f4ea0
- SHA1 b07f4a6bc2373f467bf098d5152a6e6f391bccdc
- SHA512 cb8fabd237ba8455e86c575bd0e082088ab9fd3666d3f29f24d6234d42f29188c20bef3413a76f66a01828f2f37db9be08023f7b40369f0a9cb29356f950c1bf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvxT:A3mnXoZjzyacNVOE/ZxUiKiYZacvxT
- TLSH T1C6F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 769KB
- SHA256 0d1013f64e3f60e603fce98c85b097e213c56410f955036a8dd3873a77852557
- MD5 d22523f729ac00417fe00bcc95a5012a
- SHA1 4dc02b96a66b204dba449b43d7fdb665d81b63c4
- SHA512 ad3e85959f9e39b8b03d73ab8a05a275475a457460b6c5a6481357856c9ececf8a28c8ea7c8c123b3d3bcae79211363b7d0468d143cd0d2a1fa76b851a4af561
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvfu:A3mnXoZjzyacNVOE/ZxUiKiYZacvfu
- TLSH T104F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 769KB
- SHA256 fff2cfdbbb4c38e4030d7fb80b3bae87f44eda7463410644c0ef5cee201b1e5e
- MD5 9907525f823e5b8711b9cce52c25bd00
- SHA1 7a74a118816dd51352c9c6239978dd45f81b299e
- SHA512 74fc8a0df3729888957a8e3e48ecd64f6225546d9201f8c45ae96599eb439d12cedfdeb0a7de63d2b846186376eed8e76037b3a83f3ded1f6517562c3e4454fc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvDb:A3mnXoZjzyacNVOE/ZxUiKiYZacvDb
- TLSH T1D0F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 769KB
- SHA256 dbc6499f7547ee361cdde038a275e05035bb6def0e8e1bc890062a2e316e7d6e
- MD5 5136c1cc33590c0caa1b31be6f15b1c4
- SHA1 1f3645244e97b6dbed46b0bc574ad3d809574c7a
- SHA512 4e5b857af0d1a785df29cdae218fd1187ac0060d0aa568cd5ac28777ed0c15569fe18736edd125b267b6c6359e4e7cc650c28bb6e67bd651da24b4fd2358acb3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvXf:A3mnXoZjzyacNVOE/ZxUiKiYZacvXf
- TLSH T1C0F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 769KB
- SHA256 b4de9dc5e3bad9ad29c35f4220aeb46356398d8556515ea7aadd0e50f7443779
- MD5 4d8b462cdeb3e69986d62689c89c3984
- SHA1 caee94a49717f8aa3f6cf5b91bfa7a180b37a1d5
- SHA512 02addd0eb0e5e197bb337a8e85b6168af052191357115ae9e3de7fd69770ba6840b74a7fbe4dc47840daafb7d2a93890624a53a8d243d4e44ec262b904599579
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvgK:A3mnXoZjzyacNVOE/ZxUiKiYZacvgK
- TLSH T162F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 769KB
- SHA256 a62ea859436cecc522ad99d702a08b9d9b05a2951cad9d4496d3951a5d18b58e
- MD5 2c7026d1205676601826dd6acc840ab2
- SHA1 0d230d58e719b867c9e73b566c12ee6caedc26f9
- SHA512 c5cdf49810afbbf9a0953b3e0a782abc6bd78f44f18ee99539f3dc8387fd77a1f26d89b75aba95cd7e4fc0414a25657d254e4fa3a6b1396c37268195feb9cc42
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvdk:A3mnXoZjzyacNVOE/ZxUiKiYZacvdk
- TLSH T1C5F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 769KB
- SHA256 59eed87186cfd74865a42fdf4e5a5e78d0b2e8ecfcf9bb91b9edb6bfd49048c4
- MD5 8c5fe0952a9d064d0ea22798610505d3
- SHA1 cc8a3a6f9faa1fb4d8c20cc09fb34b9f9ce20691
- SHA512 d863750938b7bace98ceaaa1d209a8904d58856006608d3ae6d39f7ea5f2443dd3937187feb6b48222051140fb2cea51ee9a543029c116c0b6adc650a70f4ef0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvC0:A3mnXoZjzyacNVOE/ZxUiKiYZacvC0
- TLSH T157F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 769KB
- SHA256 da8c33e30f4d13d846154ab800976dbb66a55eacc0fc5ff174c5c9bbf743fe9e
- MD5 e8ed9543809fb3b92cd6cd89bc1f49b2
- SHA1 5ac750d602bc4bcc9fcafa055a04a120e41136de
- SHA512 7765348f34b3016c096a0a37a0448378859571ce60888d0c5bf9996fa21e243c7d9fc144ba97272088f5695e29564e7e0d99c0f2b87936f8424a89c6267a6ae1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvR70:A3mnXoZjzyacNVOE/ZxUiKiYZacvRg
- TLSH T10FF4AE13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 769KB
- SHA256 40fd3654b15346db03711519451eb1d06934c464402c28f4bfc5d424b24a5da1
- MD5 d6ab5f5b8899b6e7a931ef09e0977c52
- SHA1 eef50977531d0a5e77d2c9f388cb65d36d97e173
- SHA512 6e3df7c9e93f0fc2d821e38c0efdc6750ba559bb0727e89164eb4efe60e4c7f388c54398f8ee81d012a2de14f955166610bfd59d61e52cc38b3294dcb1eb3820
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacv4r:A3mnXoZjzyacNVOE/ZxUiKiYZacv4r
- TLSH T10FF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 769KB
- SHA256 7d61b506c66a8088b0943ca5630c11f53204b7f7f7a8e93abe8a8f1f08a89932
- MD5 e36f69e36cc60822f1af905155b22e90
- SHA1 752457417d4d233ce957c31d19d6a854106e3de4
- SHA512 5f57e26e5253f2b4e0e843e690665fc95b70d2dbbba339f3e1e39ff4bea9587ac6ba82e98735babc98865be556b8ba685a78b0fb8befb466449c5f6e416db439
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvWn:A3mnXoZjzyacNVOE/ZxUiKiYZacvWn
- TLSH T12BF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 769KB
- SHA256 61a39fb2d517842815a0e3375148375a96cf1c6671cffb16ac4865e7883781f7
- MD5 eaa5fd9cd75aaadd0cd613bd7e8e8a79
- SHA1 62c3f0dd725ac195c7831df8f2e616971917a669
- SHA512 5711ebe683b1327538bd59ecebb3e69c2a6b5ea8561970c910f821ea704daa014558fd7c11a46fdabaf0ad81c403d7695c5d59fe12de5f6d293d272b06f4d311
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacv8x:A3mnXoZjzyacNVOE/ZxUiKiYZacv8x
- TLSH T1DBF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 769KB
- SHA256 5099c0c68885e5ad1b0879b53f2aaef39413743711d8f806bff33a7a75d621ab
- MD5 8f88098e82c3339fc62292905ae73a12
- SHA1 3d6fbcb8cecd8c9773b4b8b2a26f53e74ffbcbe3
- SHA512 8c1a54321b553c6f1cfa19b36866b01b2dda792eac674cf1a9d8d5849b90cb146d3b0ede487086335e347172e1d9878f8f5c1525e90aed4a5f2807d781712503
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacv2A:A3mnXoZjzyacNVOE/ZxUiKiYZacv2A
- TLSH T16BF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 769KB
- SHA256 48d86256d57bb78844989c59f325a1b87571f8e063d8379f80642729c65ad854
- MD5 24e647d43f890adae590c6d462365169
- SHA1 991b592b6a97ddc695468823c38866ef2ec919fb
- SHA512 ea3f238a6b4da74e6e96260074d761ac790322fa4299dc93aa0dc13a98be0ddae148adf2c85ae543c980e67489885ce78053f850140e59a18afd1d76a4f3da3f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvv9Q:A3mnXoZjzyacNVOE/ZxUiKiYZacvv9Q
- TLSH T1B6F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 769KB
- SHA256 2962f9a90c5f05df406cb849e74d96e43bdb7178cc6788185329b4770a8a6306
- MD5 1096717649feac192e579b1a8b33bbaf
- SHA1 04f0bcb8caebb594b38cd382501cfcf06c0f7653
- SHA512 269e8202eb6ebcad71106f0ac4caf23fdbacc26f45cc2448e9ffba633c05bd8d2d03d987044ab8d407b5d46300a021be954dc2fa6ae2e076621319a360e9ea2d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvG4:A3mnXoZjzyacNVOE/ZxUiKiYZacvG4
- TLSH T1BCF4AE13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 769KB
- SHA256 872c7530bc10c744d16865cd64490fd382902ca1693a775786516e5837905a3e
- MD5 e362acf638c2248465183f174b4271a4
- SHA1 64676caa64d90c52d315fd964dd957a2632b4856
- SHA512 98369f9a309427e82f7dd655d6640e581d0bea6fe8bb94f14bc5bb4e0878c498be386b987a2a26aa116e500983dda6053a7c50415ea2aaea88f0c008c8445925
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvVu:A3mnXoZjzyacNVOE/ZxUiKiYZacvVu
- TLSH T193F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 769KB
- SHA256 eb1f1827f8ce932deaf82144f143c49bab3cdfd217286c08a2fb89b44fcb68e7
- MD5 252cb09d6abba4486e2834648818a942
- SHA1 02421335f742965ebb5e3fdc5919a55eda27f9e2
- SHA512 b35c756ab29c771fe98638d569c7ffd38d2c9ee2819fcdce270d9fb8c76e3a88981ce4794d0a9a1d15d8d8907de946bca4b8a864eed135390e641d4b9dafc890
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvIj:A3mnXoZjzyacNVOE/ZxUiKiYZacvIj
- TLSH T148F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 769KB
- SHA256 7ffa72e67e0d9ad4669144328d8c2f10fc9799651393f4619830adae15f5de41
- MD5 dcf43c26fca5826d26661fe8f0b241dd
- SHA1 6697defa4c0f1909836c27db288feb95663780a0
- SHA512 73a6a8f61bfa4b231fa66d75510199f93d4c7e1bae3c22c6d92537f616abbc457da57537a3631f7b748e41d8ad36930efd419e3913bb7c04595de283b57585d2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacv5g:A3mnXoZjzyacNVOE/ZxUiKiYZacv5g
- TLSH T13FF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 769KB
- SHA256 fba825d68114dc8c4a4f9ef30ac53a7d138cd7ee52ad799eac17a48a15714b06
- MD5 c25549cad2387267fcd74735fd133e27
- SHA1 7e42a4196e6b6447cfac7f4990dd810b3a1e69d3
- SHA512 921c672b64e386bd3722ef448444990aa16573321ddf8c3beab638efc62019c61fe71549d7b67c317fa98ac45536d6ac767b1229d1fbb5ed4c8bc6c048613aeb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvgI:A3mnXoZjzyacNVOE/ZxUiKiYZacvgI
- TLSH T16EF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 769KB
- SHA256 e17584362eae6a42f59c77235115eaa45605d588424065a1ede21c804be3bfb7
- MD5 e4b08c07aca698560db17255eb97764d
- SHA1 25e76329d9243b15543a2ca3d73d28402c26766f
- SHA512 4a67289d3f94e1c2d3d896d117049361ea5d7b7ac371d147d8260cf255d5417d8480f9b1bae9340db7669547156a4410f627b556ff4eb812859885799be031bd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvio:A3mnXoZjzyacNVOE/ZxUiKiYZacvio
- TLSH T171F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 769KB
- SHA256 08dbc4febc8df4925d4d9cb98d72b9659691bb3bc9310d13e51b6d7c15d0b9e0
- MD5 16c919b140879b99b634b5072a0d6784
- SHA1 fa1916d7339e578bfd5d02fd7ab690b566c8b438
- SHA512 afca551131640d5bf8a09f8419b600120ce9198ad515a0842ab6c96b04319837badef64bdbcb8660df78cff7e42d2a4481f6f1a6eafbf7380528e5be25b6d7e4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvZ+:A3mnXoZjzyacNVOE/ZxUiKiYZacvZ+
- TLSH T101F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 769KB
- SHA256 a00aed9a81c417cbe9e14f6f80f36f18f0af49285d44277e042e02b7d728d6fa
- MD5 35483eff083ebd6844aff7b646aac13e
- SHA1 69cb08e9f9ba524ab7a2f93ca76ee88cebfbf5f7
- SHA512 6a6e2662239fbacf054804e70b6a2cfaeec22dab4d98e76b1f79887a170ab6dea175216d106f03f2e846c138ecb2d88f05d624b9e718afabfe469b5bdfad7115
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvHQ:A3mnXoZjzyacNVOE/ZxUiKiYZacvHQ
- TLSH T10EF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 769KB
- SHA256 a9463e4edd46d9a9e480bb911847d4db40a43bccf0548204fbc4e2bc57f19974
- MD5 65555bf0726e8150c2541c96eda0332d
- SHA1 d29972752c9102aac8b83523b056f8426e07efea
- SHA512 4948edec25cc8908987160b85708f311f95d0b3088ebc26cdfaa08a0ae520ecdf9c69fa5329098f897bd20294a1cac5c777086526ecc542b05e1f9a0d4c39093
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvcX:A3mnXoZjzyacNVOE/ZxUiKiYZacvcX
- TLSH T16DF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 965KB
- SHA256 28cd51bb29fa5dee8cbb5e129609a2808cccc5b7e4d05a81ece877c174349407
- MD5 6aec99e653e345da827a85bc23439ac1
- SHA1 342cb9381d4f461b180a73e5ea93ad9bafbf7566
- SHA512 b13687b7b904d5732eab09d69095d7ff6aa737fdc040882cd4394495c849abc678f64a5df8bf890db7e4de6475d6eb5fb6878c9c3dcc98d4e80823530bf0ed59
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYZacvLjCXF7IwZ:A3kMLC17IwZ
- TLSH T17D25AE13DAA004E6E5168174A9D64626EBB5BD6617A083CF635CC2252F237C07F7E3F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 769KB
- SHA256 fe64b4db3af9d5ff70a1272a23c13767baa640055e7804d64a8b4ceb27833b9e
- MD5 b87d7ad3fb6ae261106a927e66d3fd31
- SHA1 ee8877aa017e908344b8989c654cbb017b52f5f2
- SHA512 1ad816b397f7a7a738090c015561865a90cf0d664f3baf7a22114427c0298659881ba2eb2f82090c9239a3387a737d695cd1c74a4efac1f9bc60408a661f9e92
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvaL:A3mnXoZjzyacNVOE/ZxUiKiYZacvaL
- TLSH T139F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 769KB
- SHA256 2816dd11e3c3660bd91ce06467910e304382217b0782ec3dde6751812bf80580
- MD5 4291838f5d56cd60347d7c1195934704
- SHA1 08b5d9dc8eb9763f7062f9bc46ed881434b85893
- SHA512 3d7f4dbff4dec7bddec0ebec749ca3f9cc183695d332368721fda3f4fe02fea26649e70af9c2447845658b43d294733c58a9901ae4a8f8f360cee1343f7a9a81
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacv+FC:A3mnXoZjzyacNVOE/ZxUiKiYZacv+M
- TLSH T124F4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 769KB
- SHA256 c8e6afb178537ceb41806b6bdb221ea254886f2ce3bd4b9f0b001e459d94ca99
- MD5 ad702b15ce37592067a0a9549a0dce72
- SHA1 13c4ba14e604e122afadf6e55110ec77976a5747
- SHA512 689229e0115d6fe7b628fcf89f00b762cc008f4a72a4f7d23d230778d3b13d9007cd55bbb44324d71a1cf1a6cfcfd78e3aab31e835fafcec69735ba9093a61b3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYZacvnh:A3mnXoZjzyacNVOE/ZxUiKiYZacvnh
- TLSH T18CF4AE13DAA104E5E50A8170A9D50626EB75BD676BA0C2DF232CC2152F627C07F7E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH