Analysis
- max time kernel
125s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:09
Behavioral task
behavioral1
Sample
2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 951KB
- Sample260810-wrhtmszvb1
- SHA256 01bdd8f0c910f1a97b14fa28e0e728ae2bc0855f735234409bbfbf368ad63014
- MD5 dc4bafdcca8772255a2bbe3d83b4e215
- SHA1 8e6c42735735e08be2a53a089fc8772b24cdba96
- SHA512 1cc8a846f533939769adac22a30145ece98356a697abd9b29a1be4556c1f3be6049d833914bd4d3dbe7b2bd7ee156fd1c0ea9a06830c3d1ec0c949d9a6af497f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp5bL0kb:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDb
- TLSH T14A25AE17E7A004F9E8178134D9A54A12E7B1BC661770C6DF236892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/5704-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c46a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c46b-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5704-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2672-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-300.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-515.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c46f-606.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198f1-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-710.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-768.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-830.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-861.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1058.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1095.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1120.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1351.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1384.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c46a-5.dat aspack_v212_v242 behavioral2/files/0x000e00000001c46b-13.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-244.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-300.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-447.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-515.dat aspack_v212_v242 behavioral2/files/0x000d00000001c46f-606.dat aspack_v212_v242 behavioral2/files/0x00040000000198f1-631.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-710.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-743.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-768.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-830.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-861.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-893.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-900.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-921.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-940.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-959.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1008.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1051.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1058.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1095.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1120.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1146.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1178.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1185.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1192.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1229.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1332.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1351.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1376.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1384.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2672 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5704 2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2672 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_dc4bafdcca8772255a2bbe3d83b4e215_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5704
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 951KB
- SHA256 01bdd8f0c910f1a97b14fa28e0e728ae2bc0855f735234409bbfbf368ad63014
- MD5 dc4bafdcca8772255a2bbe3d83b4e215
- SHA1 8e6c42735735e08be2a53a089fc8772b24cdba96
- SHA512 1cc8a846f533939769adac22a30145ece98356a697abd9b29a1be4556c1f3be6049d833914bd4d3dbe7b2bd7ee156fd1c0ea9a06830c3d1ec0c949d9a6af497f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp5bL0kb:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDb
- TLSH T14A25AE17E7A004F9E8178134D9A54A12E7B1BC661770C6DF236892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.5MB
- SHA256 12454b977fd609bb1612ae7fdecf13c58ff965298965e75ecdfaee47658d80fe
- MD5 15c8161e11c025a08b655592c865d5c0
- SHA1 ec778bab7eeeae6891b6ef50b85b4847134d10ec
- SHA512 bacd8fbe2c74c137d2a22e49e1d250115d81619667ef9805cd5c8630f0034fa8dbba60f1f6fc6e4fbde604195c322041e6e6f650884ae3be6fdd34a0263ad4f7
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDH0Le5ji0hmxNrM:A3kMhT1LljCPji0Aj
- TLSH T1A2658D16F6B406B5D073C179C9E2965AEA7138461B30CACF139887292F337E19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 965KB
- SHA256 733e4533c5c61ecd4bbd0055ac91ed63331551e0184395e6402905d42337a819
- MD5 bc9fb9a898a44173a780bc7e957ec1de
- SHA1 bc2a1fee5d075e0cf5d3f983b1bf73e149a86e4d
- SHA512 3f2eae994c90bc3123a5f279442719d78898ff2038f7dd5d471a074baf9468b5cf4551e8ac0b544811d32b1a64f3da91b8e541def2d81d3754a03482df5b3504
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDZa:A3kMhT1Llj
- TLSH T13925AE13E7A004F9E9178134D9A64A12EBB1BC661770C7DF136892262F337D06E3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 974KB
- SHA256 d271f37553bd922ea4e002828e979b43da2f24169fce62a9ff97fcbf784a70f8
- MD5 adcf09e6438895e29209f60551c2ff5a
- SHA1 fb920a437a1db7c1eabce1cee84327659f1bbbae
- SHA512 1735493950e5227ab07f3da4dd1ff17589ded188c9edc3b273a125208515be7e3309ccab6d4e6dd21f1b4f6f06260121c3b1ef4e7e6cc1028780de5f2359d26a
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLD0o:A3kMhT1Lljk
- TLSH T17C25AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 974KB
- SHA256 a92f925126b39189c3541feacc535db9595b8961dc3e07937896bc7982c05058
- MD5 57951d3d14dc358e706db13d14b0880d
- SHA1 b2198b0cef60d3add5e988feba19d1eedec9b0a2
- SHA512 78c95bf31e84194bb37b23c6fcd1e75c2e3b61b798a1cd33b459a46c736838838d8bd8310e3e517731f4897eb75c0b7f2096418d18464d0fe8a20c7a63afa40b
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDUu:A3kMhT1LljW
- TLSH T15A25AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 974KB
- SHA256 06730a30850ed875a4a59206cfed151ac507e2514cd9360d30592e1053c6a825
- MD5 5299aca46e8477537dc2632ec5ab9433
- SHA1 525cb01de19b232f03b6f8461c947cb0c67fb587
- SHA512 8bac79864fc914fdb71b39775bfceb8abcb3399172b6da4b611b1639865453d42e1b93fea2d0099b792c616d00cf79fb2971a813df9e8d46a308ba122ae818ae
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLD49:A3kMhT1Llj3
- TLSH T1D625AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 974KB
- SHA256 d7f633ad5edcbdc432f2fb3d2216e756835a237a6323c3883dc3d67a37eb914d
- MD5 b6adf78ee9d1bc133d90afabd0a0f2e7
- SHA1 fd923047c378f1aac0d75f3b850e31451f4afee2
- SHA512 b1d3dd7fbcf3cbb2555be7c6bd408eac9aed3e265654ce11a1948bd82f0c4b9e4186de7355852dd00ca114ca26647b34f59aee5023568f1efba1a046e71e78d9
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDgc:A3kMhT1LljG
- TLSH T13025AE13E7A004F5E817813499A54A12EBB1BC661770C7DF236892262F737D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 974KB
- SHA256 9692e725aa08ca91e55ce28fd0b8e57ce8d48f4b924e7ef81054df03eef2ac24
- MD5 5ec7d6c069ffda32bf6c02fbf5df015b
- SHA1 f08c72b9a5111afc0d54d97387d15896535b2f39
- SHA512 a88603b5f5fa1257f835502bb0f4158654a0cdd3c0ebb411e6209d82cf27ea3ff9757cf0b85e5cdbb640d8b0f5f4cff1cb00e5452ab4a916adeaeef5139c4814
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDJp:A3kMhT1LljU
- TLSH T16225AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 974KB
- SHA256 b14ebbf5d07be7abefea1d70970762eab6dd5f8521564d2824e007654363f7a3
- MD5 e9bdd105a99f88a4c503e4308766f22b
- SHA1 4150cf85fe0e85da8b8f1df868e659b69d88d4a9
- SHA512 c71720f7b1b24b13097eb0f249330f2dfbf6358fb46900ee164885bd4cc9eb62a55ca73d0f9f07f48b746c5a8c761015977ee7fe5baeb353992cf0b6a6b1cd8e
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDON:A3kMhT1Lljj
- TLSH T16925AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 974KB
- SHA256 c2f950b63a866be52edcf51ef9178cfcdd9ad8664dd22c30d81f519ac8ba3367
- MD5 b8ad7dd8a94a01050b3bd76c3929484c
- SHA1 01a3d0b5f27427aed75870925012dace72d83ba4
- SHA512 52c55b80744615190879bc95a68b4e085f802495cafa6f2cd20ad95f649b7bee12c96be77a56ecf6f2949b28cfa7623490a3aaf1fcf918967847cd579285e7b0
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDyF:A3kMhT1Llj1
- TLSH T11A25AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 974KB
- SHA256 647dda48412e988979866f670e6666d8d4437319688e457e74a0c9ed4b15e71e
- MD5 68dbed35a2809b2bcd3dec1750c7abc9
- SHA1 8515a553c1f73f6156f991d2655712cf3a9956f0
- SHA512 be07bd9b933f11d8523cbf53d75efe344ab0639fe43cfd4db8a1c65b821accc4a2c805a2899fb0177a26e2a412846bbb080744317459aaa2878d3eeff1cd23f7
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLD3C:A3kMhT1LljZ
- TLSH T10625AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 974KB
- SHA256 c2876ff0ec30311ddc3fc8577cbc6b854e8b2ce34076b7588fd84ee4e2364b94
- MD5 ee802bcad9915f5d6a0e896e888c9718
- SHA1 740f10caade5d58b1c56acb5e831dc027a466662
- SHA512 8425bcede81f5cddb090e896e0e8ea23e114e39b53da013d78c4743da9e083264c4ac17ee26af403fe404c1bded5e16a209d83d14ae2676a3314f1a9a5a7766d
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLD4w:A3kMhT1LljE
- TLSH T12125AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 974KB
- SHA256 8a5188cae106618afbc71567b7718ca424aaa2ba75ab51ba1a83382eefaccbaf
- MD5 7dbb8f1fe1065a97000d6443a160e01f
- SHA1 ce5a63a018683ca50c2a1549d5ea3ed37cdfe2a7
- SHA512 5c27e6caa1efcb14bbe82416704e918a148a8cba7cda1d34ed48bc2e83795fcdba8089ee0d466da1dde89ede506c3032bb886c2ccdda4c56a8aa4191a35911b2
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDXT:A3kMhT1Lljs
- TLSH T1F725AE17E7A004F5E8168134D9A54A12EBB1BC661770C7DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 974KB
- SHA256 dbc51a542648df686fe7c286ef78bd08643a482e8f55314c78b6835d7cb1aca6
- MD5 cb2f3a319ca3b4aff05042512791b5b4
- SHA1 f3d6bb67f222867ee61a3d4a350ba89f96295e7b
- SHA512 fb3d753ddeeff5db37d4db73b635dd0edda6843ded56ef7792f29b4710b7af7b95d0d72ab69c8c954e68ec989567707bd7141984c4234bdf9d81dd1e0e8bf183
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDhu:A3kMhT1LljL
- TLSH T10725AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 974KB
- SHA256 6e8292035237870d91880d66c67d298829d88615ef7a4d271cc0bea6f839890d
- MD5 dda6b3ceea62dc76c325c0acaf58d207
- SHA1 0d0e7d9290e36b21a4a71df32bbf7c171518c400
- SHA512 bf24bf8ecfc9288c8df3d8f5eda90e717129bedfb02036aba43ec0ff4aedce42cc7685282e3e29d7e24b1be909e15d8ba750bf6a78d3e586288170339cfc5ad6
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDJb:A3kMhT1Llji
- TLSH T1B225AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 974KB
- SHA256 5c18538008b8d74edd9d41e9d29ffc1223844bf68b927cf08cb24d6327753462
- MD5 d7f240de795ba122e7e72f5ce52b6d90
- SHA1 2ca5ffc1ddcda58165038291d757c0ba78b62ef4
- SHA512 8e58d3db7a742bf373f2be6e3719c5685ff102cb6dcaf402c3ce6ccf2dceea03fea01d1c117f753ba8277af4556d572775bc3bf5bcf780a2857de8e0f63a11e1
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDxf:A3kMhT1LljC
- TLSH T11C25AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 974KB
- SHA256 d776a93c745562bb23665a51b4093a6c40a8887f2755e033f35109258518182e
- MD5 80b2b8ba9a429a11b1905c315c40f99d
- SHA1 517e26242f4a970c25e31746fd71ad0af1ce28c3
- SHA512 9339cc3b7b2402c9059032e41c3af90d5843b9c98ef1d26921fb2114b6609b6378f1a5b38d1607e9ce3175dedb3aa22d01816911c465aaeca215e15d48468925
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDaK:A3kMhT1Llji
- TLSH T1EE25AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 974KB
- SHA256 41cf0a1f034279ce6b53c1b08881d73d14f0ef12134f2762a18358c41e64002d
- MD5 c832f216f226e27967f7a74370ea80ff
- SHA1 1d784ca2235e0147b4d4fb64e405e78339fd2846
- SHA512 88939b489cae31e47d9116bb614e4eaa57ddc747e2997d74c335d2488dc911e4b67b7150300359bc742480b6006e6fedf4538f2685d4d28d6d3a2963f4584278
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDPk:A3kMhT1Llj3
- TLSH T1B725AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 974KB
- SHA256 ce64e60d5dc4d874e5140749eb6556d854616c6debde20c70cb24619249f63cd
- MD5 b27a10d555290fc0bcf4af50766949f9
- SHA1 f60ad948864f700107887e9fc5a058d46d5f6b15
- SHA512 e9ff952d784a7b1ce656643dcfea09a4d7d8b57bdb8c7f901fd2d99b4aafd1c69e782f6ea2be9d7a4cf4baeed9822c6bbcba2f92dcae78cadc87606033d3bf13
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDI0:A3kMhT1LljW
- TLSH T10625AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 974KB
- SHA256 6babdd599cd40a8ad69f00c55c937e2da3908aa3543a5a1992ab3ad9299b2d9b
- MD5 68e2136a71f1c48146d8ac1e2582518d
- SHA1 ae4269e7997d5d519a2f1d686821c8f0e3e01141
- SHA512 01cd06171400c4c789d03bacdf52e384172dc3e9ab1a330a7e5929824e4558bb2d64ec60625fc89dd41a1a0ec48fd66bf7e20b34758d18a6bf65c452950601f6
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDjg:A3kMhT1Lljv
- TLSH T18225AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 974KB
- SHA256 c4923587ee528900ca95cf2b380631eb7df885aed647f32d57099caa02776939
- MD5 64046651d2eecd97c627f7ca2a61963c
- SHA1 350e541ea1e9bdd0f96c15c690615a2db1f3f91f
- SHA512 2189e3babc3d187d2a29594fb39876d1063d416c2a0d6be4c787432e8536573c21beaab20bfb8d691e3ffe6a434e8e33d2b43e1c45866cc46e5a2dad3b9fadd5
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDer:A3kMhT1LljJ
- TLSH T13225AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 974KB
- SHA256 45de3ea4e3be5a37a36ea452fe44dfd4698b1da26a0e48efe7ded49be54563be
- MD5 a680f410816ff76a341f0a7ebd536bde
- SHA1 3ebe6832ffd78c554ea4c09c5e226e3769874b83
- SHA512 6950ff7e9146a83fd9e5f694b8e6f3792b87cb1054047ce005f5b1c9b157dd4707a86287df8ace72c9e80e8d4c2d0e4f9caad6477b428351f342725d41d0a380
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDEn:A3kMhT1Lljj
- TLSH T11E25AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 974KB
- SHA256 2abb03ea0c70f39c2e8cb740dafe8f0819dfd79dd7b099d794163bc74e05e589
- MD5 da582b0cb0b2f0fd2af8d044874ba0a0
- SHA1 ec26d4a05845b8d0985e979d12fa3abee86d1c1e
- SHA512 17a9f5b00e6c8782e8d832442fd2008c2c8b9e2710195efdaf09ccd359e5dcef69a9619b9dec27c43af1de812a13ecfd20e3627393e7981ac2d4e14057c4a626
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDSx:A3kMhT1LljB
- TLSH T18B25AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 974KB
- SHA256 470128b6693e9367bbff7c93a8bba20c98d326aa5c5a789016a4ea5021b34887
- MD5 57ab67589daebb56cf50708598eee6c4
- SHA1 03dcaa3070fc5986baca5905fffee9dbd87afad2
- SHA512 ca23d3c17fe03e1d1b4716d99ac776d5d0f49a12aa3743d1ea616351b0f55d8369467d99ce2c0dc9ac8b85b4b7afaff9bacd05602290d4c9633f329793644f72
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDkA:A3kMhT1Llju
- TLSH T10025AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 974KB
- SHA256 aa3dbd4aed9fb34b4a036fbc913833d68ae5bb2f897eff09c341c398a6428fec
- MD5 ea7d977322a9d843579c9344d3fc1b1f
- SHA1 861b195bda45c0b51b41ae2fd7c8c93161d6cce1
- SHA512 0279aabde5e7201436d96043999098dc62a2a42f40eb948a8eaac23bb9dc657c1c0538e60368abcea10b746a87acda84d2e589b6e8ca7e53203c30c346c624f4
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDN9Q:A3kMhT1Lljz
- TLSH T18325AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 974KB
- SHA256 265a4ffae011a113d706625d4a92d18d1443880ed6816de1b032a35e93e1e06c
- MD5 19197b80eb4a1df56aecb620027842c9
- SHA1 458035b2d16e029593282a31b08f15ef52990acc
- SHA512 9154ddee071cce36509dc24238cc8f7e5fa1a349fbb7f579f59a757b8672037e7611195351b0be0cd1d281d77f33a5f4f1cbff1731c851109077cb1a5a4a5e2c
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDo4:A3kMhT1Llj0
- TLSH T15D25AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 974KB
- SHA256 752297d86ac23140d0a7a18c89f5e0287756375a2009b2ca5acb144dd960b3e0
- MD5 bee7bb9a917bdf037c049678970bec8f
- SHA1 cc5cec625ea8851c36c051826750c0c03eeaa224
- SHA512 80101719835d655b045826cc980de78d28798482da65d59865a69e20777d2aff5bb8a2de1b2c041d2b6383dfb8387645fb518534f0f760dbd122f5cba00b0ee2
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLD7u:A3kMhT1Lljl
- TLSH T10325AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 974KB
- SHA256 323f6643d6bf1b829fd075a7fcdcf22556c5a57b0caedf0ca201ff4277c02604
- MD5 b29e783165a4ca5de1fa0d24f258e4bf
- SHA1 beb5c325071c65994b34d1f938aafe238080a52d
- SHA512 949c10f952ab464b2e1399d84d9611ed3eb5baf3e1abade4c9ff08a17789fd53393127c16e2b3a2cba54b9b851025a83688199ae78e94b0f0a53d4bd8b152fa8
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLD2j:A3kMhT1Lljn
- TLSH T11B25AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 974KB
- SHA256 d24ea453015303838d9a28ba86f3c4261e2539c664d3c38c720caa7c1184e324
- MD5 fe2599d9ee04377fa9cf0270814c4912
- SHA1 9ea5a22b5fed4f4dde96a76d984a95a0e06b9c27
- SHA512 f07c64319308597edcb25f91dd6c9b6e1322f2fd0f73a5ed57ef12bdaa45574764d3274e0850370ac85f4cb5832ab7874301c11a522cf239e21763ca55d7740e
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDjg:A3kMhT1LljP
- TLSH T12125AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 974KB
- SHA256 91dede8ed7ae750aaaf1b3ec7b9e4f6b1ec3e704385682b396aed00d8ade02b7
- MD5 88b4a35d515b8880b0b3d5cdfa298e5f
- SHA1 58d46df145d4818a09ecaf2256489582b86b5f52
- SHA512 c6635118d06921a4c5e4c5cbc780f6fbf24c1bffd53866d9dcf7d6aa66cdff6c1fbea2ffff8e925bc76e54231ad26b7322e863224a8044af72be7253c1973e66
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDeI:A3kMhT1Llje
- TLSH T10625AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 974KB
- SHA256 f5587dd44ec8f83d2bd4d7ff40f3aa3429510186a2658f86e76d43e473d8cc3d
- MD5 9591c7418e71b30fcbdeafbc33acd7b5
- SHA1 152d15801127db27464905ce3ae7c1a09069e49a
- SHA512 42900a6db74ee36030eb8353e2ae4a14df6a1588e2f744179c8bfa5b2c8ffab962031293f8fa58ce399a0b3a068cc5ec2eb54afadebfcd269affb1f0cd129231
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDso:A3kMhT1Lljc
- TLSH T17025AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 974KB
- SHA256 2c45d6396de3501b4e2c7764e04ad77ea5e8c485b00d940da96ef2b66b05bd36
- MD5 82f5d8e0e92dd70bae5c7f9ffbbc3cb4
- SHA1 d439c8796ae5cfc9951d4733a8fca33b57411cbc
- SHA512 c02b650bef0628da50711be4f20b7505e3113e50c9e11728cb82ade2845316ad47d3ea0d6e65e93a48081514bd81ee7f949308f8bf5600860d232eeaec73baa0
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDv+:A3kMhT1LljR
- TLSH T18725AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 974KB
- SHA256 2c10059a6f2ff72ebfcb52403262774eca1f193c7a8e32bed8b19fb29fdbbdb2
- MD5 02ba9dbe19aa63488b0c126bc4fb08f6
- SHA1 130abb194ed3ad938e5b11636bdbc0bb927f0914
- SHA512 fa6c0646994d7e77ed02a103d3bdeaa46540da2f479e4476703df2afe5d13684bd08fedab4b57f0734c49ebeef9a00ce43a0416c54d624c147dc1c8fc8008b15
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDFQ:A3kMhT1LljR
- TLSH T17425AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 974KB
- SHA256 49cb8f1b53169a8f9babe63a614c6078f5b6899f7c3d538fc98acab24aaa973d
- MD5 bb6842fd5228a96c4b6604ceb43a990b
- SHA1 0281cb7f0c3610e7c58a1501eb685939db5c26be
- SHA512 e286e462e7afff4167bac27bcf9ea76ec3dba8f198afa170bce8621007e48509c32866622ee199282de6a09e953ab430697ac1a50491f1617ff80758a5039683
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDKX:A3kMhT1Lljd
- TLSH T11525AE13E79004F9E817813499A54A12EBB1BC661770C7DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 974KB
- SHA256 fe10832e8804ef238fe695517e5e3a9582f26cbba888a71afb4875b4732cecca
- MD5 ddefd608f24c206b900db0a8f8be4ad9
- SHA1 523054f2c81db31e291cdf32b1267b07bfd73d96
- SHA512 2c23d0dd162189cfed8bc58fdf8e23663cfbb1a0541e15ee02d57bbe0fbe965626944318812b9b23dfbacb9b673d3609b3133cc95b0b5f9433e819925d6e64f7
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDsL:A3kMhT1Lljf
- TLSH T12E25AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 974KB
- SHA256 0d069b1af6cb185b5ed5bd77da21a54c7a3b8deade0665304d4e2cd13cd6ed1c
- MD5 eee4fcfbedfd2f06149e770ded5fa41d
- SHA1 876d0c7db7d382e91b15ee09086192f058a1388a
- SHA512 1fd7f795eff86d860b76085e1175f466c8f555ebd7fe49bd3c7152f59808c232eb82230a2f5fb1fb2f440a3d5b4953fbc82c11c2c28c1bc5353624e054c5be62
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDoM:A3kMhT1Lljq
- TLSH T12725AE17E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F337D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 974KB
- SHA256 05898730cf835aa04161e3a3d350a1cedb98815cae2ec01c64390115cba7b0fb
- MD5 79b955a11b670b8b4be29f82bb4e20cc
- SHA1 8023b262d24692c36e631dc8d9242bd6b6a7919d
- SHA512 699a1531ef93439b5673d213e725063cad21b2c2cc8dd7f595a07d7639c7de5cb2f112fa97d2d606da752dc81580fec60ded5e83c77f305d9e13378c3b00a97d
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp5bLDJh:A3kMhT1Lljk
- TLSH T16725AE13E7A004F5E8178134D9A54A12EBB1BC661770C6DF236892262F737D06F3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH