Analysis
- max time kernel
93s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 23:24
Behavioral task
behavioral1
Sample
2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 672KB
- Sample260730-3drmysstgx
- SHA256 19d00438d3a306b791d10debccf43b19e51180db6150fa75dec0c68d02e5ed99
- MD5 cfc0e985d2a283c214ff80f31e65746e
- SHA1 3c950739508d091e7e3786093b4278f09785cb33
- SHA512 f047badf785a49a4882f15cc9225525958f354cd5a20c6b0a889fa8848763a4be603e913105377c1e2f90840958a14df264f4593b63b7f71e3716842f03eb611
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Z:A3mnXoZjzyaEFo3+aWiauoOasf6Z
- TLSH T117E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 50 IoCs
resource yara_rule behavioral2/memory/1324-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c618-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1324-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4640-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189a9-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bac3-331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00050000000189a7-488.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a83-597.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a86-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-784.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-1050.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1063.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-1100.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1150.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1351.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1404.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-1406.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1407.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c618-6.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-39.dat aspack_v212_v242 behavioral2/files/0x00040000000189a9-204.dat aspack_v212_v242 behavioral2/files/0x000300000001bac3-331.dat aspack_v212_v242 behavioral2/files/0x00050000000189a7-488.dat aspack_v212_v242 behavioral2/files/0x0005000000018a83-597.dat aspack_v212_v242 behavioral2/files/0x0005000000018a86-616.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-647.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-727.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-741.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-784.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-821.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-852.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-871.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-884.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-891.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-904.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-917.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-930.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-950.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-952.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1007.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-1050.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1063.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-1100.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-1137.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1150.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1175.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1182.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-1183.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1220.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1324.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1338.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1351.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1370.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1377.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1384.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1400.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1401.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1402.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1404.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-1406.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1407.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4640 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1324 2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4640 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_cfc0e985d2a283c214ff80f31e65746e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1324
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 672KB
- SHA256 19d00438d3a306b791d10debccf43b19e51180db6150fa75dec0c68d02e5ed99
- MD5 cfc0e985d2a283c214ff80f31e65746e
- SHA1 3c950739508d091e7e3786093b4278f09785cb33
- SHA512 f047badf785a49a4882f15cc9225525958f354cd5a20c6b0a889fa8848763a4be603e913105377c1e2f90840958a14df264f4593b63b7f71e3716842f03eb611
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Z:A3mnXoZjzyaEFo3+aWiauoOasf6Z
- TLSH T117E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.2MB
- SHA256 585db360f57fca060fb6e39c927fc3e9ebfbcbd925a686d63f668b22226f9d8f
- MD5 232cd5fce2d8f45b1328ff8d420f7455
- SHA1 285672233cc754018a5785bfe5479418b8b3a57c
- SHA512 86721d3fe92ba6a35d38f8fae6712a8a4ad3bdd48953a9928715e970f37361d4001c701e2f9a8d519acde181408f912b5af096358ef1c3b3612cebb824083ad7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOasf6F0Le5ji0hmxNrM:A3kMqPji0Aj
- TLSH T1CD457C17F6B442B5E073C075C9E2969AEA7138421B30CACB1359C7283F67BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 686KB
- SHA256 9966f50b6c6a5b5f3088295185bd7ddcf56f4371e58fb84455c7ed62974737c7
- MD5 0c79d8e054c3dc7555248f9a477e0fcb
- SHA1 e4dc3863ee22b563e19e05dff89189fd617babb5
- SHA512 552d0451c8373e1adc1332d92a32966b9f4e1fdc79deec0ccf5c13b202c91883666a9fa0ab6b5e438c2cd26962e944fd32dbd6bbc01ae1087c8d163672f15fd8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Ha:A3mnXoZjzyaEFo3+aWiauoOasf6Ha
- TLSH T196E4AF03DB9014F5E61A8130A9E65A23FB75BC221760D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 695KB
- SHA256 f9895eac24f4107d88c635466a3ae7d7854bea654afc08c7fe6e34e23c347dc9
- MD5 beed6e2e84431753920b8cbfbfd2b297
- SHA1 9acc69ef139137e45825533ff91ca771ab092d39
- SHA512 f93896bd0b4091b2eb54dd172057d07e2f30b0d2766c21b5c8849601ac61e3309c95f90f487b025981b4a51fdd12ebf9cb23ffdfce6afb63ae8934b9af99b986
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf63Z:A3mnXoZjzyaEFo3+aWiauoOasf63Z
- TLSH T160E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 695KB
- SHA256 c04a2b5c6317e6b2746cff864e172ecd8cb809ff7bf6989e82812cacc90c2203
- MD5 c8c1dd687c567650d6bfb8b68696b28f
- SHA1 cd00a16030a751aa6f039871ea9060ec133a6642
- SHA512 8eae5cdb508eebc02547d978ef9161f2138937254be0d6a3833a972c15a8631c5c827967271aeeb62ab7d909d80600f4f7cb5d71e569a34d571a2ab60edca2d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6M1:A3mnXoZjzyaEFo3+aWiauoOasf6M1
- TLSH T120E4AF13DBA004F5E51A8130A9E54A22FB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 695KB
- SHA256 cde3d93b1a0f29f847c99db6eb95ddc8e9ecb7ff6520449f2b935b71eb243599
- MD5 e7519608081c6ec2407b0d791953c411
- SHA1 60a9c51d7893fbc9978218c26c6593ef0eacbc19
- SHA512 c52487bb10b1e079453099df125fb1428dadb4b1efcbf2c11a2d9f7b0bc9ffd08efba5eaf15649f007bc72c20830e35626962fe47cf15d09b6ddd293958f134a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6m6:A3mnXoZjzyaEFo3+aWiauoOasf6m6
- TLSH T122E4AF13DB9004F5E51A8130A9E64A22FB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 957KB
- SHA256 3f9085a6d98cec6af0203e5feb89dfc917c23f872a750aeb5ded32dc03ddbb16
- MD5 6342ca309cb7857c8053e46e2b97484c
- SHA1 267ba67597a7190b61771c48efd63fbcb5b77278
- SHA512 893876730a6ab5b320af6eb5aa103938237194d231e2e92e62f212769339494b20af90c2fcd09c8c00ae853566ae01efc1a6186457f930e65ddc875288015570
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOasf6nZM9zFVSOS:A3kMIZM9zfu
- TLSH T10525BF13E79014F5E917813499E54A12EBB1BC261B60C7DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 695KB
- SHA256 bbb6eb9c50e07c7efde5f95b0bc3d4ceb98689c436b4fba1a454b7f0d4b6d52f
- MD5 b94b6ea66b310669c0eba373c55427f9
- SHA1 1a80a354c449b531a49aec05bc969c727de1238e
- SHA512 7859d681ed2b4b4a8d317c4d1157f1a385ca84032e25a69a132efd017b0d1d54e9ac56a8fe99a127e64324b58224310cb73a28dcfc971dcbf0f9bce2d136172e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf62N:A3mnXoZjzyaEFo3+aWiauoOasf62N
- TLSH T1B9E4AF13DB9004F5E51A8130A9E64A22FB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 695KB
- SHA256 26fb9dbf5b9e35cd0115b92382d356d9e397cdb4552d7b4b7f8f71d08f947a60
- MD5 1d1f0bda7cdca0d80956c8d39d7f642c
- SHA1 27c429f9fd64aa661740105b7903830b82b8bc84
- SHA512 7331f18a1d544a64bc47fcc49abc13ed70c5bd5a94969e9e41b8022babfab5c729a010a1001ac4de6fd2b977f25e160c48baf2281f402d594cd181ff16963105
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf60f:A3mnXoZjzyaEFo3+aWiauoOasf60f
- TLSH T1DCE4AF13DB9004F5E51A8130A9E64A22FB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 833KB
- SHA256 154edddc222115e505a24cb20827141a4b2e612e7ab463666be2bc6e48c903d2
- MD5 20ddf0703144afdc59b73fb193aed6dc
- SHA1 3a25ace12b38fe879dc0fc69b05c99deeee04495
- SHA512 2061dad5bf297eb9ee5937a37bed0a15fb17241ba7e4b549fa6453b7358ac5d0b4b5f38f2bb92e62302f3ec6d41b9a9749df634385a3d777e042b7c816211852
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6CyPz5L87:A3mnXoZjzyaEFo3+aWiauoOasf6fzy7
- TLSH T11105AF13E7A110F9E11A813499E65A12FB75BC221760D7DF236882252F327D0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 695KB
- SHA256 4dd30e923152bc5e8fcaceb72f8c05cd2ca92de924a0463bc8f721c6e1beee92
- MD5 3702be633ebc2e5d9b2c47b12088e21f
- SHA1 474b317ede96bbb86c3e2c0d108dea0666b4fd64
- SHA512 69ffea64243417bafe78c7a7eba72e23b2cf070e2cbbc5c11de409452f967911ffa03b489431188c3db9f322e2ac3f0da8b5d14a1a8a2e7ac7dca0880d828e08
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6eo:A3mnXoZjzyaEFo3+aWiauoOasf6eo
- TLSH T16FE4AF13DBA004F5E51A8130A9E64A22FB75BC661760D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 695KB
- SHA256 c63b17958982fac1606ad0fc18496018f80f5671aef65b8cceeb356bcfb05226
- MD5 8781be8b87c005a6bebf914e8448839c
- SHA1 2cba61aa755c3ab1cec2cff1ec21408325dd6ff8
- SHA512 63550d201d1a3a7754db930b07704f9731d7e62d781e5c0fbfa20387b184005ebab8d795859d829e936d2168adfffb16253da11c358db6671884d14e47470d7d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6yu:A3mnXoZjzyaEFo3+aWiauoOasf6yu
- TLSH T1CFE4AF13DB9014F5E51A8130A9E64A22FB75BC621B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 833KB
- SHA256 fb3823b9e489ca60505937a0d7c4387b7691451e1e0ccd99c2835a97b3f17923
- MD5 700399f49a90a9a759b42065523efac2
- SHA1 4cd6e00263b61fbea9fb6891c8e662eca903d10f
- SHA512 b9b67c12f30aac530b3e062fbdce5360ac49d9e8206cec1526715ac3d238a555983d8e1245de455f2a6b3b22edc50668448cbb7c1757153491047432370a2ec1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6/yPz5L88:A3mnXoZjzyaEFo3+aWiauoOasf6yzy8
- TLSH T12A059F13E7A110F9E11A813499E65A12FB75BC221760D7DF236883252F327D0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 957KB
- SHA256 b52ea5c5ffc9bbc73c0726b99b2f381e4372931bfdad696d912460eb8e34c345
- MD5 976885ab03bbac47c6aa621159e72aa3
- SHA1 60d41dbbf13a4ba6e509341ad6a2f27e026b1ce0
- SHA512 a183f169ddd846ee31601158898e0438341938f7c7382bfee64f0523b4b120544f90bfa3e40cf2e01a31bef716bc20db36cd903d32c9519cb362827a8893ba14
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOasf6WTWaLl3z0zDI:A3kMrT1LljB
- TLSH T1A125BF13E79014F9E917813499E54A12EBB1BC261B60C7DF136892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 695KB
- SHA256 566f7a9fc54635f35488c5b29534b089cb111dfebcd6effab42b4575b64490ef
- MD5 904cb532cb83450f1c67df760a359232
- SHA1 1dffbee5220cbdaf78867a9f9bd68f9a5f726219
- SHA512 57b830da282e2c3f19a284dc5a032b7a0e8f500e485d251a46405e9aaa10b928b4becaba2fb65eb88b2f06f0daf0b9c72ead286ff39e724629d89d7e840cfa29
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6G9:A3mnXoZjzyaEFo3+aWiauoOasf6G9
- TLSH T119E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 695KB
- SHA256 9afedceaab5c24fadd563f824fe3a2cc5fdb0de1f9cc46e890f96f80ab193a39
- MD5 ad2aaac052135c21706f3551104d7e11
- SHA1 11e88b250e9f6ba0e9809c179f3693f72ad6cffd
- SHA512 3060d2e873a65b2c527f7ed016bc36a720e451f8b509927f7e3c33454f80f2e62b057a1c23a3fcc694f6db813a73fc6447c4e7b67cd31ff0f7a8d77e97f3ed09
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Gc:A3mnXoZjzyaEFo3+aWiauoOasf6Gc
- TLSH T17AE4AF13DBA004F5E51A8130A9E64A23FB75BC661760D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 695KB
- SHA256 651ebf505f337609213698ca91a6c388fdcc9fb84184ca7b319269a85daa6f2b
- MD5 690ddf8676eb64c723e9d5984455265c
- SHA1 6be96b1201791b1ada795c0a2292d33c1e911095
- SHA512 88de08bf868d9e75b2faccee064548090c2c57a1aad6afa1dbc2538dfc090f7c889770cf071e78095f15eb7539e06a7212788d3a1cdd34bf513c8ca85cc47683
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6/p:A3mnXoZjzyaEFo3+aWiauoOasf6/p
- TLSH T1BCE4AF13DBA014F5E51A8130A9E64A23FB75BC621760D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 695KB
- SHA256 db8fbfa15799426830c6531922339f48890b37151c1bd92eeda03359c14f5970
- MD5 b14d542bb25b0b10820c2bd33ed43904
- SHA1 853f452ba5f19fc25302a504b7482949c7c3d56e
- SHA512 d0d41d5691b04dcd1d6ce4849f4a180b9c60e5abd918b239039b7377a1d2658030841aea5ea84897679293c32cface1ab0c6f834783cb857f3e86cb55654552a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6g0a:A3mnXoZjzyaEFo3+aWiauoOasf6gN
- TLSH T13FE4AF13DB9004F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 695KB
- SHA256 47c8a193ed1b7412a9397d42c4a42854ca1e2049650cb908e53883e6a54b5e05
- MD5 9fd4e6046b0837596406c4d6e84882c8
- SHA1 261390a68a5ffafe707cd89cc51d20b400f5dddc
- SHA512 b966bbdb12f6369eef4376520e8eb2aeef732d827658e219c662b375a2fb5c86510cfdda9c860ae7e02d9b674f1184a637f8c2e256f5ccbe7f65cfb1a1aa1ab6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6oF:A3mnXoZjzyaEFo3+aWiauoOasf6oF
- TLSH T133E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 695KB
- SHA256 48f316d23de8cd0663a2f2293d9ade6c61684df1a20584790bdbd10d362e0239
- MD5 b88091be82af2bddf148e78a350ca9b4
- SHA1 923968b9b1b38915ab618bb7e00d10cba40954a3
- SHA512 0262a24d3527175928247843d4cad9c112b58f18579c8287ce836a997cc55c1bb2380a80135e9e8b8dc779bd14643a5a9d447dac6061d822bae1149e666700dc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6dC:A3mnXoZjzyaEFo3+aWiauoOasf6dC
- TLSH T17EE4AF13DBA004F5E51A8130A9E64A23EB75BC621760D6DF6368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 695KB
- SHA256 0d19d61bda6af6f525b31dc24fe07a7921d19cb2a5391a9ad4ada56163b8ecb6
- MD5 2e0634b86d11019ca54d9cb85672a861
- SHA1 47454b084a4e642623a4d126cd5346e45230054f
- SHA512 a4369288c8e51db693543dd4ba6234175f44104a2f753dc3c91b43b071a1b05bd150f247899678265d234fb4b158de4ab86850fc7cb0d1501ba3a288f369298f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6mw:A3mnXoZjzyaEFo3+aWiauoOasf6mw
- TLSH T15DE4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 695KB
- SHA256 34e85af962b7a226561164fda28329d73fbe7f04a44f3693b2109a164415ab69
- MD5 66f45894ecd656d46d022857b3241db4
- SHA1 db30f0e1b4c3c6f049e29704a449e8e33974b0cf
- SHA512 d5060f19b9277ef8d5fed2a094dde4ddaeb503d6014bfc7626191db1c8a302c0f4ec00b45e2cc31dbf59c1e9580108de72f0e4598a633b6169ae292c70f3c39b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6VT:A3mnXoZjzyaEFo3+aWiauoOasf6VT
- TLSH T194E4AF13DBA004F5E51A8130A9E64A22FB75BC661760D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 695KB
- SHA256 752faf2ee2d33e5a35d4650b815ee45139cd420429880950e2146b2a834eddc1
- MD5 fd99e944e4e1f360b262ff99ab61f54b
- SHA1 531ae0130d00d4ba8da93867105077b355d81b28
- SHA512 599e59433db9f5d98c5457b5364446b994a1e9416678bc58983f598023b22ccc0c76197795ea0c91fcd8d99cd7bc9fe8520912fce02741ca13f91ee238d07e56
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6ru:A3mnXoZjzyaEFo3+aWiauoOasf6ru
- TLSH T1CBE4AF13DB9014F5E51A8130A9E64A22FB75BC621B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 695KB
- SHA256 c6b0b9f3410847aad85856f73b787655ecc096c95b8dd9eef3e72cff93a28986
- MD5 c7abf0074f5f719a101072f3575f41cf
- SHA1 525582d2e39140719097616a5749315692cb4263
- SHA512 35f677993d2c76be842a78660522d3baef8f4c9ff1396fdabb73c6c97ec4550ad4becb9b44ba73e0a521f04a8a3c2993f7a582e7a168cc52aab94f3402e1bcfe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Pb:A3mnXoZjzyaEFo3+aWiauoOasf6Pb
- TLSH T191E4AF13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 695KB
- SHA256 8890b4e9056a1753f838b5735e1a854b3b0d8ef0c550f7002bf2a593b9df2dc0
- MD5 9b0eed5fa4e827a4b16b6de6a22c3e68
- SHA1 651f1e32674c2101a23d595e55d0c1f37d13817f
- SHA512 40296d946a93ea893276732397b2e983aa9417243f6a6878e818b1a3b65fe50e7403b9f2a9ce4ca080c784770609fa41bdabad2303970f755c6054ee007c4285
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Lf:A3mnXoZjzyaEFo3+aWiauoOasf6Lf
- TLSH T10CE4AF13DBA004F5E51A8130A9E54A23EB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 695KB
- SHA256 0d25165db4cf684e8040e241eef33fa7ed62a6e2c8ca9e8f2564b1dde80c0a7e
- MD5 31f57f9a579fb48766d3b2f2337be4e3
- SHA1 ed1f0223226eaff53c5954145d0d385e66e84526
- SHA512 d1eed0d8560c9b09bdf083dbe1b5372288f16d6c4d96ee54a661aee01b7a9dd7c81e3e6685b327fd6d5fe243a10fa5b263d46423b455ec6318b2ad9215f6d590
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6EK:A3mnXoZjzyaEFo3+aWiauoOasf6EK
- TLSH T1BCE4AF13DB9004F5E51A8130A9E64A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 695KB
- SHA256 c4a3c373916a2825e417107d652c3aa1d828398ab70a628ca989f9ce1d6385f6
- MD5 d983ddc3ef30370cf148b6696b76b706
- SHA1 946c057f1ed785aa0ad4056bc6e3e85e86ba1494
- SHA512 3fd315da43ba924916d24b9fcd9283a83643f6d8a9a41db9fdaad42969e00f70aa3e131a771b8e30abf408bfea58d148fd4021d8c60c9a5d716bd10ccd649335
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf65k:A3mnXoZjzyaEFo3+aWiauoOasf65k
- TLSH T1C0E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 695KB
- SHA256 68e2a9ed698264dc8b411e5393ee4664281f10a6d779f9a1166fcf1da7cfd613
- MD5 4094df194bee8adb5ce1f84ac82b6fa0
- SHA1 a6c140021826b105bf824a5b25fc7876521ef2d1
- SHA512 6faee5e8e9e4e3165fcf6dcd7770ca53f854ffb9b411cc06d688271f4e23d81006455eeaf3857549c90d179573838181671e3309c65aeae670a197ebd31edda2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf620:A3mnXoZjzyaEFo3+aWiauoOasf620
- TLSH T14BE4AF13DBA004F5E51A8130A9E54A22FB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 695KB
- SHA256 b1c2a4f801e7ce80b746bd0418a58b34268d34bd5b24b64ce49252d8f560e4a9
- MD5 417373b3a4dc43a6024f63372a9c56c9
- SHA1 0097a336f67561a5d0d60ceaec3aa002c3645ef3
- SHA512 80cec12f7be65861379dd024c0fcd0f35535b479cb52d66482c8e45f5a294345747c4629fd032371790ddb766c5443702a2de232bdc4444a3cc9c4f780c19654
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6F70:A3mnXoZjzyaEFo3+aWiauoOasf6Fg
- TLSH T1C5E4AF13DB9004F5E51A8130A9E64A22FB75BC625B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 695KB
- SHA256 a92fe37ba7c57622549e22b6d01c9b82315a869986b3df18e27fe536131f89bf
- MD5 773c1935528eb69ec0e077b2527a2efe
- SHA1 8fda2c91673052153547bc13cfe6e1bec2a25425
- SHA512 1c0ab32b117e3e7fe8596f22a392a2adde45551eb40b050f910da0dbf2978656e1fe79b53a5c881abd653c5645021f094070e73a2cf7ac492017be675848121e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Ur:A3mnXoZjzyaEFo3+aWiauoOasf6Ur
- TLSH T1CFE4AF13DB9004F5E51A8130A9E64A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 695KB
- SHA256 c4d3b6707cc782c5cc8492aaac5564412e03af0bd297e5efa916fc9bc0979603
- MD5 d95328f0883c86e3e4f559edebba816c
- SHA1 148b4b5996b7638864189cf7dc19ea38ea066c30
- SHA512 6176131acf3cc78361c6d6fddfe861f49effd2850f00fc472783aa38a01e6deab5725aae46fe90126c32a5732d3089bd3c7bd6d580cd574953343ed2a67e72ef
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6qn:A3mnXoZjzyaEFo3+aWiauoOasf6qn
- TLSH T1DEE4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 695KB
- SHA256 071997b342054b7800e6c1cba8bb67aa4cf2aab3b76b55dfecf818b546f60280
- MD5 62584dcd52d359ca93fc12ee546d6ff3
- SHA1 21e877abc13a600dff3804691500bb994d33bc85
- SHA512 ff9c881261770f4fe2c847955c604eb70c39c5f933818e8c18499c8df4bf8d60a1d8b899ed7f79823431121bc15002fd9ac13c32b81414fdd4115fc0457e2467
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6gx:A3mnXoZjzyaEFo3+aWiauoOasf6gx
- TLSH T12EE4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 695KB
- SHA256 c44f92bf773381c605a1f369d1d9c5b2509778021832aded0a7e43fdb71dc3ff
- MD5 20a039e0f949c7147001443f2a7a940a
- SHA1 cfcd487e3ac7887ddc359492c37eca10223ec52c
- SHA512 0b89b1a6511aa80ed7e3a8d23c60412025f8f7fe5255748f2fd48e469031dd62bcaddf8e94e6936e942d5c3eff613797b5f3b255cd6d7aa977721126f5c86f59
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6iA:A3mnXoZjzyaEFo3+aWiauoOasf6iA
- TLSH T102E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 695KB
- SHA256 7bf51dbf491af4d880242e6c7d29d5625408de1549a7146f240a02352670a7c6
- MD5 3db41b67aa021682b70e68067fbe91d5
- SHA1 5b0977b701857acfa9bc3fec8015d9a91ba6bcfb
- SHA512 f54b33fba0a8c07287cd31e8a698b221d7e96111f8060c769267c37fd1c2d57b7743e10363d5b7ad0079a61476d113be2e97fa19eae3e1c8ffbae6447a63daf7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6b9Q:A3mnXoZjzyaEFo3+aWiauoOasf6b9Q
- TLSH T1BDE4AF13DBA004F5E51A8170A9E64A23FB75BC621760D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 695KB
- SHA256 027799fb50b97de50c9183c76b9c10a4fe1ddc0e701cb2eba041289a6977d9f6
- MD5 fe9e030fe4237f88df9b823a8cfdae01
- SHA1 c9a6744abe15cc485589d8f5ddcecd7ce0ea4330
- SHA512 fb5894c7e4ac05fd1a9e5d3175b7938c3599d394d258d5827917fa14d5f3082db6897a6c31ad74496845ad03ea7e4a389b94960dc01135e60df1fcfb3f126c08
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6q4:A3mnXoZjzyaEFo3+aWiauoOasf6q4
- TLSH T1CFE4AE13DB9004F5E51A8130A9E64A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 695KB
- SHA256 09635e2c8d5f21faa4f126c473b1de51902bce4ed77f31e6f94ddd67181694ab
- MD5 13dff3103548b351d4a082d54b586d1e
- SHA1 619eb9a8202d141d2adf617965bf6ad6df29ace2
- SHA512 e2e6b2d9d91636dd01525b4a1762ccb458bc4a541aa4946b5de0f3f82d11ae9aaa0f819cce7f64937863048769b8373cceb40946ac54c4430efe86ee60ddcf11
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6xu:A3mnXoZjzyaEFo3+aWiauoOasf6xu
- TLSH T1F1E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 695KB
- SHA256 07e86bf074120506935f84690cbe74a15894785b98cdd9e9414f7c56a968a40a
- MD5 11f73bfc08d6d0b34ddc8a94e8280d79
- SHA1 0693d4e144ff35851b92268982bfac1464286ca6
- SHA512 fb4ca10dcaf35c0c60d4ad70ab89602493c372ab67bc470abb7b50f6d0e9412e1e33bb51a38a820e53311afbb4ab87df8cfbbcb17e82a6a92c18410b13daa415
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6Ej:A3mnXoZjzyaEFo3+aWiauoOasf6Ej
- TLSH T1F8E4AF13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 695KB
- SHA256 14416d0ce4d25543e8d0c174fa35b1d37e44594b13c0cd9c8f0b9542d3c3df03
- MD5 5a7a071eb20d74011b22c17d57245f3b
- SHA1 bd1120da7be7bacaba75f76c296e1e8138bf161a
- SHA512 ad4338efd77540311cc13b646f9e494225da76ef3375cdd4bfa3bbadab8b619b2049e7f15716dce0b05ccbb253dc56908b6fcd364f62659b9c095fc73ba63519
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6lg:A3mnXoZjzyaEFo3+aWiauoOasf6lg
- TLSH T1F0E4AF13DB9004F5E51A8130A9E64A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 695KB
- SHA256 e15af2bafcb3dda095ce40611fecb1ece3d165f8448f5224eb148f9df790aaba
- MD5 4fb09ddf33a7351e9631b68b74e55c3a
- SHA1 f0b66ab6ecee0795dbb870c0c8cbf2617450c76e
- SHA512 e1ea7ea002534d7c708d8f3ccf2e49ed3b6cccd58713648a27dd778cb00ba9999d6669c980c2adedbf0483f8d2ce889cc3cbf9ea58ab7639b5852dfe171a702f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6EI:A3mnXoZjzyaEFo3+aWiauoOasf6EI
- TLSH T1FEE4AF13DB9004F5E51A8130A9E64A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 695KB
- SHA256 f75caf9c7f984767ab759ab20ddd4ee2b8902eb97c6543856bc6a65f9406d7c8
- MD5 e758a94a2b667027547c1a41893a4202
- SHA1 003dcf7a4484e5b73a0a1dd1b55504c8e7d26082
- SHA512 de31bbb1df110b9c101f5388ff4d83166a74184c38481f52bd6c6b355bc2f7c5c8d7d26d47e35f23c605f28720c64f863c0c04e2515aec0cc0a649e5a962f0ca
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf62o:A3mnXoZjzyaEFo3+aWiauoOasf62o
- TLSH T1F0E4AE13DBA004F5E51A8130A9E54A22FB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 695KB
- SHA256 a28927b699d2c7fe9b6d4e6bf0fcab2d74f4f9d66206b19e3b9affa49cb5be3c
- MD5 7d6e2581ea030ff22b0c93373edd360a
- SHA1 7ad63ec673481b215fd8d83edd08ca4db51c0418
- SHA512 9e7b08f3d1ed4f1ee4f48bb6c02fe0eb5be8dbf8436addc04650c6bc194a9bfdcb4c0def7dce87f7012d7f7222af9ad32a6f6fa5a84f521e1aed4830de7eec24
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6d+:A3mnXoZjzyaEFo3+aWiauoOasf6d+
- TLSH T17CE4AF13DBA014F5E51A8130A9E54A22FB75BC621B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 695KB
- SHA256 70afaa6c78583a04bbca457a0791e164ca5599241b589da7776caa67cf458b14
- MD5 d963a021775fe5a02b350a32b2e355e9
- SHA1 40cfc4a01a029fde2117ca841562089f96514e69
- SHA512 68484892ee5e25c62831dcb14e36bb0d16bd3f35f92322d9cdf9d5212f477a94c4d4ddc3913005d0d223ebd8e7242331a861786d7422a468714b4cd214886d43
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6LQ:A3mnXoZjzyaEFo3+aWiauoOasf6LQ
- TLSH T1A2E4AF13DB9004F5E51A8130A9E64A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 695KB
- SHA256 05af58f548db8b4c29e53e4c37ecdf17149f4b4d2ab29db622281b54333c53f7
- MD5 d0eb32f85e85b08d27050776d554e043
- SHA1 4344bf2a678590f37a7ada5038a5f55abb8bf0eb
- SHA512 974793ed8d81682aa65502b641bac7e24b53e2c5b1efc19998c7beb1548b5035fda91ef6a8df0bb11babff0a46d13b5cabd84d9142a4dea75874bcfe774bfe3a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6AX:A3mnXoZjzyaEFo3+aWiauoOasf6AX
- TLSH T13FE4AE13DB9014F5E51A8130A9E64A23FB75BC621B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 892KB
- SHA256 40d335068df029db485bf660e604c8a4d82dc0f6c81b4d2d0dadd9acc9982845
- MD5 3196cbd239154f403d57629ef192a20b
- SHA1 48e471b6a05a733c08e3a36e77b9235e04961a30
- SHA512 819b3c54447b5f857fd0302cb0730fa73181c3b0e18bfebc209ee142fb6b1af85392c1e622e8931cdb0292c32fcb82b8f693ed99cf6b3342f516eb1fec281358
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOasf6fjCXF7IwZ:A3kMWC17IwZ
- TLSH T15C15AE13DBA014F5E56A813499E64A27EB757C221760C7CF539882252F237C0AF3E7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 695KB
- SHA256 fdbb0c029ff28e94bf6b665198537d803f422c836a5e9b2bf211d9ed04bd03fd
- MD5 f5ec77fa94cf4a3df80e715442f331aa
- SHA1 1f9a5256063c88520c947ccc9406200b0fbc32de
- SHA512 60c08204df0ea53ba2fe13d6beed02252438f11ce669c1c87c79bbad8424edb35632bd230f2a985298793810d5e0a5c157f736b768d430967a303c5249f9e3f4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf62L:A3mnXoZjzyaEFo3+aWiauoOasf62L
- TLSH T187E4AF13DB9004F5E51A8130A9E64A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 695KB
- SHA256 12b0a2f13775691856ec23b3c43cd0363d9004f6495d7d109f1785d5f7fdb6e9
- MD5 c31a25b3c51cce19384b5f3d82ad485d
- SHA1 75cf1ef3f68884f7e16f79edc843f0b2c3b0ed8e
- SHA512 fba3b74b55f576c915d39c670679ed6e64b9ae6a3e3f3eb4a95d11ca052ba382fad8cdb18a243eb6ea5a3cfbd5401aa12d1d2374e8a1ead8c3493044c9bca9d9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6KFC:A3mnXoZjzyaEFo3+aWiauoOasf6KM
- TLSH T16AE4AF13DB9004F5E51A8130A9E64A22FB75BC625B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 695KB
- SHA256 821ff842a7513f544e7aac942b5657bf6c4bf94a237a63abbd5738a1c361576f
- MD5 d620e6ba0c72750e32ccefd6da25b44e
- SHA1 fc64b31ca1fbb9b38a4f7b2abfcc7d446d019d09
- SHA512 0eba99c65550db433403754eba1bcb60d5b3c0f020ebcf5b57423ce06c172d0852ba5a04d52c1a3837b45f4ed54e2303f7cd725844fc8c51574efa8e0580e230
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOasf6bh:A3mnXoZjzyaEFo3+aWiauoOasf6bh
- TLSH T1C0E4AF13DBA014F5E51A8130A9E64A23FB75BC621760D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH