Analysis
- max time kernel
117s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 22:45
Behavioral task
behavioral1
Sample
2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 933KB
- Sample260730-2pjwtayerb
- SHA256 f21d8dbeb2042c773d74f7025d7d64737a6d944ca6233a91c699723a1dfa65cf
- MD5 07cc634418836435fa90f20c34a7dc8e
- SHA1 c8905fa47296b64fabae98be52ceb2205ff09150
- SHA512 3b3a426ce9db2722b0e8d9e8c99f4a05d82dd4384c8f20964ccb90aefac7f5d2459b654771bc382c4b7863a6a36c4267ce602cf9d1e1eff0e5674de8e8e41633
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0a:A3mnXoZjzyaEFo3+aWiauhzyozyr0N
- TLSH T19E159E17E7A120F9D126823499E61A12F775BC321760DADF136887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/5920-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c56c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5920-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4672-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001896e-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-254.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a4a-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-306.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-337.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-465.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-544.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-717.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-773.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-938.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-964.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-989.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1063.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1094.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1107.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1163.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018903-1490.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c56c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000400000001896e-201.dat aspack_v212_v242 behavioral2/files/0x0004000000018a48-208.dat aspack_v212_v242 behavioral2/files/0x000400000001983a-227.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-228.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-247.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-254.dat aspack_v212_v242 behavioral2/files/0x0013000000018a4a-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-306.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-337.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-465.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-544.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-611.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-637.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-717.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-773.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-811.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-938.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-964.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-989.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1020.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1063.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1094.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1107.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1144.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1163.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1188.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1195.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1227.dat aspack_v212_v242 behavioral2/files/0x0008000000018903-1490.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4672 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5920 2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4672 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_07cc634418836435fa90f20c34a7dc8e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5920
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 f21d8dbeb2042c773d74f7025d7d64737a6d944ca6233a91c699723a1dfa65cf
- MD5 07cc634418836435fa90f20c34a7dc8e
- SHA1 c8905fa47296b64fabae98be52ceb2205ff09150
- SHA512 3b3a426ce9db2722b0e8d9e8c99f4a05d82dd4384c8f20964ccb90aefac7f5d2459b654771bc382c4b7863a6a36c4267ce602cf9d1e1eff0e5674de8e8e41633
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0a:A3mnXoZjzyaEFo3+aWiauhzyozyr0N
- TLSH T19E159E17E7A120F9D126823499E61A12F775BC321760DADF136887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 962KB
- SHA256 9eaf34a4c0ebce43b7bf4e82fa43c495faaef0eb82be214c541dcd1972cd15a3
- MD5 dcf84ba475a09fbdc863ff7690fa1cf8
- SHA1 dc07beb34a6cb7854ab832c491e540a816bc1b28
- SHA512 f64a2acaea9810408320cc0ca725bb25be7bb07d06c8d629182cd96d8af16d9a9f3b0f1925635bf9d1e36b0e5e0bb9840f542609b0102ee211120ab8576c09a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0sP:A3mnXoZjzyaEFo3+aWiauhzyozyr0bP
- TLSH T1F4259F17E7A120F9D126823499E55A12F775BC321760CADF236487262F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 353aa3e7f665d19d3d823294f032597099e632a57c38a3c2ff0ba84786dc9c7a
- MD5 42e47fa12b9e17ed38796334c68cb18b
- SHA1 ed8e9c3521b426185d38bbce1ed6edbb25df3199
- SHA512 4a752ff1d5085986436c98b7e03544ffdc13b88c513c998a4088d1167bb7e0f94ac14caf19c49e1b70c2134ce3d74f193823ea5236ad6674095cf65632778501
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyozyr0Z0Le5ji0hmxNrM:A3kMPb5Pji0Aj
- TLSH T1D6656B17F6A402B5D033C179C9E25A5AEB7238521B308ACF139487792F277E19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 957KB
- SHA256 861f57154d2b5a587793677b6a9c423883fc315efff99ed2758b0a04b24b65dc
- MD5 b3e7fb5ac4beab82848574dc3f83767f
- SHA1 373a2bdfa081fb217d6505ecd40cc6f43f04f5bc
- SHA512 b901c1ae2e85a3702a20536cb230886272e0d7c61474d3a47e8103fb1c7246ae713fc9336c1288025049750234a45800c6d95a4d2abd790be0a729f2f41967db
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0+Z:A3mnXoZjzyaEFo3+aWiauhzyozyr0zZ
- TLSH T103259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 957KB
- SHA256 401387008cdb731cff9d09ca4849bfadeaa846108662f31d6c806f23070e41c4
- MD5 70d3479cd7f8790da0e9c05821ebd3c0
- SHA1 5a7acb6d9e20fc00c1d9d25ab5f44585ad367760
- SHA512 10ac9bc971183edb080add0a355a6ab1c98d06bdcccbd820b2ba5f99f4842ad597a5ccfe7f3cbedb853e8afc11860fef7c653aeecd679831ee97fee3e0220148
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0Z1:A3mnXoZjzyaEFo3+aWiauhzyozyr0o1
- TLSH T12A259E17E7A120F9D126823499E61A12F775BC361760D6DF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 97b4a7e2c5da2a98e961ab8173105dce6a2c86833beff4660f8d86991d161049
- MD5 63e9cf5d01083bb47a6f08df473da868
- SHA1 49de566a8174a7401b219a1333c4210d08fc6743
- SHA512 ace6575c09990b06bbc2c9e891637799213d21268828e007d5487124845c26814bdf66b8373af7d2e8fc99481a44ef9711042eb5303367ce00272e7ec59ba0bb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0d6:A3mnXoZjzyaEFo3+aWiauhzyozyr0K6
- TLSH T13A259E17E7A120F9D126823499E55A12F775BC361760CADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 957KB
- SHA256 bbe46a239b4a8b20b025b80afdf78f82fdeac45df6bdd36900108296d6e1bd4e
- MD5 df5f0f28c785cced0355e4d77644a6da
- SHA1 acf01c723e4261711319b530d972a93def43a36e
- SHA512 5f0d9303e1d9042744f7d93d1af726fc5712fdbdbcb41550849129252f8798999e8d811fbbe9b2a7ebf91f590a7945d037d275668f87733aad3a2e02a4e8e966
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0zN:A3mnXoZjzyaEFo3+aWiauhzyozyr0iN
- TLSH T1E0259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 957KB
- SHA256 e72d6ebb902ab9299f3878dac7d9b3aa300b8f332066019a02c500dbf2550f27
- MD5 d4fb617d65297c618e5bd4d9a9ded28b
- SHA1 cb3e5b782e58951bc4eadd6aee27f2ebaecb0654
- SHA512 6adf4125911188cb9a59c2eb8af10f77734e8d6df3e6d593691551656936289f10d00783ac19b246999e90d53a7d37bdcc3b56dfe6ac53dd939fa86992323209
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0Bf:A3mnXoZjzyaEFo3+aWiauhzyozyr0Yf
- TLSH T120259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 f3cb9fd94dfa12fc7aea38409c6655146d23ddee3330fd33842ce83f1c526c69
- MD5 4d789601d68d5c27471aea7bd5dd9f79
- SHA1 3f5e2a5000828db6e3fd454cade2005cccf10a77
- SHA512 7e9aade6329514e50e12dd103a469179d62d85b2a490cce9af0fb209c172954ca2891671fbd5c922df3fdb11a73f5e8ee1f0bd185dc805be01516b07291c18f8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0jo:A3mnXoZjzyaEFo3+aWiauhzyozyr0yo
- TLSH T169259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 ade584c09048d8deee4be9cdf8ef22c8ff47aed1ab19ea70cc558e16bedcf847
- MD5 6a78dfb907e1e1b81fb0fff26490bf86
- SHA1 adf70a7fe723dbad1a972c287677d3f6766ee97c
- SHA512 08625fc7982cb87a06c87b02030946f07af79ff02fbd71b65a76bc219a69163bed770d5be67a757200ff886e77c3b71dfee711853de76c9f9c407610dc49086d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0Xu:A3mnXoZjzyaEFo3+aWiauhzyozyr0mu
- TLSH T181259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 f12e96e96f7f87537f312bda25d5e6806d50fa9fd0f571d192e0f3f3bf6e2aba
- MD5 99a378dd429c4026cc045d5d49b9b339
- SHA1 9bd78a89116f93f040d6334984347257b85c95cb
- SHA512 9ab73121d041100ce4402ab36c7b0ed5214662c8cbba07ea9149337829921a971345efb948c3c2cbb7679a49bf52608b6cf8622c9d488691989f777262d09ca1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0N0a:A3mnXoZjzyaEFo3+aWiauhzyozyr00N
- TLSH T1EF259E17E7A120F9D116823499E61A12F775BC361760CADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 fc0bc87308488c56ac95a34907d2a87b9410b52132d051399e1945e82a18728e
- MD5 a0eb99c5257806d5e281e1ac9d1044c0
- SHA1 611f7e92e24d5020347ee623921288c15fd4f9fe
- SHA512 f1f7c25899e24b032f866bd7ce5ec242d91e63821105b48a353cd829bb53171b29a6b9aa6055cbc7ea06cdff092401bb013e2132ecbf96a55a67be0ea975cd2a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0/F:A3mnXoZjzyaEFo3+aWiauhzyozyr0cF
- TLSH T13F259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 7ebeac4e2fe7592c6a861febdb3b5ca0d525efe011e7d94f2774ba3afbba250f
- MD5 6257260a0b40fef9043710816c6a3be7
- SHA1 5cca529c747a450b893aa98e53e6572c2fb4c505
- SHA512 2a40d88ffa775747b52b3eceba9dda68fc801a3e253c3e0d6427d93268e908e19f64c2918b344f7bc166b3c22497c9ce957fdd369ceea5c9b602790d11f97ec5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0gC:A3mnXoZjzyaEFo3+aWiauhzyozyr0JC
- TLSH T165259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 31e955b4b934fa8b45b7ba7dfe2ae1826a7a307b6c9cf42fa8f3384e7d2a5094
- MD5 4f678edc009f03f5866e4ca297f541b5
- SHA1 4b6b6fcaa93b651b58a0c4248b604a17d80de505
- SHA512 0998b7a3f371fa140b7eccf731b8a7b18836e92846034c9b413727d9454905cbccf6558c90a4415d927a701591a10a28c18b456cc47fbe208612d6e365bf820b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0zw:A3mnXoZjzyaEFo3+aWiauhzyozyr0qw
- TLSH T16A259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 cb60f351c9a049b4d191c88892afe3f8d340fce955a059aa5e925f7f19dd2e28
- MD5 f29cbf8dbf188ccc2862ce11bafed914
- SHA1 1b4bbd4bd281176d1428055ac9cbc4fea0f80b41
- SHA512 52457daf71e96b843a03360150193b0a059ed6c2336e9e8ae38f14454d299e9dfe03eccb6c78d1ad926867ba4cc3d292a9b8ad46661fa0cd5bb39808363dddf5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N06T:A3mnXoZjzyaEFo3+aWiauhzyozyr0xT
- TLSH T179259E17E7A120F9D126823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 b43afdce33793520a848293a17d6bbd154d436262cd111f8c37bb55bf13df83a
- MD5 e6a40e474dabd052543aa8efab1739da
- SHA1 7de01250f7749ca4a58b1498518958a612293ac8
- SHA512 44a0a695f2344e964a86aa4d4dccb16bb70ae041c7f3288272351431e21ae05742afb03ea0ac976273b271262ea2c0c259d53cf5c535a8fdb245adb8fecf6eb0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0au:A3mnXoZjzyaEFo3+aWiauhzyozyr0fu
- TLSH T102259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 89a04e0e41ac0cea1374bdb9f3fc0a438fa31324adf93e16616e72916271f962
- MD5 c950d3b38faf1eceec9f3bd25c2311eb
- SHA1 4215ebb04ea94c6a767c3046aff992f8ddc0578c
- SHA512 c700facb32104756226e901d589a3ad232e8cee870b7936afbab59029453c13034fe22d4d098a83a8bffd8a3578d4eed2ed0413b10ce13ffdb13ab2a0e36b8de
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0kb:A3mnXoZjzyaEFo3+aWiauhzyozyr0Db
- TLSH T11C259E17E7A120F9E116823499E51A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 db14a9b3cea6458f379766183592870565aa91aeaeb2b55cfc82016ec5c614bf
- MD5 af529aad0013b4f73c7348386d91164a
- SHA1 da0cc756400092cb6f5ae1e7a5d50a00be2351d3
- SHA512 133ccea602678d1684ee6a677cc375c79e22a536ec8bee5579b655f2db67e0d5f79a2fa5afbc1d2831b686e2b564be301fcf41cc9970f0f2a8217fc84b35e2eb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0qf:A3mnXoZjzyaEFo3+aWiauhzyozyr0Xf
- TLSH T1B3259E17E7A120F9D126823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 4a3b448ae920be27dd0ba21eee92d2c212034d0984df1c229e86fb650d2aebc7
- MD5 71ba82839bb15c40dd44baebea7ac384
- SHA1 666ebb8f3be316efeec37d0c455d2339bf210ad5
- SHA512 b3f239c2f6b96b6a22fc5441f8446a443bea6c8077bf34a91f75a105070ee07d23abd707c6b090eb289c5e39519df55ef18e950b7aca560eb7c7c216008b6cc6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N03K:A3mnXoZjzyaEFo3+aWiauhzyozyr0gK
- TLSH T17B259E17E7A120F9D126823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 30866bb9ecbd708b76d6e696607bc6de7fbe602031fc7c51f86d1d330735420b
- MD5 9b4e49e80f69a0bbe9d986b8d1893c00
- SHA1 ef90fef0fd36791e4d0518cd2a825a7631a4867a
- SHA512 4c12ad688d9235da33db41e89be3f616f2f1c13afc3d266ac0948008ac961d9c8e2b074f407a292760e6c3253cde3a79d6cfba71fa221191eb69916011ca8ca3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0Ak:A3mnXoZjzyaEFo3+aWiauhzyozyr0dk
- TLSH T1A2259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 1ca7412c3c4fc29be56bf857f1f4dd970420d5d84296edaf888089336d71176b
- MD5 751b2dd8e9ba01f07b71fa8b4a6f6b64
- SHA1 554b4de5d1f3db7890fc52cb4c4677ecb345924e
- SHA512 895ab552b18de7cc1b4156bed6dd927a27fd17de19c7c17f71c777124a2e7e179c7719234637d076c25fe754b32f3178f92871392b53891aa0dcaed45475ad15
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0x0:A3mnXoZjzyaEFo3+aWiauhzyozyr0C0
- TLSH T108259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 9c2063e1fb7b6bcc2ad2b4a883b780ca632e0978bddfd1e44be7a378fe55b696
- MD5 21b4f8d3300d8e0ba0aaf9d3b45833a6
- SHA1 115dc70ee0b32aef3020bd6654a31188d6974a84
- SHA512 41059837057497a69f6e8e6175fa5b2125acd49c8e4b7da1f5af3767e93334846e83896b8f296b57928734ebcf0b6fe41e6a057acfc5752f3d1ed3924931d38a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0k70:A3mnXoZjzyaEFo3+aWiauhzyozyr0Rg
- TLSH T12D259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 dff3b5621a50ea4480c60b274e878bef522574b90b591fd831acd8a3ff47632e
- MD5 e152a9b19d27ba642a9fb4b3880e55a0
- SHA1 1df4253d5b785c941f300965ff13fb85ed63fa0c
- SHA512 a7d07c24a26f3cb85f5f6836935a51f6ec5941bb918ea83aadf7e242df860e540f3581a74b24fbb7445f71bb2e03ab36bd7e3702bf0db6e031df7fe2b68cb074
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0Br:A3mnXoZjzyaEFo3+aWiauhzyozyr04r
- TLSH T18A259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 6b7c60c7537d3684458f1b3dc95f9f99639b045484ee67972e203d22238073e5
- MD5 3ee98b85f2ea5fe1694e34f1258f18ab
- SHA1 e55f6a3625e3cd13caaf5647c5d7c4112941a191
- SHA512 762364ddad596449d5fb2e7e5ac3553d02d7c92153b235921a510c823a85785640c0c1a00161f897964cf8867b271a0ad1ca8d9c66cbb9b9a445d756d40f0ad1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0Dn:A3mnXoZjzyaEFo3+aWiauhzyozyr0Wn
- TLSH T1FD259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 c4f0a0e6369c52aaa2ca2b9604d7bb90a14b862eec701d6c9dc8e10e171924ea
- MD5 4c3e632a5df0c2c8b621aa6b17659249
- SHA1 ef493e674e139f20ece99d76a3e233a8834e6939
- SHA512 3a81a966477f911c8acd8a898615985f34060d52f97dd2c06336edda8ab975becbfe04391cf65afab9cb2896b1bc2840533d2eff1201e47f377cb0c4b8f08f4f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0fx:A3mnXoZjzyaEFo3+aWiauhzyozyr08x
- TLSH T1D3259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 c7297e6c204d5eeedf0dd82cc001c01dc93d9f4079559b20976405f810b36697
- MD5 81689bd6cd4be7fcd86c0f8600717a53
- SHA1 46f21cffa48fc96f5ac6c02961e4afd06372dcd6
- SHA512 ae0c1f647d8131be593dd4b5ff745c2b97ab86f82f1ff5cc3d3181d4b934f333a3d663f526f3d0edc26a93dd82d77413793db1675a9cd51abce05470c8d64302
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0FA:A3mnXoZjzyaEFo3+aWiauhzyozyr02A
- TLSH T152259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 a179e3c7cc9bab69f1f9c217ba9839142b2323bb6e3b0b81faa49e6cf6324f00
- MD5 988caa228aa48542f797e392ebbbfbfa
- SHA1 c82de68aab346e10ccdf23fbe77c2addb87c8fcc
- SHA512 0e365a90801fcb8aefcacbe955ce2b87b4f029b4b34354da7a596eeb957617a02ec58cb4641fdc2e72d7f42fd1f55ae370ac4801a3b06471a82f88b56b1d5d64
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0+9Q:A3mnXoZjzyaEFo3+aWiauhzyozyr0v9Q
- TLSH T11A259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 abc475557706efb81d40cecaddb5387aabd46b8ce44616642e851c93ff598b8f
- MD5 7a0b9886556aa4e8bebf523952dfbc1e
- SHA1 60d0d5073594b09af50684576c70178b85fb5fb5
- SHA512 56c8c7cd0e39a50b755afeb50a17729074de31ed11cc407c4195170ccb2c5f85cc0993bb0969ad266db7accc3763bcb69e713724cc6a200b6dca66645644470a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0r4:A3mnXoZjzyaEFo3+aWiauhzyozyr0G4
- TLSH T160259E17E7A120F9D116823499E61A12F775BC361760CADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 cc8cd0254435e21797eeb05a3132eb1421e8d458462141752ad6255e79c1aec0
- MD5 1251984e9a95c90198371f7fc334ba94
- SHA1 03dc62a270de94788566dc233cab237945b973ef
- SHA512 962084fc754376a6dd08a3613e71123fbdd345731ca0854bc1045d07d8f1d07553862274772960e8f8d1ebe9324a40f7c35f005c3c0b90f4093c92fbd740512d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0iu:A3mnXoZjzyaEFo3+aWiauhzyozyr0Vu
- TLSH T1BF259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 5d04f46a0a186524757b4ecb3f7805f0c25cb72f5824de1883de62289fe4badc
- MD5 13f9b8491f98c56dd81853797e884367
- SHA1 20898b4fc30d58bd544e2b9ba6aea964a47f87e7
- SHA512 e5f52baa4a052ac31c7297c29e36028ccc90ba543bed04c299f3f0190ec834ac38ffd4e782091c2d98e482d03dd62e0175aa888e10d171aec9c713b18c8fe60f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0zj:A3mnXoZjzyaEFo3+aWiauhzyozyr0Ij
- TLSH T1F2259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 2bfddd61e746f57d8fdd3cd3d64eb339fd355d271d0c2e0a2f613965cb1e155d
- MD5 4346cce778e4b0bb0af5a3a0d62aa1dc
- SHA1 6356f2159557cdd25a57047e1d138fc9f6b5c7d2
- SHA512 a0afbebd39b58b0cfbe438c754b749b90061ffb16099cad82879e3ff627b511d3bb52e1b85558648702ed42e451cc79502e470cb487308bd34ee51dc1615d4ef
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0+g:A3mnXoZjzyaEFo3+aWiauhzyozyr05g
- TLSH T17C259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 abb03867b48d12ba54c3e9d2e2402e3a8455ee97ce5fe4b203acfc55076103df
- MD5 7227cb76f413aedc21ad6f77330e9a42
- SHA1 c88fc056700ff43bb94e773afa3eaffcaf39a8e7
- SHA512 5231a81032069eab10b443056af7b1eea2f0c6629ab2ab0ecd0ffb9678a88da52846399b76cccbe2010c76bb767b1c56737c4b547186412028e439d72e6e93bb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0xI:A3mnXoZjzyaEFo3+aWiauhzyozyr0gI
- TLSH T124259E17E7A120F9E116823499E61A12F775BC361760C6DF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 5d20a45dbff1709a97874d7ff942b3c4fbc2873184cd35766e8a613cf4d85aca
- MD5 902e69a28fc27417d6d414a4eb85a882
- SHA1 26796ab405de4889b35dbfd325c5af122286261e
- SHA512 36e2a9563f2357d6e38d450d977197460f46413f130fea770c94aeb04223bca0aa18e5aa56bd0bdff264482be9cdf368b47b2c1812d8d4eb34d988876e03774b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0zo:A3mnXoZjzyaEFo3+aWiauhzyozyr0io
- TLSH T10F259E17E7A120F9D126823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 ed35a26557ffe6cf2380028cc31792313e0538615bf29af003f11758d9a548f8
- MD5 9179d3b867827dc4bf8ee365174961fd
- SHA1 0e48ea97e9356187efeee7a5582e95158284ade6
- SHA512 106cb575aee1b420a44c8586e722a7eaf4eff07ae68a7efcf4b49a82134c34f0632860fb4d35c152695ae41cca4b71385b43742286ad2c10e1acabd875ffbaf8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N04+:A3mnXoZjzyaEFo3+aWiauhzyozyr0Z+
- TLSH T129259E17E7A120F9D116823499E61A12F775BC361760CADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 3c242185c64e71d4329ddaf736e7d11e24174509b924d9f8118cf046f9482c6e
- MD5 30d74c26bd4ac8140ceb26926d675503
- SHA1 9057363adafecc003d82825f69c1cb9a184f817f
- SHA512 797a7a3928d3555305c452953a549be0ac1542dec76bfe84c30abc88a926c6d407a9782d21b2ce81c002432648019ad28961cc457831d86f0a920e4cdc476b68
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0QQ:A3mnXoZjzyaEFo3+aWiauhzyozyr0HQ
- TLSH T15C259E17E7A120F9D116823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 d17564501c9d5236ac84d2d338f57f394241647a2c2eb34f609e8c88f90d9ccb
- MD5 31e1bfe41d9dcc501e2dd8c8663bc5f1
- SHA1 dc7e4d39d50a1750e4451c77e9a1b6d9d31b32d9
- SHA512 d1c0e65e4804356dd3356a8670228a82e7d8361506b2024fed0fa1df5dfa40a7620eea1519c64199e91c2ab459efcf181d922d2015136b75293ae5e72a3e5f45
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N05X:A3mnXoZjzyaEFo3+aWiauhzyozyr0cX
- TLSH T1ED259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 b780f667b6fde0f856d661a95e559ad3d214a32d91fcff6c0981461ce5756db1
- MD5 2482e0abd99c99d9003c2fdd30095f05
- SHA1 d7e8cb4350bffd92895464bfab73060902d0ba21
- SHA512 2be54849d6c97801261deb2a98a60fa0a450050354db7c647e22215b824217229a471d1830639db3e7d30f94003284c5eeeb7a0ac02de1b7edbd0ca695c25f75
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0TL:A3mnXoZjzyaEFo3+aWiauhzyozyr0aL
- TLSH T15B259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 68dd49e2fabf10a8876d89fb75a763972987fc232e239303864cdd7b1a8cb338
- MD5 a9ee16881265ac59a12561e842bb3d75
- SHA1 7f80e95e7ef04ad4c07657db8f22847c69f539d1
- SHA512 064c2d10866976220ce6baba214c13dc424f93fd46614354f2be6e90741d09a025f99c604ac764652c996abc34dc457dbe026d57cba8017d475f2b5515a9709d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N05FC:A3mnXoZjzyaEFo3+aWiauhzyozyr0+M
- TLSH T11A259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 cc23ac69af702ee150fd24d71c45b6d5987a826b9fe0da4bd9921eaf27c3f335
- MD5 e6e31d0129aa96320b33ca73e45b53e6
- SHA1 5a112e9c6af8f73aa7bf6d58b3fd1b223191b0d6
- SHA512 4a88cb051957dac224fec283169255f9b089c25638ed3d91c79b6b65efdeacc8186f36510ca301f4593fd59ffa343a0147a99363c5759bb7018db4b0e4911f06
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0N0Ch:A3mnXoZjzyaEFo3+aWiauhzyozyr0nh
- TLSH T151259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH