Analysis
- max time kernel
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 10:38
Behavioral task
behavioral1
Sample
2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 847KB
- Sample260804-mpp1hahf82
- SHA256 cf8e37495e73502430a64d9fbea0db4f9401458667a86f061da5663460ebb1c3
- MD5 9af7fb026e1a9071439febf4361bb091
- SHA1 2dfee9631f58657c448b652567ac9d3fbfa8f993
- SHA512 d478da81007ab902c7115dd720b496170971dc1b8ff75f2403b65d83c597453eb6d300fa2cf2246790ac8c71f2a04a984b9bd8ac2aa9e6852d0646544b85de24
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvz:A3kMoZ
- TLSH T16405AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236882152F327C0BF3E7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/4220-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4220-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4228-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bacf-219.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000019871-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-514.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-643.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-806.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-939.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-958.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-989.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1058.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1122.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1217.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f0000000188d8-1558.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066ad-1868.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c48a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x000200000001bacf-219.dat aspack_v212_v242 behavioral2/files/0x0005000000019871-262.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-323.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-445.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-495.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-514.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-599.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-624.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-643.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-728.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-747.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-790.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-797.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-806.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-854.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-874.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-893.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-900.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-913.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-926.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-939.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-958.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-989.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1014.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1058.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1084.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1097.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1122.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1147.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1192.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1217.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1289.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-1333.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1353.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1372.dat aspack_v212_v242 behavioral2/files/0x001f0000000188d8-1558.dat aspack_v212_v242 behavioral2/files/0x00020000000066ad-1868.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4228 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4220 2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4228 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9af7fb026e1a9071439febf4361bb091_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4220
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 847KB
- SHA256 cf8e37495e73502430a64d9fbea0db4f9401458667a86f061da5663460ebb1c3
- MD5 9af7fb026e1a9071439febf4361bb091
- SHA1 2dfee9631f58657c448b652567ac9d3fbfa8f993
- SHA512 d478da81007ab902c7115dd720b496170971dc1b8ff75f2403b65d83c597453eb6d300fa2cf2246790ac8c71f2a04a984b9bd8ac2aa9e6852d0646544b85de24
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvz:A3kMoZ
- TLSH T16405AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236882152F327C0BF3E7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.1MB
- SHA256 3b59872a55f3cb79902565c62e79a0b02f57c5d554c11a58b24f1d9f61377783
- MD5 bb6867d63e60b2594869f84c98c1e3b6
- SHA1 945e49c990b44a2e0339bea86bca08a891b39956
- SHA512 fc85c7cc737f75926f4d3755a9da0a0d6d02f01645fe3573b31fb764158add79c231544b28bea963ee7359577aab9e6c31ff5e04e2f5f9e94b07ed16c1f5a0e6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv9TWaLl3z0zDD:A3kMoPT1Llje
- TLSH T1BD35BF13E7A004F5E95B8234D9E54A12EBB1BC561B60C6DF236892151F337C0AF3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 946KB
- SHA256 d586e3e7cc5e7a4489a9b4ba8cfb0f1313a62abd7217e45883806ad3cf28fb79
- MD5 30d5af6ba8803f1e03bac538c9880b1b
- SHA1 56ebef148b8484f95b9ac39298af9dea3dc9554f
- SHA512 ee94ca1195bb13a42977539e0d67fc3435fca9a939b7b15bdcac661a514e018c391f3cf8fadfb4dab6d961dfbe81693809ad5df6e7eaa7b12a648de145e97585
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvL2MqDBxc:A3kMoIMqlxc
- TLSH T19F25BF03EBE004F5E6564630A9E55A22EF75BD521B60C6DF236882151F327C0EF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 0003e37ce505ec12a53a606774a685d636784682a17cffed8a988201b67a442d
- MD5 0870e64ea4388a6d6b0a4bcd1284d7a4
- SHA1 88bf8c1bb2010844280e441d2510eb5f5c8d062c
- SHA512 f50bd164557c8b311467eb61bfe6e670f54ff355e140dc9b48ddd0cd0dc08db44dd92a5feaba6611bd217dad5f4eaf0354a8b9305420da815fd3b96ba7e875eb
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvA0Le5ji0hmxNrM:A3kMoSPji0Aj
- TLSH T16E657C17F6B442B5E077C175C9E2965AEA7138821B30CACF1359C7282F23BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 862KB
- SHA256 101e4dd55ee6e55298e6ee0970f148f1aef07a252b34b103b5691e42b142fdb6
- MD5 356fe9a43bd8274c915845ceeb8583cc
- SHA1 b0862cde52f5a91dd5c08e94d27a93216456d301
- SHA512 05bf11b4e8564328a44d68fac78018e2dc5465b9494ef77f9a52a51fd45668e9842d69ac207af942975fe374abdff3042c1b140f23c22b38c1428f0d58b0b587
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv6a:A3kMo
- TLSH T13115AF03DBA004F5E65A8630A9E54613EB75BD565B60C7DF236882152F327C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 895KB
- SHA256 e0019db576126fb89da75a7dc68378d624e19a8c78b5557c41ee5603aca3d035
- MD5 b2f3fd15580999c4255c64dac6d06005
- SHA1 02136d6038347c8bd08f230b71dda72348f865ca
- SHA512 9ba166a21659b511444f3016d61aa56601bf5a6f2fe253fa2f7e083e77250d39ea035e6844f97238fe22ec078b9843e5bd95dc450dd993291cbd85993b29df70
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvpb:A3kMo3b
- TLSH T19015BF03DBA404F5E65A4630A9E54613EB75BD532B60C6DF2368C2152F327C0AF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 871KB
- SHA256 6250ef65babb3adf165047ed6a0250c856892d4bfe44bbeb24069449a5146206
- MD5 50e5e8766a0e93f8664be5f590044d29
- SHA1 f18bcec755f1e6da8c86dd87691563593fffbc18
- SHA512 841a9e73e55e68512a090107468324028cee787fb0f1aebca1c38c126d476feb6a5c270bdb0379e2c84df91eac27d85d7f5dbce2385dc604c3cf1d2013a2e49b
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvL6:A3kMo8
- TLSH T17115AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF2368C2152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 871KB
- SHA256 e49b5fe9db9586f606a57daffe6e4d527a34c025ad5b8973a251649dac8448a3
- MD5 fbbc9906391fa635e8d6cdc509a63808
- SHA1 214ae6db85ac1197b90ec8a087669ff27a1b6ba2
- SHA512 dcbdce101b6f0147f4087e89f45ed40b52d83748e2176e6055d8bf0cc98a31d30a5fcde2fd1c993a7d25e6a8a89acfe4a48f91f51d73b9df20cbb50fcb2e05c4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvVN:A3kMoh
- TLSH T10E15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 871KB
- SHA256 fecb99a20c37f7e61418aefc3c0f2cc2f1c530fd03a99534a6100b39a17efe26
- MD5 e80db96cb2da33689c87781afb9ca8ed
- SHA1 1ae49e8978020ded9d13c24cdc75ff16f195df08
- SHA512 7884468f8835ca0f27a001834160af8d6151dcfedb83568fb21d9ffcf12e436d1c6976cdbdef939aee06205f2c98d375e76fc319fd2fdb51b86d744628d4035d
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvTf:A3kMoB
- TLSH T15A15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 871KB
- SHA256 1d02e79af54b37454c1635a0aaace3292e49fe2583475d446333b903c507f956
- MD5 8aeef7235970ce34e1e6022350a7fe56
- SHA1 4dc4362ff52f2cd3c7960dd4040cb51d32ee8dbd
- SHA512 421e0132420034d3c1f31f8cdc8249e1d6871d20d77c2ec54a235fba8c6a19a22bc556a600adf08cf75b892f0a4f49bf6b05ce63e3064571f6ec71ceb421e8ef
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvlo:A3kMoU
- TLSH T1D715AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 871KB
- SHA256 66e9a8c04962e4201260546fed96dec5e09cefb04001d12be81b66bb48f924d7
- MD5 ca70074886203597b151162c90f965ad
- SHA1 f3a8787990d6c2e0dabe58a36e9aa6459ba09aca
- SHA512 ec1e218f751e7332c406dc50c097d7d086394c60e102523c24bcbdacd21422bcddac885ddd3dc6c2ac2b6878a9dc2aab0bbf4f98879182671f5181985dbba1a5
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvlu:A3kMom
- TLSH T1E915AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 871KB
- SHA256 cb9768dd4f86c7e817d73c5e33cdf0613b7f1c404c419a18d2d1f7046ba90d10
- MD5 d6d7a2f26b9ffc6f73cb6e1e9fc9d624
- SHA1 9959bce44fc8cde0cbfd6853f2306f4d3fcbd69c
- SHA512 acb2b2805d8755692a38ef0ca0e1418395b0e50be6f8a73ca5a92bc7655c5fbfe13386dbd2c72c0bee699aff58ca20d5f1e2af109c639d11aa32da1a3887a6c6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvb9:A3kMon
- TLSH T16D15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 871KB
- SHA256 cf8417751d6dd2bae8010201f4b2b3da268556e345708d2862c8a16170bf1dbd
- MD5 207f728c581f7eda3ab410b7267efd29
- SHA1 72536dc9fa83c6657699de8f4bd6f8e142924bce
- SHA512 1e77a7b0a6e81f23700a915fc562f31cbff026492185b0541e702e6c8489519d8ac38005ad8e7125dd61226fa1cf3320a7171a003545ef1b2aee53c0441ed2ad
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvnc:A3kMo2
- TLSH T13815AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 871KB
- SHA256 6a370e2243cc11ea46fe5358d891cc2cf2653de202e292376bcfc0a4be50881a
- MD5 b35b6253424898a3e988e122296ccde0
- SHA1 158b380307ef0d2979bef8a1061941103d2cf70d
- SHA512 cd5de38a2bdae3d54326cd78fb33fc4cae59ac16943ea2318d99c787b5d75f3702dab8c0e04b3c5aa3f73f0ebbf305a595ddb4732405b65aeedb9d1d6f960a3c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvwp:A3kMok
- TLSH T13D15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 871KB
- SHA256 6c8fcc47a2dfb169696d1beb2508d29d94a2e74424ff979c05da67e9d66c2bf8
- MD5 c9396ae201165c029f9fa9b5b2a5e2f7
- SHA1 ee2d25c5ef48e00d4199fecdd526fe3733bcd8c3
- SHA512 292819921f76e4e82328a275611434abdebf91a8b3d50292cb4267b90bd91522aa3c55caa90d9152c4815f5aaf2a81645ce376dd8d9fe6fa58eb94523efce195
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv3N:A3kMoT
- TLSH T15A15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 871KB
- SHA256 60d45682b8736e8a14c9a47c3b69a0e109b7714b334b35bc791af369801c5f7d
- MD5 fc982cae20cfec1bb17ec1b05d97d242
- SHA1 b65a9d97456bb2b6dd690a8f2f6a798cf912b263
- SHA512 e45036dd85587ea8e84fc1db267e0cc7c948b5bdba2ab71d2f43f8f18804ff3a6cff38f648a5f1f20ddf71df9daef52556725d098fa366d60f368ff6fd76317d
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvVF:A3kMol
- TLSH T1D615AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 871KB
- SHA256 c50c8df778e004990ed8601aff7f23c7d1eaaf5d8e5a7540bb671761ef366cb4
- MD5 36ca23845641c03f0d9808d7bf4644e6
- SHA1 1756bd33e7544bb7f2ccc269317410256a53a679
- SHA512 a34f031e954f0e27045396c91175b20a4d6ba0af7689b4b14ce422cd3e39bd82f78c9fa64827d73b8a09f0feca81de1ea96c6c68c7565f1fe8a63cfdfa4caf3e
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv2C:A3kMoJ
- TLSH T14415AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF2368C2152F327C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 871KB
- SHA256 7238aa99e98623204817f2fd317e1f853e37fb14cbb06598265b33c8d02bae79
- MD5 3dadd897214cdcec080c094156dd48d1
- SHA1 668e7dadd647e91611cda5b0b3e3dd982df609ba
- SHA512 abac2bf25fab060b6124820c4060c2c341da506a1381827459c4630d1c21bb2640bdfa00ebae715fec1a7b661ee031ed1a4bedb4786cd894967e72c5ee28e840
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvZw:A3kMo0
- TLSH T1EB15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 871KB
- SHA256 866cc1366d78e75aa3bb22f0bfc588e3afae9f88ea69a09a0a5d66d6af13b0af
- MD5 23c2d6c2a41595287ba40cda61dfd045
- SHA1 e0c057b7337a7eb7ede02ebe1d6e35256b14bfb1
- SHA512 d0328fb8334ec38fe92ff2124950e6f19d2f89685e978c046bc9ab742421a602e8754db5dd186cba30f0fa25aef5b9206e9e0ccb145efd8c069c184a7b6f18ba
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvgT:A3kMoc
- TLSH T11615AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 871KB
- SHA256 285c3ee3d8c41db9aaa6d54a4667773acd2426032d99d3619673d33f454bacc2
- MD5 cf21da0e6f24a97230dcc5bf86b3ff89
- SHA1 f8947fe444d3bc083710e4dad50a794df72b3c13
- SHA512 e8dc58c3bbaadb42ed0a4686c1dc02bdf65c0620e0caede6454b7aba6edcd54e4f324afc0725d8462a54917ba052547e1537ed8b55d831202e33430c25291f24
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvMu:A3kMo7
- TLSH T14615AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 871KB
- SHA256 6e964736e4ff8c2bcb3fb2ce683e2e1588c5d96824be55d40ef781743c04e7bd
- MD5 e9e1db4d07abda8e6ac57f1e9ecf122d
- SHA1 b21efeb0befca1c6721e09ce96e07e65434b5a78
- SHA512 a8ccc53f74c405aae59392bca188f83692270d8c1ee0cedc5cef4c1f4386a7fcf91fe528c69bf9f5ff92eed6497a51f8bbc3f6d9ec89aa83d8b373f84ce6bad4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvqb:A3kMoS
- TLSH T1F715AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 871KB
- SHA256 4441952009bef96ed29313fca3577d0c0f569c725be8545fa6ab341c7b29a386
- MD5 29fcd1edc7dd4b9fb8b126b9f88fd691
- SHA1 d07a438c450e195b43f36e5f04e7fab68b9b6789
- SHA512 82fa9b691f08817abd27f7057a5763ad91c2d0b4240dad52a0496209cc019dacbf4f71ff5d4a913804e7ee9e778e5435f4738f44ec34cfe43d847cb0ccd05a6d
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvsf:A3kMoy
- TLSH T1F715AF03DBA004F5E61A8630A9E54613EB75BD575B60C6DF236882152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 871KB
- SHA256 a58beac78ade785f7ecef66314f2dd5b34a9537d166ec03996d6bd3b85e2061b
- MD5 b454dd5b2fa6d43b50821bbb4ae0659f
- SHA1 afb95a45b17b7e3a0ed00dc25f91b4f8405f63f1
- SHA512 629b7733ab6d97fc619e493fae81df73920bb5053449f5138ff262ce0d923827210803bc30a38b6787b473856c2a272baa86e62e364efe8e830930e3f3489a61
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvpK:A3kMoS
- TLSH T1CA15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 871KB
- SHA256 d0ea2bd713c4d8b699c5f39830307fb3434c7f6d81e7602a35fa15a2b3d34723
- MD5 e8a9a0eed2cb826d8965454923fd43a1
- SHA1 8ab38d2d9c0bd6be0bd9bb1d8801a7da02e8761e
- SHA512 ffb2cdab9d767c1680bdf87da8f9e4a6f70777848a2ff87c97d5a1a51040eec1d691ddb6a3c70912a57433b3c961fbf89fe9e35120740731ed39b850d8bd3a28
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvSk:A3kMon
- TLSH T1E015AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 871KB
- SHA256 5dcb0111c0edeafbfb59b401bae5bc0309f79f217e03b84c02bd26f5a61144e6
- MD5 28d4b2e88040925ad075dce61e025ab7
- SHA1 fb1d4817ca3256d5b9d6c1e6e13df4df942b5be7
- SHA512 2dfde9fcb9b104aa1b5d69f6d2d7afc6c3b8aceb965ac2cd54dfd4239b46646cd34dec6d240d6f0b3475a4f39871e64fa8bf97ae583c495713f13d3ecb45bede
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvH0:A3kMom
- TLSH T17515AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236882152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 871KB
- SHA256 f37d23423a37d49fd68741a58ec3a2adbc2ffecb43d39042477fd466e2bc451b
- MD5 b570eff872fb0f9d26fa046c5138d20d
- SHA1 a602962ee6c9b0adc7bcd907168d24b05dc8d222
- SHA512 62e19e09bc26a7ff04d313e28beb11cb1887e11d75f2f47b4b0193e98f2fec41e7eb7436557c4e52b6f7ed14313d9de0d5b53af1a1d5a210095e0d1b374a19b1
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv2g:A3kMof
- TLSH T16615AF03DBA004F5E61A8630A9E54613EB75BD575B60C6DF236882152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 871KB
- SHA256 ee622f705271940242f154da2537f39d34677b8bc4d0c1b5eac57613543d1c73
- MD5 ff78c7e9efdc9042758582a52ef1db58
- SHA1 5d0a01f81efc65fe17ccc2bc4413667a07512fa1
- SHA512 e3bb81f025c9d339119b4470b942a8b3db5e65c51e9e795fb15e184d4f6f3dd878dc77f68bd832c36acabd7768970732192e09bf80914f98226bcf2589dec16a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv/r:A3kMo5
- TLSH T1E615AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 871KB
- SHA256 3931579c503f396dec9cc7f547bd454dd7751351f943cac9ad27306b4dbd4e56
- MD5 3d5df656e6045d431bf598a821f41a8d
- SHA1 6451fa766d627db94fcc4c7b65874a6d41493f9d
- SHA512 da9fc73f1d8745299cf689d1c1fe0aa4ce1c1f1493d1b46ad98c13bfde32a73f2fe19cbc6770fc1c97ba5bed574c41b3bbbb8bbcec698287112a409c44e14063
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvJn:A3kMoz
- TLSH T11C15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 871KB
- SHA256 c62eb4ef53e05451e67218e12645a5930f9564a130098b4b2fdbab179f8a4a26
- MD5 2aad2241d087006b7a63939c8bcfd1b6
- SHA1 e0a00ebcd1d531c29a3e39aa751974926e457429
- SHA512 24063a2318af5231a9ea5bf6c240c3946006a273c9e61d4b8a5859ccb29ce8d6499f4753578decdd1537c3c2ee562a07c4987e2a7e15d80c1cee12864b87fa44
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvFx:A3kMox
- TLSH T1DE15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 871KB
- SHA256 c896ce312c3eef84bc01df02374a37eae10a1b3423979c5830ae4d34e5998f93
- MD5 dfdccf3b724bcf4428f3ac50f168f27c
- SHA1 76e6cdb720ae917fb3e77d7ede2db659f9ef8801
- SHA512 e2327a43e7acd06e7056bff1dc06b680695a59f49c1d2e89eebadbf010999936ef3f90efb1f691a57d2a7a8e2c42d54ec2d549f84308e283dec4808b2febbfeb
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv7A:A3kMoe
- TLSH T10915AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 871KB
- SHA256 dee9181464e73709b813c374bd37a9c190cedcff252b336f71309f210f4379bb
- MD5 31600e452e4d6ca8828b44845959023b
- SHA1 669766382885ed9aadadf06291ec021761cd2cf9
- SHA512 5d18b23a38f8e89b156bc59195adbe9874edf454c6a65f395eebc93fa2e348c8f55bddbeba367db6b5fc386f4c6d3448a23f5060a953e08119d034cee9fdeb27
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvs9Q:A3kMoD
- TLSH T12A15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 871KB
- SHA256 a058d658e3276a1cd6c1d8b4a7a692a7b9c2caa5594f63cdc78b909c61a1a812
- MD5 8fb0272ba656605fa6fc7c3b42d4adc7
- SHA1 d8793254b4fbd628b7f4fec3017db200ceb11301
- SHA512 967af9fb2c1d6e0f5548bc45389b48c028007d9338d680c1cfb6d7a48e48d92e61a00c39818eda285ee8d7cafa44a787be13b405b16dfeae6f69468979b6fb6a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv14:A3kMok
- TLSH T15315AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF232C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 871KB
- SHA256 e8678498695000c426d57f2496365a61dc85fd9c1f018e6bf6de1002c579aaec
- MD5 a6b305a9612ed0069bf1cfab1d1c9d01
- SHA1 188252a3e2ce4a2d38a01c108b010d7342b6c4aa
- SHA512 4e55c68287ce1758ebeb67854e1ca06b36848ddb47165a309171439c88b225369afaf410ca64c72800729e2202058f059e2ffc12e63c85fe408b6e2b7948c856
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvgu:A3kMoV
- TLSH T11D15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 871KB
- SHA256 d9bd21c1d7cb0d91fdc05934d233dc5b9f05075cfe494e0204aa73fc905bc4e0
- MD5 d236f1986f6682ded2a9abc04953b04c
- SHA1 4023665f281955298a785424b9d9283ff11b9332
- SHA512 72eb2e58288f195253f1665df7ef1026663ee5baf58120c759ddfe7e7a9820a1e5d78f1be9772f9203978aca307136064e85732208e35ea708283326305ff8b5
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvBj:A3kMo3
- TLSH T1CF15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 871KB
- SHA256 11721dc1b3390ffbb554669bec18f9dce17ceca2dc4e3d2fddb72d8961c84d96
- MD5 031a7624ae05341a4380c1f08bbc04e7
- SHA1 6f216a371836bfd9ecb35feebfe99cf55e9ffb4a
- SHA512 961809ca3f5427c34197857fbece406cc6b13592739abb99b97e6bde12588b7bef186fb0086699d5f02842b9df1d90ae441c3fd1daadc66655ec7fe7f48e3ab8
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvIg:A3kMof
- TLSH T1F415AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 871KB
- SHA256 cc87d33ef66f74dd6967d13271ae575238ccb723cad6210eff156581269ec5e3
- MD5 38c48754e06febcdbddad07f483bdb23
- SHA1 382d3efe0e31921d5788c2d87c8acb730d7f6e58
- SHA512 6687b4a1737e2931b02585994f9f823465f8185492bf76cb3a7f812ad290e109d40fcda72739e9a22ccfe83be3bcb0a49aa21193406ea0683c13605734e94680
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvHI:A3kMoO
- TLSH T14515AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 871KB
- SHA256 d74c7b344f3edc1d991fc30e405c53bf13c99a927a6266ba3ab417a43b3ddb88
- MD5 38a689477317b8e2841c3823a3d70474
- SHA1 81f28679004744b22df058cdc3cd258334630918
- SHA512 ef617c37190d0f7d143ab8557106649d61225147f9d807529ac1ec4f456c8b2a8853b5c8923e6ccc2b7b74ff30377c5d8adceda093fdaf1103389ca3ba0582e7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvNo:A3kMoM
- TLSH T1AD15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 871KB
- SHA256 c0793c44b9533821f56d05af2b35262f619ea69116591cce3929fe58e81d09f5
- MD5 377bd98def8afa6e1985e7da8342b605
- SHA1 9b8313c3e68c48585708f31c5d65a5d5c0770053
- SHA512 a85d949d6ed325cc026c10f49ea05db0c16ad016882715c2613a8a83ed9a5a03c9bd05669446641297728a4a6d5da3bc1e3cec1b8605b6cde762cb1cd8e66e8f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv++:A3kMoh
- TLSH T1FD15AF03DBA004F5E61A8630A9E54613EB75BD575B60C6DF236882152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 871KB
- SHA256 5428194b984c04a493f605fad2b20ef054ffd0ecf52597d3718b2d1a674577dd
- MD5 5890e2a69b0f99e7843c2fe029443c1a
- SHA1 67b1636f3867086f9c2ccea986122efa2ca12dd3
- SHA512 7ea799772919cd1fc0d827a2a01bcd113a4c9398504c1122cbdeb485e614ae4fbf34b2946c9aaae9e34288e8ce090b2a64a6d5de656fbdaf102fb7effc2aec1c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv+Q:A3kMoh
- TLSH T10D15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 871KB
- SHA256 e2a62b055ba990af122c746c6e380ae1cf886769b8ff41e30702b08f0434d258
- MD5 c1a709148007847a538305e7af6354ca
- SHA1 8e7d8eadc7bcf5221b9a06c3c6ccfd52543eca72
- SHA512 347a5b165789fd95c07345179327a6ada1d4227b566fbb421b3190c8255eb611b5e0c970ad75f8d1a4ed54b891a0bd4469d24c64b59a4990c90270dbb487f960
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvfX:A3kMoN
- TLSH T15415AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 871KB
- SHA256 3f7f32ea5cc8039b935d141ad609549d6d118d94288522346f63263d31ec0996
- MD5 36797b024b51766c960b4bb0b31d57fd
- SHA1 bb657a8292a689b18ac6375de18b75613b34bbd2
- SHA512 88bb25fdb8a92d688ed4cc3cd94284ae1a17771fc19ee88e1e45e9aa4a205a41dcf6086caf513209c416460a0683c5370a9abd5fecd504a593a99f486898e2ab
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv1L:A3kMoP
- TLSH T1EB15AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 871KB
- SHA256 f74250866f59d0ca59e3b04318763ddd25e37991d214443e4f068f54e3487258
- MD5 1ef8c4c8bc262f1931c8eeeccbc96cd4
- SHA1 b0d351727a115d1d439dbd911556d57ab8a2f829
- SHA512 c05c1258a27fb25cd910030d15cd21242fa2b0a918525d248eeb219265f9cb860a90eece870935581504c2abb81d279de6dc7133ead45f0995092fbc02353894
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJvTM:A3kMo6
- TLSH T1E915AF03DBA004F5E61A8630A9E54613EB75BD565B60C6DF236C82152F327C0BF3A7B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 871KB
- SHA256 4a192f3c1799edc6cfcdaea07aac8f23838a0aafd997afa2510c3c7863c62268
- MD5 b0273ba64726fe1f7ec4fd6fbcc8faf6
- SHA1 a3b38b83f9afc123975d1123b296eec48c4c8731
- SHA512 5081c5b5640ed46cfbf3367d4d3b5b4d38fbba5bef287ffd827e846e4139d63a61886213da63bf5a3e3e535d7d7f2e644e12b49eec7ce23f318c0294f3b08309
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaBQDZagCHIJv0h:A3kMo0
- TLSH T1E615AF03DBA004F5E61A8630A9E54613EB75BD575B60C6DF236882152F727C0BF3A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH