Analysis
- max time kernel
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:15
Behavioral task
behavioral1
Sample
2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 823KB
- Sample260803-dr8e7axfma
- SHA256 ae81117955abcce340ea787eae425563716235800d00618dc518b74d0d49c654
- MD5 9199da655ce4cfb6bb7f17771688b40e
- SHA1 3634188f72e573f9eee3470992c9ed164201d710
- SHA512 dace4d87ae72ae170dd604bff4295b2699bd825ec360163297a1554317ed30142121a2db9dec0e1999fd473574a24139c25b8d146e03623d325bf553896cdea5
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413c:A3kM/56rQ
- TLSH T168058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4684-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c540-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5476-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb5-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-446.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-550.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-980.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1023.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1056.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1093.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1155.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b69f-1913.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c540-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb5-60.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-238.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-264.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-446.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-495.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-550.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-611.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-630.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-727.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-746.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-789.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-828.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-859.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-878.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-891.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-898.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-911.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-930.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-955.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-980.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1023.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1056.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1093.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1142.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1155.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1180.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1187.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1224.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1327.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1346.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1372.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1380.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1387.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1401.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1402.dat aspack_v212_v242 behavioral2/files/0x000200000001b69f-1913.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5476 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4684 2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5476 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9199da655ce4cfb6bb7f17771688b40e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 823KB
- SHA256 ae81117955abcce340ea787eae425563716235800d00618dc518b74d0d49c654
- MD5 9199da655ce4cfb6bb7f17771688b40e
- SHA1 3634188f72e573f9eee3470992c9ed164201d710
- SHA512 dace4d87ae72ae170dd604bff4295b2699bd825ec360163297a1554317ed30142121a2db9dec0e1999fd473574a24139c25b8d146e03623d325bf553896cdea5
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413c:A3kM/56rQ
- TLSH T168058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 921KB
- SHA256 d1859e1fac71267ecbdcb6603f60be0ea7c4cf1285fe0641fe3d4a99a952028a
- MD5 b8d56665be26ee802d2ff78272226521
- SHA1 8c3e9ca336a67529dba9f9d457d3e06501b6d85c
- SHA512 8b9c26008013e5ba5a461fcb5b0d65827c8d7abe29a5cc0b6e44a4bea58570c6718c6cba4bb0e0fb4401e7189192e255b444bd8b4f5143bf60bb1177577201c6
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413ebBPzBAU:A3kM/56rEBPVAU
- TLSH T121158D03A6940FE5D12F813499A54962EB777C125F208BDF1354AE293F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 1e7be09cce7892c2649f971a59f04f4f8b1a3ff690c9c89855d2b0e13e4ade00
- MD5 d4b32a0732d2a97356db7cd0fc4df2c5
- SHA1 0c9e583d0e712595245f4ad9bb8dc270e21d837f
- SHA512 b24edc54d1fb90ffb094fafc4b9c2f6e3580ac314041e047ff2fd60fb152eddea46d6fa1d8b60a7037156e054ea76ad82b1ff8e273bdc9b31a094e7d6084cd55
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413k0Le5ji0hmxNrM:A3kM/56roPji0Aj
- TLSH T160554A16F6A44BA5D02BC178C5D2569AEA733C425F308BCB03549E283F377D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 837KB
- SHA256 dbc2fa1835740e3ebbe1dc9bd46b998eaf9a598eddf2bf44b3c84aae3859d9b3
- MD5 7376cd1de21c1d7647052ffbae3f05d2
- SHA1 712bbfc8c98b4a6623f93b27cf5e1016aebfea64
- SHA512 0e541e52be0b5663a2e19156cc24beeb628272c08d65a10f26f208d6f113e88e4b86377ad1121f8473c0903da124ce8720914959ba06964938aefc7fe9903d83
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Oa:A3kM/56r
- TLSH T158058C07A6940FE5E11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 871KB
- SHA256 cccf91afb2d983be2d9f5b42ca589840a552060ba106edc6a330cad30f148d08
- MD5 095e385c2496c50896789568fe88ea4e
- SHA1 a5a9ae5cc10692e31b6b0d38ed3805d8102a1e5b
- SHA512 525cb01bf83d77d4a836835477a50fc142ae3f551a7ddb1bf9d04e7300c498e957ca06c8d0a305df5b02cfaf0aa562bb0ddc34eca300bc341d8c8bbd032ae907
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Nb:A3kM/56rxb
- TLSH T1BE157C03A6940FE5E12F813499A64662E7777C125F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 846KB
- SHA256 a098f514f23bc6cc0b6eb9333b99f9ed2be8f6918f2300c8fd1597fb453bbeae
- MD5 fb5a47c2b7bf9f851bd7ad7bb5b0d907
- SHA1 2b25f9ee46b81ca1e1fecdf40bc1c49331f343d7
- SHA512 a5e7aad6e4772bf4103c7fd1da1c7756aafa332b51eb642a294d6b58292daa486ebaae896a9c8754d3670b6a4f011d7843e48635e4d95df15f268586d4f9bd86
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413v6:A3kM/56rW
- TLSH T16B058C03A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 846KB
- SHA256 32e931df79834d9023e6491c034152aa2980d8f27a7151bd1343748a3ed9aad4
- MD5 a8013aec41a281bb89cc6f8124721196
- SHA1 51d35d79e66ebd2ddaf83331ec4803dc704b6bc1
- SHA512 2335596f92855c2878206cfe112dbbbc4d0869525ab1eecef97a48c3585d5f7876e52f77aa6c0b2f80294587b16f37d0b67c52287c9271227111ac4021165679
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413po:A3kM/56ry
- TLSH T1B6058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 846KB
- SHA256 ec55583e0be489ec0a0a5205260229043f0f259edaf520549045adfa5819cccb
- MD5 b0342bc6bcd222ac7f46def207b109b4
- SHA1 44fe7a871381344c862e09386a739102ddbc44b7
- SHA512 2d0e3e8be44684d314fb01d0697dc024d023d25b7fc0d8655c8885f2de1ade1808d27834c26cf53264264c6a876a64f3bd6f14c93ff88d74934f2b5ac2f74c68
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Zu:A3kM/56rc
- TLSH T1D1058C03A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 846KB
- SHA256 632ed1c83503c897c656a2566ee1669ee85111775fd4cc7814aa150e62e3db06
- MD5 34e6d5c8cda9d5b4d01b745a625cc42f
- SHA1 dca6bbc30c592cf12592cf94c4f8b02061c6ec27
- SHA512 758990ea8dcb85954ec7d3d990692c64dcd369466405b6373e8dacb7e9ed4bd293e8539bc73df9db9c9843a497c1719f8c87f4b3515d0eebe207e7beeb46b5cc
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413/9:A3kM/56rB
- TLSH T121058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 846KB
- SHA256 35b9ff7ca292aa41502b0f3a2a88bd1033d05a88d2f49649b784a75fa8eb8bf7
- MD5 7dd1c14d712e9c18db51bbc91d539670
- SHA1 abba7399e7510f49b3a1f727dd9bce73aec52207
- SHA512 90f8d429ff6a0d63b956576cc5cb1d1071dcbe8197ae4b1b6e4ad4e03be63d2acceffd872902e031fd552c99b7971fac4ada78db55b02c909a62f5b0fc1117b5
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413bc:A3kM/56rU
- TLSH T14E058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 846KB
- SHA256 fe52206b4dfba2f77dc5f6ddda57e8b9fcf8046eac19039d4c866b855e5e6823
- MD5 447b976c3f68484feeefbdb33814ded5
- SHA1 a641c06f5d80cd0d77fbf0f01a0e09199fe8cac5
- SHA512 803771139ce4daecc285a6a1bfa5d63b558b11eab6a63a4a37e1d2d4a06982f4d38a9b48c8296c84dc9a8cc17ca09a2193902f0719e18f0b0ac636f366301c89
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Ep:A3kM/56rC
- TLSH T1FF058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 846KB
- SHA256 c517b20ec6667376f3742983fb3a647455000d33efe29d88ef85b34c1c6f2d88
- MD5 dfe3f461f20cbc52f14eee7bc0c64ad5
- SHA1 a4ae896654833457fdf56741c6f992196f13630f
- SHA512 9eebdeeb10a24f647789775b72d5a8269cd0ae12db9730ce96a75513e390c8e533bdb1393bb5df56db3144cd05d211e8d2f0b380a9eeaec9e03511b3616fa403
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413LN:A3kM/56rl
- TLSH T1E9058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 846KB
- SHA256 de5b7c13a1b851905ccd962a844e90abaaac4c668fb13713b91a5e327937f2ec
- MD5 a75a332645947ee4d3903980f0d6dcdc
- SHA1 0f2349c2cff64f08d2a5a1a16c5dab102187cb58
- SHA512 f6dfc04a7b6955c8bac7e309a191beba865720b5937f36fa24018e4e2b2d47f5f787ec5d3f9323933140e81d5caefbe110d56c90ac77d27d8f3a352a889a4a84
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413ZF:A3kM/56rv
- TLSH T11D058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 846KB
- SHA256 52c4462bc4d714e7feaea7ca9244f2d02623cd81d97d621819cf2e275fefb807
- MD5 c3009c20e3ba8f75322b18187905eeb4
- SHA1 a450b41442b834100cc1db47bbc465b759cc2057
- SHA512 c1840025ced96f1d42e5e91709220212dc88b56dc93b65ac282435084cbc39300c288ce18ab62153e78459668854dd515b3f24ed310e87b1cbabb35671cb0d08
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413yC:A3kM/56rj
- TLSH T157058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 846KB
- SHA256 06ce681f4accb1940ed13e02619a4f17a47ca7f4c522cf385f6ab7cb30ae8004
- MD5 d8ba3528c46bacae051c29017d2c2a50
- SHA1 038cfc643f0ebd9403272467da54036b0a6be80e
- SHA512 3a10dc23cb595ced74d68c61cff6d5f54be8b677992e2043fc3ad9ca2e01d0950138c9cab99dd42d86a5858fd923767079a3f605bd74ff10936659b32bacab4e
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413tw:A3kM/56rm
- TLSH T148058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 846KB
- SHA256 a6ee12baa12ffd66b07d52054fa0d152e2cc67335ee54bcd2690a96597b88203
- MD5 37c750e0c4f27cf3074b21d3e30d284c
- SHA1 d24db27ae3b935030f8094186878d846ac9fca23
- SHA512 7e69aca3a30320fd4545125fedd2f6954d96518fb9c5aace499309a705e760db7f5cc6f78af8ec8a4b967b6d75943a5b86e14d47b3d71fddff00136fd2e9583f
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413cT:A3kM/56rm
- TLSH T16E058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 846KB
- SHA256 5ac201466b5481c6c1d0be0f39c25e787261644288fd45d0310d3f424b00218d
- MD5 a77f3027f34c884ca1b6bee7eee54312
- SHA1 38310a22cc6daf30333a8c51127df81de77f8bf1
- SHA512 3d7936d16378250ae761693fb72ffb1036aeac25298937b636ef11df376f50829cb6fe692beaf49af810965ba63c19bfbde9f5ad5fd27b0d96207f5701eea013
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413wu:A3kM/56rB
- TLSH T124058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 846KB
- SHA256 6d88c18753ac5539e0f3e7c98933cf8b8d72410ee5d4ab59c1f023ceab25e475
- MD5 c359e45252ab749b8b6f8a302cd0573d
- SHA1 727f74a144313e475509215da6d5c47bb0f833b5
- SHA512 92d66cd4f893a0d650b36e44b0a72ac21a994b9bc5c6369180e291d962355fe7eabbb46a9a78975f6769dab4bb2b095b26792f336bbac75572d2c53d5311c937
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Ob:A3kM/56rg
- TLSH T15D058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 846KB
- SHA256 baec1914b4cb9f245a0e94f1b1553625b41b6825b04ef42af66186ad39ed5ac4
- MD5 e8b3ed353db34cd41306f897495adc7c
- SHA1 eb85a8a729c9ea5e2f1f075298822edcdafd2732
- SHA512 870c9e3c624e2168a4e92ec7c965fb161d3055bd186c0f06b9e8c813921898a71d1f499ebc569ac3f81bfacb005a10aa28524973a8476775680d6df9caf0523d
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai4134f:A3kM/56rQ
- TLSH T12E058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 846KB
- SHA256 75995d577666b85cb18e2b0e46e6e58c88fcc161c7c412fdad809ceefca605e1
- MD5 46922616c419d2f4e23d3f2566a0b67a
- SHA1 8f676afc562cce6c75f30c654f224b32cc0bd5e4
- SHA512 e6bfee5bd408e88bde9fb2f4ec45f187095787bcac03418ab0c75c747953b5b42bee1872bfa802545e3b0eab7332ca87ccb69242d9c431b188280e0582199f2d
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai4131K:A3kM/56rw
- TLSH T110058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 846KB
- SHA256 ba249876c578b2ed9053c24eaa304e84670d6d90efebe3dcb342f0a3a23b44ae
- MD5 456b5c28335240806b10e8cf3b1bc030
- SHA1 c3a6889f95f48cc4441ba07e4bb5d28c0272c903
- SHA512 a9a938112f233e748b8fdf8afb2c54893cc194df60f589ce318a7b3408ac079275fb58d57818102412b2757975a6649a2e150bc60a405c46879aa1db14dd1693
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai4132k:A3kM/56rZ
- TLSH T139058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 846KB
- SHA256 4d58d80334d66a80b2a832727974ebeb961edddfb5d9edbdfeb41a848b1b40ec
- MD5 1c031e641022b9f8ad36d881f82ed84e
- SHA1 3b2ab36c2bc86993c061f8eda823cdb7f0a50d48
- SHA512 04038a8e5110bd6912e3c1ad94506bec55e55237809f34a383fd04bbc4ecb421e7f00adefe9d561a9ba6e56e04dff4b0a5ea2385cc32df0919a488e15bd179ef
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413T0:A3kM/56rs
- TLSH T123058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 846KB
- SHA256 8ae8f1905d626c4f23f507bd9fa31c66868265126eff5dce4c9842b28a29b508
- MD5 4fa63c7a58b417bcb497792316f9d62e
- SHA1 9b43a59336edd3c441f7f895a2d9e3bee367e43d
- SHA512 6478d362e050f4aaf6f1b79d910105f4c1e799ea8dbc1d5c274c1a5503a234209aa06ac1b676e0cb21a1f8e80a2f75b1300fb8638b2b1cfdb95258bcf7e120ee
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413ig:A3kM/56rR
- TLSH T1E4057C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 846KB
- SHA256 80bfcdd79ee4cb04085381a1c4a634986f3c183aadb7a2ef7b5941a07057a5b3
- MD5 e2ffb885f83eb2735864e55f4e9d760f
- SHA1 f7f223a216c641017434e1d801966c7907d8701c
- SHA512 8dcc22df54ce7125bbb3011470b2da3f14e396338d849bc5f95228a63e351287c93cc3b4fd1d169ad674c61b167217dc9c6b959af034731c9f4f5a3ac2bd6e6b
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Dr:A3kM/56r7
- TLSH T181058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 846KB
- SHA256 9857e37775008889ffcfe69ddbadd3b9fe692446f2b53d9d7728f00fe580aab4
- MD5 0dffe3c36b63b5ab2475aa0f345d68e7
- SHA1 7af51cf4822c9b04e98d096b28532ada4c226316
- SHA512 cc454f97bea97ba5d9ffbc035c77a4ed933625a8a480d23e2509dc862966d297bff1d7129fe1f1c5e55268481ec722a0e2111e08fb65132cc00466dc3f2ba34b
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413ln:A3kM/56rN
- TLSH T199058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 846KB
- SHA256 eeaa4e6551695029cf485febaa58a888ada21197bc0a5569d596443be62f371e
- MD5 b99999bced93deb494b31b18c79de210
- SHA1 d5aa319b62705af1bc1447b91377a8ab2331d815
- SHA512 e0043685a40fe761fc8ad4b872cbbb3e0c525a3c2a0dca0749b3ba71b6d0dee8888d8ca5a7cd0455c3399a4d34959f5c7e7f9955dc4abee90fa0491e015d7c21
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Rx:A3kM/56rz
- TLSH T135058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 846KB
- SHA256 a66c24aa896ae59cac67a546bad09283b657e78e8c2875f504a027d1cbbe56f8
- MD5 597c6d80b18bcc9a911d7c9b2f3653d2
- SHA1 9095804e88ca97d32e8aea307822230811dc1896
- SHA512 c21c320605035d83672fdd736eda3d69377ed18e44bba32f17e997d304ef8c491dc8cd0f81d50842faea93a5c07ade37e12cf8e34151f3c955c840e3912a7b5c
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413/A:A3kM/56rM
- TLSH T1AF057C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 846KB
- SHA256 f3bb1f7f12dcf8f23cc81e454eaec82548b7eb84d633e2e3b2ac10b6b402ac96
- MD5 1c7b1ef131252169c6944b5a03d68923
- SHA1 15102571f45546082345bee93ff78dd4a0faddc0
- SHA512 4f3ae1d3921fdbc80a9f3c412887a21c58270d87d419e7f437223b4672514f61cfbfd7ec067cd5d699bfa1018acb672a55d11b2ca2024b6aa3571b44be158208
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Q9Q:A3kM/56rt
- TLSH T173058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 846KB
- SHA256 0bfd469a86bfbbf6129a6d046024179cc405e136e05e9d7e28e77817c4d917ff
- MD5 790a285050dc68305eba35ca0a3a896b
- SHA1 95c4f744f97feab047e9a85c2c68f7aece4938d1
- SHA512 8fb6651860795e5b52995c6ae6261b186b33afe33999dd4ce102d3de7dd94a9bbec75407b6fb4a202e4133f2307172e2725465229f49e8cd401a883a385c8ee1
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413x4:A3kM/56ry
- TLSH T151058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 846KB
- SHA256 fcf4cd2755fc71bb776ff92586274fd8c66e99fcbf7f6b93f95069f65ecc9d2b
- MD5 f8d3325fda7d6a2f9502e3478138d66c
- SHA1 24f347aaa0d0d4e8ff77d46c523ac2d280fe04bb
- SHA512 931ae695aadcb8ff4229e268ee3c988fdd821caf7ca4e82bf09a49feb72ec60261d708d2cc2a34cf26da1d8b800e49e51a2c55c70e468db7572e533f15c895ca
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai4130u:A3kM/56rj
- TLSH T195058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 846KB
- SHA256 ec3ea6bde82a51c179df896f044fe6b10e64dfd7edb4078b26dbb0892643c8cd
- MD5 d264f8a685c40a8077ace66ecc435623
- SHA1 b2bf4c4d3050ce887cbdaab4190b903cc2cc6361
- SHA512 12cc423ac436b29f19bc4fddf0b1cdfeb03e957d7669a2938298fe82954911b385f835e65ced684207232249a7454fca2a508f0df294cb18323be4b44f92ba34
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Fj:A3kM/56rN
- TLSH T178058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 846KB
- SHA256 89561f519e410244f1453054982a9b5d9a9754600228de2fe2ac99b16f4ce701
- MD5 f6e7b7f3e8482e0c9c7aaf9d1c4ea045
- SHA1 2506a277011598b45115f629f4f6d502df98f8a0
- SHA512 6e799867e90b075c7909445749c4eacb79c604ec816f85a08916fa938545aea82064af2b9a05b717ed267f1e0791229dc928c15fb6b27fd4fa298a82cf7d34da
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Mg:A3kM/56rR
- TLSH T1D3058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 846KB
- SHA256 3071f1eb7f01824f6f5d986e3027e0256054c4a6a3efc33ce337696d090fa88f
- MD5 7cd4b73c251f8398d66b937ee3bf58d4
- SHA1 b6af7e32722cc7912027cf2e2893dfcc24ecb856
- SHA512 614642c344482a1488de762b4c510049176f5e2bc923881ffe3ad50bc1a9e4825e6ec0ed728baafb66b0dbf355602e3cbeadac58c0c4285628df48efb5af3580
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413TI:A3kM/56rA
- TLSH T14A058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 846KB
- SHA256 9e7c49430abc66454d4f540e74d391b4174946531d2364510cf7dcbfc9d04963
- MD5 3e3eb53ff1b8f840a79156df15c9313f
- SHA1 c8dd4e66c2a570c814a4c78c0879d31ee008ce13
- SHA512 87a9cc84ccd1d9a14cd0210ed6942d3d4b737205670ea97c5869280b0893a0531b7e22f2349997b5b24eb18697230e255cbb49edeab30bdfe68e2160895b62a3
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413po:A3kM/56ri
- TLSH T1BF058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 846KB
- SHA256 f898bb34f99e0ecea299eb1609bd0915cbe68eb44555531ed62fd5a5e26bd086
- MD5 8ab241ff3c042495742c2ec3a6230dcc
- SHA1 7fdf281d8ccf74eb85dd078d999445d36bbd4e6d
- SHA512 879fbc1d8e7377a17f508ad066f6e52cd2abc46d2b2b41b790e2b79571d6861943eed5ce992ccd30e3786c8396866e247035f46499ee120eae48f0f8e2489a99
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413a+:A3kM/56rH
- TLSH T172058C03A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 846KB
- SHA256 35eb5bc598d1ff8d4b50af231cf126645e9e5da5ae152c221b0a2c96804cdd69
- MD5 04762746be3e7e3c46a35cea9628b5cc
- SHA1 a3c268b3da1ee115b0ed8d941bb7cf7c37d05383
- SHA512 10ab5b4e8c930922d8b0b82212defa0782985eaaad7f6b0524f22c798ac2af77a2e458513a2fd7b40b4a54a8f67770d135b8b4320be2c98da5b9b651f0f97acb
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413aQ:A3kM/56rz
- TLSH T15F058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 846KB
- SHA256 6e080d3abc86b0e69fab3bee363825d6d55d2c98f812f9ce89118bd9613c68f4
- MD5 2b02f7daee9d956292c85b020e0c30b3
- SHA1 0e250719e4f748a075761596baf3dc4c3e3b6a7a
- SHA512 bdb99104008053099edfb08d74621139c7afd824902e953f84ef85a69c2e9ffc12acc1a519412953815ec7bf9012802b2099cc2505b107cef478352ef46a58ab
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413rX:A3kM/56rn
- TLSH T16B058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 846KB
- SHA256 c8825493b83a20822630f08badb61b4a9960e414a921472b8ab523c2c9b3386b
- MD5 3666b385de26535c428860690ddb4676
- SHA1 13f671016ac0d0e3fff154161b77fc7d14eeeb0d
- SHA512 6b398c7eba23d63ab2d82a846af7d5fe16040f59a7eef1e5265e5c87ab2794d40f4dd3f1c9489dda64c19b04764e488985b8247b514a68486da38af79bdc4638
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai4135L:A3kM/56rJ
- TLSH T180058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 846KB
- SHA256 a6a09858a1925cd3d7543822e54d949ef478010df6ae8f50ce0114b356045ef8
- MD5 d079c61dcc9b61e2094220e2b6459408
- SHA1 7d9cca703ebe462ef4c9b500e37691504daea436
- SHA512 faeee5fc29167bf1390f9bb832bc165811fafccbd95c76787b9fae06faa5361009a60dcf69a5ae1fd0580748dfbfcb04f6e4e7326c112afacf34cccf6762d55a
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413nM:A3kM/56rw
- TLSH T1A3058C07A6940FE5D11F813499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 846KB
- SHA256 95223ac16fbf7e5bacb0d82479de4dce527bf202ab7c388b2c40bea163c4abef
- MD5 4e5022bc6d8da8dcf50c6acc4959d11d
- SHA1 994da50aec23b27f0abb7e697483d9120f886a7d
- SHA512 9a237a44b30d3ca3d8b4166f70f05d27d78553c8225a3d65d93d76f09a8cb6742b7a84dd404c30493984051d4283be6d8c80c5a3c19c0ae70fd7fdbcabe03bb0
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRai413Qh:A3kM/56ri
- TLSH T163058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH