Analysis
- max time kernel
89s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 16:10
Behavioral task
behavioral1
Sample
2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 913KB
- Sample260817-tmpqaathqb
- SHA256 994dfcebcf5846afdc6894e8de56148420e1d76ed35a05bf3d52052e648167ea
- MD5 31283885acbed43a16e6f55c7ea8681f
- SHA1 171046f3bdf3a0ab0329f8bb750756bdff3d70b9
- SHA512 e09fc1a331a4c00a15ff8a39a09caf8afd6d29b4e1d3cb518aa54208e219fcbb76ad9c766365cf7074233a812cd3cd53a95be9d4da2dc60d725c4ff21862a7d3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyp:A3kMjKx56rP
- TLSH T1CE157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024502-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2264-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2924-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2264-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215c7-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023524-144.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021223-279.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023532-448.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021222-497.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021225-516.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021224-601.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021226-632.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021227-681.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021228-736.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021229-750.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122b-794.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122c-807.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122d-856.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122e-875.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021230-894.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002122f-901.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021231-914.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021233-933.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021232-953.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021234-960.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021235-1016.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021237-1059.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021238-1084.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021239-1103.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123a-1134.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123b-1159.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123c-1178.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123d-1191.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123f-1204.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123e-1290.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021241-1334.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002e0000000203ab-1353.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021246-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000202d9-1434.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024511-1467.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020268-1504.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020277-1529.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021514-1566.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023130-1685.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001ebc5-1975.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f000000000749-2265.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024502-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x00020000000215c7-60.dat aspack_v212_v242 behavioral1/files/0x0002000000023524-144.dat aspack_v212_v242 behavioral1/files/0x0002000000021223-279.dat aspack_v212_v242 behavioral1/files/0x0003000000023532-448.dat aspack_v212_v242 behavioral1/files/0x0003000000021222-497.dat aspack_v212_v242 behavioral1/files/0x0002000000021225-516.dat aspack_v212_v242 behavioral1/files/0x0004000000021224-601.dat aspack_v212_v242 behavioral1/files/0x0002000000021226-632.dat aspack_v212_v242 behavioral1/files/0x0002000000021227-681.dat aspack_v212_v242 behavioral1/files/0x0002000000021228-736.dat aspack_v212_v242 behavioral1/files/0x0002000000021229-750.dat aspack_v212_v242 behavioral1/files/0x000200000002122b-794.dat aspack_v212_v242 behavioral1/files/0x000200000002122c-807.dat aspack_v212_v242 behavioral1/files/0x000200000002122d-856.dat aspack_v212_v242 behavioral1/files/0x000200000002122e-875.dat aspack_v212_v242 behavioral1/files/0x0002000000021230-894.dat aspack_v212_v242 behavioral1/files/0x000300000002122f-901.dat aspack_v212_v242 behavioral1/files/0x0002000000021231-914.dat aspack_v212_v242 behavioral1/files/0x0002000000021233-933.dat aspack_v212_v242 behavioral1/files/0x0003000000021232-953.dat aspack_v212_v242 behavioral1/files/0x0002000000021234-960.dat aspack_v212_v242 behavioral1/files/0x0002000000021235-1016.dat aspack_v212_v242 behavioral1/files/0x0002000000021237-1059.dat aspack_v212_v242 behavioral1/files/0x0002000000021238-1084.dat aspack_v212_v242 behavioral1/files/0x0002000000021239-1103.dat aspack_v212_v242 behavioral1/files/0x000200000002123a-1134.dat aspack_v212_v242 behavioral1/files/0x000200000002123b-1159.dat aspack_v212_v242 behavioral1/files/0x000200000002123c-1178.dat aspack_v212_v242 behavioral1/files/0x000200000002123d-1191.dat aspack_v212_v242 behavioral1/files/0x000200000002123f-1204.dat aspack_v212_v242 behavioral1/files/0x000300000002123e-1290.dat aspack_v212_v242 behavioral1/files/0x0002000000021241-1334.dat aspack_v212_v242 behavioral1/files/0x002e0000000203ab-1353.dat aspack_v212_v242 behavioral1/files/0x0002000000021246-1378.dat aspack_v212_v242 behavioral1/files/0x00020000000202d9-1434.dat aspack_v212_v242 behavioral1/files/0x0007000000024511-1467.dat aspack_v212_v242 behavioral1/files/0x0007000000020268-1504.dat aspack_v212_v242 behavioral1/files/0x0007000000020277-1529.dat aspack_v212_v242 behavioral1/files/0x0003000000021514-1566.dat aspack_v212_v242 behavioral1/files/0x0004000000023130-1685.dat aspack_v212_v242 behavioral1/files/0x000500000001ebc5-1975.dat aspack_v212_v242 behavioral1/files/0x000f000000000749-2265.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2264 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2924 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2264 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2924
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 913KB
- SHA256 994dfcebcf5846afdc6894e8de56148420e1d76ed35a05bf3d52052e648167ea
- MD5 31283885acbed43a16e6f55c7ea8681f
- SHA1 171046f3bdf3a0ab0329f8bb750756bdff3d70b9
- SHA512 e09fc1a331a4c00a15ff8a39a09caf8afd6d29b4e1d3cb518aa54208e219fcbb76ad9c766365cf7074233a812cd3cd53a95be9d4da2dc60d725c4ff21862a7d3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyp:A3kMjKx56rP
- TLSH T1CE157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 941KB
- SHA256 a03aebb3ec4546b927fe2ef2aaa8d1ee0b5b6d1e23c86f3d5e0e70f76908907a
- MD5 d34a10c1d06bf347b5fc99b87c241066
- SHA1 c4233ef0814257715f5b58ddb75064183de7685f
- SHA512 537ef6ae28bb765f9530bf6086de4f078daa70cdab2c18acd6aa460a5d4c94392338b515b0d14f1e4ca78d47e498b3036f43e08a39e07f56696b21b8dd4d4444
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyvP:A3kMjKx56rJ
- TLSH T1E1258C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 959KB
- SHA256 dde0beffc377c8886a0a3a98927fcae926782f507e9181cd17fb9b22b4ac5d21
- MD5 8f1dcde9fd6db46e64a59392c40af56e
- SHA1 7d46e6a74565a570e7e953fba06d687a9e1b8692
- SHA512 59f187a973ecb10f9fdd3f2da13c31412469f6d89250fb2a9d62b7fa2e4507c330481d412be1d97f624f81b7f2c742b80b9e92638076782bb402fc6e95af8ef0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyc0:A3kMjKx56rG0
- TLSH T116258C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
- Size 1015KB
- SHA256 354571636cfd58ee17d767517a21ab78acb5a6cb3c655185899c465b50ad6523
- MD5 d7b8b11ecc5fe2e27c58b46994c7429a
- SHA1 7bce1eb88781466def804ab8cf4212ff47cfde99
- SHA512 3467b03b312b4289f8c74d9519654423c6ec4477d950390895f1dfba51aa0e72a687306af7d24d475f69a7e8086fa025180b2ac40eef679840c7b0e72bb0fea0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyaW:A3kMjKx56rMW
- TLSH T17B257C03B6940FA5D12F823499A54666E777BC121F2087DF2354AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 965KB
- SHA256 84fe0e37deb7e28f723b74ab0dce79b177b1f3a3d0f3843afb5f932a092f6bbc
- MD5 09658ccff45343f0d5b55e6f38be1a9b
- SHA1 37483c2a6c4635514bc4c995290a24a61b141924
- SHA512 23b82fc60401b1b8be72da50ce9041157e74fe17c440d522931cbccbb61e4dbc39a80723b8fb721c701e569e5125f85c84f53da1e855e91abce98be420609030
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy4fj:A3kMjKx56rcj
- TLSH T14F258D03A7940FA5D11F823499A14662EB77BC525F2087DF1354AE263F727C0AE3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.3MB
- SHA256 91749c7bbd121eb66d6a790ebcdf77209bd18631ab0be58df7bdeb3f50e06248
- MD5 d3d8e21e7293d1ebaac2ff843b463f04
- SHA1 47da175881fbea77177d88dc3493a241d0bf7e3b
- SHA512 4e7786053163090a8b484a2f785c7ec467a49f7ef26d368a969895f96099c60ac3b847c48ae5e62a713e76599bf02017042940feadb011835215a915db29ac5a
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyJ3Td9CHKy7GZO:A3kMjKx56rvTd9CHKyao
- TLSH T147655B12A7D40EA5E17F863499A14512EA777C561F208BCF13946E2A3F337C09E39B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 b9326a552f934b26e2db3eb57f4217eb411d647d4d2be3ba0314b0b40b74d992
- MD5 832857f6f66cd8ddd55a8c1ff4529d38
- SHA1 c28b34eff506ac3a852245df9cc7a3657d4b88aa
- SHA512 4fe289f02ede2923ca2f03b1e93e7e759f7d735035b6a54b79da6b6979c8a459520312034233ef1c39498a0da778dcee8c8df0de0c3c538f70d271fa7ae36ea4
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyBUr2d29dBrtpDiI:A3kMjKx56rXUidGl
- TLSH T163656B02A6980FE9E06F813499924652EB737C561F2097DF1394AE293F337D05E3A727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe$
- Size 1.0MB
- SHA256 b444927a97a857623642bd034091bf8eda414a9df489265ed366e19ad6fc4f1d
- MD5 404d063c34cafebf054b0274a327ec97
- SHA1 93732cbfa817a7d193967188f9a79b8bfc5e61b8
- SHA512 d5a7806a04998ea60bd4245e088f2248e4f5dbf59b91f1686561b94e7d8946f3bb95a52496d37330599f4cc9e30d793a3ea62e3052f98c2296192fa54c55e705
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0Gen:A3kMjKx56rhI
- TLSH T102357C03A6940FE9D12F823499A14562EB777C621F2097DF1354AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 b18dbe574d05eab928d1e9a2e2e2c2dfebc62d134d6184ac2ecd67bb3459da0a
- MD5 cdbfc6d3cf5b0b291a2774c0405a9bd3
- SHA1 a41546da2205753dbaff38b2260c2e4651aebd14
- SHA512 1c5164d44c15d6289f0570c64920af2f02219e25e17a50500a0d29c751337c3f63b745e4a81f2b0b0f4b94812c7b9924d6ec6ef28f2765dd7337be0e7abd518a
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyV0Le5ji0hmxNrM:A3kMjKx56r7Pji0Aj
- TLSH T1C1655A16F6A44BA5D06FC174C5E2965AEA733C421F3087CB13949E293F237D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 960KB
- SHA256 4c434a35107d454152872b26ad6bd9609fa45f54847f66f830e33f93f180ce3c
- MD5 d1a5f452f87be0e8480aced8f269be5b
- SHA1 4c3de4b47f330c5975a420bc9f17be230de7858f
- SHA512 10fbe527801e5ec40860b1a6a7ab589338805c276da707818df7252ed2b849987884fb96e27c9f2c75a09ccf8d341cfb5610d99c01952bc8a5ba1845f3b394d4
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0b:A3kMjKx56reb
- TLSH T14D258D03A6940FA5E12F823499A14562EB777D522F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$
- Size 1.0MB
- SHA256 22f76f1cfb33f0d098c4d565a979c10f1995c5badf437383c5e1e33d417f5e1e
- MD5 34afa675c05c4320ac437900d5070d45
- SHA1 6f18146bffc0ea7822864af9edfa8c466ea93754
- SHA512 fa8130802b8d0a2891cdab0882ea67b4cdaf2ac63b1ff151c91e66e9e73bb074cf4cfa82cd39a2d4cc54fc6a648fa016166763e708583929469d47ed3cd8a004
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyuD:A3kMjKx56rM
- TLSH T1FB352602E6940AA5D12F8134DBA14652B7737C525FE087CB13D4EE3D3F32680AEEA657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 936KB
- SHA256 08c40781db5f28c23d2107168a2086576d256e58fbbd00f363db1b44cab30945
- MD5 7656ca404d847aafb6e6af7a4f3ec6d5
- SHA1 cce3c243e75822c97bbfe2f4bb9fa7c91e6ca0a7
- SHA512 90276544582d0417360c4456aefd062dc59294248ca41cb35fe4ab039639df6661f7c3dc5146bb14fa51fa8f6230e39ac8d99eb5337b91552b73250c4e1eef19
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy29:A3kMjKx56ro
- TLSH T12D158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 936KB
- SHA256 1151e0523832710b35943f2e9f03e32cff8672416fe4afd20e43d8b66456cbdf
- MD5 b826c5ca0d94814ccc44d1b93f175003
- SHA1 f9f1ca070433554f5d5a77928ef4da496757ade3
- SHA512 e4de0b7e686f4b824fcf66b3f4579e2293b6362e0e472661b9dc3315aaf42e6cb317f00fe1f02bf8493543f79c6e833538322a7bdd4902364ec9aee67b76281d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy2c:A3kMjKx56rp
- TLSH T115157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 936KB
- SHA256 ce939df75a62bf4ea2b44e4b810747fade4eb47c473e27f914d72ad8ebe2e4af
- MD5 14725fabef74f86e0d567439a186915e
- SHA1 f0ecf16e3b2f3efa40a1853cea0632067f3c1d6a
- SHA512 d65c31166e8f1520a56cf9934b205b832ad06e57e05ef27e0f74feca24a36df57d05c93b6db012ea3d6e2a60282027887f72dc14a790d3a6c575587fba3b5578
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyvp:A3kMjKx56rH
- TLSH T187158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 936KB
- SHA256 b78aaaf8f7a9a67e1851a7fb4640361a438a246e3dfeea4f4c4c650612f8f4a7
- MD5 1822dfe0c4c4edd253b5c8acff936ef6
- SHA1 9daecabb06402157486f597afcb32eda6a9a1b2b
- SHA512 0784beffc3d933b41b3a216254057f3233aa80f11742d042eec7afee546341b0c4b56d900f586de38c3de5fa8977b2cc0a779a7dc6a326a1abe9e6c1b2dc4606
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyQN:A3kMjKx56rM
- TLSH T161157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 936KB
- SHA256 c9a3c016090d70ecfd4c3ff8c9ec1c1f3928c326de88616ef8f1d268b36e99eb
- MD5 4a810a63b22fadcfef4463b9e4adaaa2
- SHA1 5bb00d9dba002d8dad75cf5cfa03425a32d58295
- SHA512 50cc369d189270fd4bcb9bb4c06a33fba9032734118cfcd4b4a5361514449dbbb1d5cb3ffdf08bd4c20adf41258cb781df0f3efad84afe6daa16813bbef3fe73
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyYF:A3kMjKx56ra
- TLSH T138157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 936KB
- SHA256 7a4eaeb724bb3bdeae319579fd223a97a8750bddc556f4933a6647d820a544a4
- MD5 5ea8de4fab8f606edcd1d48eacfbea1d
- SHA1 a73ce47ece232728b0602e105fd9b808110d64c9
- SHA512 6f1d9e68a631174c87b18a29ab6ffb954ef6850bb6053a9fa940f56558d320a02e5476ae7ff82ff70a9e9be3562618b937206dde54cf59ab529f6ef2b316f15e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyNC:A3kMjKx56ru
- TLSH T16A158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 936KB
- SHA256 63a9928d47e020dc2474605577c3e4b4917cd913faf4be14ef27fd86477ce225
- MD5 f3a7d7f0e7d25a6e47ae54e82706123f
- SHA1 8d6fded090b71d8f7908aace38255bec0fbf3d00
- SHA512 fbb940f91bcc1aa6775f51ee0766bf3a6644310879324ae705bfc6fb000a7ca54f920206947f93af5b27db0285749cb852080a023756e6abdff9e9129361ccf7
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy2w:A3kMjKx56r7
- TLSH T1E5157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 936KB
- SHA256 ace1c12aa456ceebefeaeccf8830408e4ee3cfdfc87e9a7a01b33a082c97ca9d
- MD5 ce8f9bc734dad7850a57b1133ef5a513
- SHA1 54fb82d0aadeccb53b57c160307dae51ef6aee21
- SHA512 24d35a71703e932e72a130e7641831a5bf1f442327870521534d6259386dc03d2413953bf0f200637d95f7cb8f6a22530eefba06a485c9d72bf7a402fe0967b0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmylT:A3kMjKx56rn
- TLSH T13C158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 936KB
- SHA256 5933406b676298fe8f35a03251a2c8de949b682d8211cc385b628595650a1109
- MD5 1505b77a97197d74f720a0e24ff2b75e
- SHA1 655bb719b4f13078de18eaf6bd487a5353366daa
- SHA512 a277c619aa5c05b3c648f5231b3f514240d87e9571bf011c51ce5da64065812fd92ddaef927b42fefb6a2f7d2a77cf6c3112703d12d960dd287976ce6331e41e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy7u:A3kMjKx56ro
- TLSH T140158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 936KB
- SHA256 1fde193a97de262949a170bf0d33d6098c4190753eaf28506f1be4b7a7e84118
- MD5 e9f6f30773d7ceffd66eafabc614f2f8
- SHA1 97c0a3d6c895d8a050b51969b48ccd65ac2c371c
- SHA512 de3fe0382917f1ea680bf7005cd04b4f22578c9173354f6edc6f13e65f45e1583a973c50e051f6491692ac35e448159ad940c390408eeba189ed6b80bc1dbfcd
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyfb:A3kMjKx56rR
- TLSH T14F158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 936KB
- SHA256 20da6e645a49783d88e97347d31cd04d747d4eaf1e8e54f7a81108aefddb3661
- MD5 769f9b53bd75e3f99bc2a5c64494be08
- SHA1 f423b7ad2b1c6270bcf66c579b05e7f5ef127e24
- SHA512 01675892dac26db249efaf6a66c61152041a2c56a94521259d0f7304b4d5e1814f57929cc29bdad7cf0b38be6ee2f2e566af0cd80f8cde3b4cffa4f7b0a82a6e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmybf:A3kMjKx56rR
- TLSH T14E158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 936KB
- SHA256 f48628a4e0e66f50682ed362559879b2de8dc374d3ed54f363abd4e16e179aca
- MD5 e950e7770b87f5dfd6924cd9b034fb68
- SHA1 4fdb93102d58f96602c803dddb7655931f4e9250
- SHA512 0c28b516ff8d3ea5c41f3923e43586e271888ea674e75db091be07cf54578bede14a241a1be919e69e9a4ef25e87f3a314527ff31d7695ff950f9e00b787d735
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0K:A3kMjKx56rp
- TLSH T1F0158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 936KB
- SHA256 0a1214c2f024eba4e812c4b923e5886014637cae68e223e41af84537d8c98be3
- MD5 f27ceeeec6dca7b4a9a47d46554d1f44
- SHA1 c072a673e70f92ff940e6c637181b3c740c665e2
- SHA512 3e1dcdea7ff481836d412f32c997041ddb1d7b1e90e415b374866bc743ee703b9963e161e86650c6bac7265e5d3b7aff971c88623acfa7f7f6bc2810e90a9a35
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmypk:A3kMjKx56rg
- TLSH T15E158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 936KB
- SHA256 8bb88e5ffa34d05e5f1f56752d0a7ea9bdba44488437c2f66b87929e8b0502df
- MD5 87cd88ab08ab5d303ba14865f7f946a3
- SHA1 6174dd2b6d3033f656a6883e0a7ac9a8a53d8e21
- SHA512 c3845fc5e964c088550d6fa1cd3e3afd286c5a0a3ccaa7f483be515cc1329d37d1fd6b38f87a53b9179f6bec92f91be8d8d7d560458edbe316cb3508c4ead044
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyG0:A3kMjKx56rp
- TLSH T1C4158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 936KB
- SHA256 e2502ea3e2ed40a0141289073491b8a7aadff8d31444244a746447af527da905
- MD5 d2d5121c374d552e1db6d2a2751cd7f5
- SHA1 356f4d89bb62b19299f976dc3936376ac2756f87
- SHA512 9fbbafd856488ad5f4251ef18b54a577b25208831615e7437075a1a650ef065989dd3537ff58dcff285724e4e114309b136a253253ab2ba4d4cd50a834192523
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyVg:A3kMjKx56r4
- TLSH T1D0158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 936KB
- SHA256 b879ab2de7a5f84e3bb4e5618dccf70c5b5313e125ba7c3e4d093ad198625b68
- MD5 bece8decd095da59ad571866f8c6020d
- SHA1 619834b42ba1a1f5271801369b9361c00f6de311
- SHA512 8fbaf56bae4abff9ca3f53a71927394caac8306b64d952e0246ebfe2aab80096081aedef0a83ea6c16022ce526837f8486fb7037707ad409b5dfad16596f01e1
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmykr:A3kMjKx56ri
- TLSH T13C157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 936KB
- SHA256 943a877eeaa9733fcf924463f958f56cb470fa0743511ca32df7b80ffaa9ccb0
- MD5 7e31594f73fb6341cd720617d8656fc9
- SHA1 60395220d896fd6f8fb631aa890cfba884ec9a78
- SHA512 fd54a1e6a5517eb9fb2ad5f41097d48f6f79589e1ccca5f7df6b7974579367d7af6241e3cef91d66cd82ee9b5cbbc9b20505218736378037cb0184e0c50dad7f
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy6n:A3kMjKx56r0
- TLSH T1E1157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 936KB
- SHA256 1169420fab57060c6331ded6f673d4e4fdb3cb1700f3efefd111c6ae3387d499
- MD5 a77c8f8e4744e950700c821d53cb7c3d
- SHA1 65b42453cfa03aab05b7d1191f50576f53aad8ff
- SHA512 7fc3fd172a458e4f8b9a549a7b44d8d15e66183c41f87b13d40c41e211130549bcab9d464bc8e402d561bb52f7dc0f1c4553031606560f4136294c2beede1ac9
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyQx:A3kMjKx56ry
- TLSH T103157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 936KB
- SHA256 c6bea8f6d5e7ac9cbcaa4dc9cba934c4d9eaeabe737cb8f1b0a7f282d76f3415
- MD5 e19c5efd86bb2d31aee8ab2826b2acbb
- SHA1 23aeb154f71c6947b14f7e9caa11efc15f4e0f87
- SHA512 b639995e6498c1f5a287010dc9c7f5fc7b62377c085035a71c4755877e07521f333a28740ebbd62d56ae87d3eee5439bd253c6377d8f804b71c0cebcc9bc7df8
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmySA:A3kMjKx56rR
- TLSH T15C158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 936KB
- SHA256 2015f2ade14117e493b0f8351ad706011644424ddd1fa764985b7ecad512a084
- MD5 b6a59e479c15c562f4f561fd9efdca00
- SHA1 dcca4080be2171d2efcf0f49f5e911c2f70e9173
- SHA512 cefec39e25ee90f8b8323a61a89db50d2845d41dd355f985b61587758321a3a782e94e26695de323bd5456b85bc2d2a5fbd8948ec250c0769ae7a15bf69476f3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyr9Q:A3kMjKx56ro
- TLSH T1AE158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 936KB
- SHA256 d7d01ce5cddd1da19374e8d85bd7145d25e8f64663439ce8f7d584633b243911
- MD5 a0a121db65952cdf376c56a90ebf511f
- SHA1 8095dfd7f08136e4f90303807d1f58bcd24e4c11
- SHA512 64f2bdc9dd5dc451d021849c8ed0c32d6f5c071c76c1ff94d0397f61e3802f296069eaf950a6933144d8788a3af425995dcc4907373a332ac725515a72a837a1
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmya4:A3kMjKx56rT
- TLSH T1A9158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 936KB
- SHA256 29fbec5340428da6f0197b4bb439fd28d240a659e7beb92ccb76f425cb3005c8
- MD5 5cdc13d1e64a695f77c47163a0fd2456
- SHA1 76d85e22f0ee4817ea7c5a4264f7a090258b32b3
- SHA512 8142d9dacc1494744cbeb7410cc0cf3ad25500123b84d0483d591c1875f761191242981fe5ad142a46571310199b17946e6f6fd910151a2857349c2a8bf62f44
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyBu:A3kMjKx56r2
- TLSH T1E8158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 936KB
- SHA256 4de9511a32c2d81f8a92fedf6346a466ac7cfbae7e8adacd0de6049cf1d67609
- MD5 5b19f1e209bb5f2ef15bde70cf7f5c07
- SHA1 23a4413859e85f0ecef175a1cf84fa41673b5e1a
- SHA512 614f4bfd4fc9e852c8508a00836a1fd2ebc970c799b0d44b5ca43f5da9446f0f6e31ec1c85aa75b35ef672ef7434007d23e29fbb2c15bc78077d3f963ce27076
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0j:A3kMjKx56rI
- TLSH T1DF157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 936KB
- SHA256 4fdbe6b551169e5be1abcea0100585b939197760e1139743e554ad965d061730
- MD5 a090e62f6a1aa84b45cef4e9c472a4be
- SHA1 aaa6afebdb48a6c9a5abb9233db8dd0bc6a272f2
- SHA512 ff2feae42b88660abe564d71a31208e468ded8cbf3162d45147266fb46d5dde451d366d8a91c880790497936022103621e1d338660ee9c19a647355e2e23d023
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy1g:A3kMjKx56rQ
- TLSH T1B9157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 936KB
- SHA256 9936f9bf8d3f5fbf4aa631129efb0934f12c0e96ed88eb59b363cc75b0228947
- MD5 09634026a373b48366e9655fa224f62a
- SHA1 980ad39d1602a5a9625bd1f3ab59da96204b2da9
- SHA512 ba2c2a0a73f21a59d3ba38f833aca92b59fd8e73ccd1b070d61f1e897948ce9b18cd985e87df2182ddfd4c7c04041edf7d222121078a31160089a4beec0ead84
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0I:A3kMjKx56rx
- TLSH T1F6158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 936KB
- SHA256 7a5cbadd6bb6cf94a3c79953b67cf2b2a4253cd928c7694771d1659725cc0034
- MD5 5d6162d29e86e5aad02b7bd20246acff
- SHA1 4816cdaa320184428355328433a668bb7bc4f403
- SHA512 340fb9f4bc5fe04e0fb806015b30aeeddbd2d607c621c2444d024159442cc64e1b38fe7d485f1fe5b5219f74326f5761563540e202ef7678903247ff819c4a8d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmymo:A3kMjKx56rP
- TLSH T1ED158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 936KB
- SHA256 c6628b6c23398b8bf4f46cefcd8c89ee3fa418f5b000f61db41d9cb5c22eea51
- MD5 6f8fdd303520bb33a745b533b8020d25
- SHA1 01a89709b5fd856ec51e977788522adbb50280c2
- SHA512 0f6395b75989633a19b9b5f1757bbf711ad364f111514ac386aefd7cafe4c8cadb241a8488f0f6c965ff17e3a497644f6d6fc0574406f33304eb2b4f023458ee
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyN+:A3kMjKx56r6
- TLSH T10B158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 936KB
- SHA256 4ab295461a7e35f307cf3c07bf1c6cb30a59dff644933924136f9fa16793b884
- MD5 4cf664098f9a2ed9cc1d18cae0cbdc93
- SHA1 cbb26011b0e187cb3266a5f4b4533470e440e40d
- SHA512 274dad5e248df349c3e813012ab553210106581ea30224d562d85db3681ccb09185ce3e0dba0be2adcd481b60b07ff0a6709de59f7c3b0310bd864554deef09d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy7Q:A3kMjKx56r+
- TLSH T128157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 936KB
- SHA256 46b5082c63e2312f75845b50e9d16a21a035a94c98cd3a428634a3c07ccb8d7f
- MD5 cd546f8a0104167448a14e41ce442ea6
- SHA1 bf9681462ae6f22d2c3ca91ed70708287bc02638
- SHA512 2173bd6efc52e59e33015b9c1ee371706b7fd8b60ffbc6ca6a7b13d05c9e81019e3b672a59d9df83e14f108276b6e2911995be6f67b37fc66603181829202353
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmywX:A3kMjKx56re
- TLSH T1D9158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 936KB
- SHA256 994087ac2884ced1a277e6d87b26b81aaa754f4fb19e05a26b861b6587d625a0
- MD5 b47e1cd49aefba02d0583ef442ec50eb
- SHA1 80ff10f26a8c99d9eb73f4ccc2d59df8481d4993
- SHA512 4a32948e576cecf36712972af58ecbefe80825e0654f068457a076663012f588c44eb5031438d97fbca6c26f3d3ec0ea2afad54f9ea86895f3d56d6d87b640e9
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyGL:A3kMjKx56rw
- TLSH T119157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 936KB
- SHA256 c9ab63f939720bc08714c2022385b9fef0f35759ce461404bbda0b3ddb2b60af
- MD5 81d0a350df4abfa5033749128ca8dca0
- SHA1 008cd4d377f3940ceb363ffd3f2f3b3fde3f324a
- SHA512 aaa802359fdc778ac9d3dfa7755e7739cb228a7d312beaa5701fed992d9ed0d59bdcd8d319fd306a299ceec1d0b3bcc6d4d650d14b3cdc841f56e587776fa4e2
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyaM:A3kMjKx56rh
- TLSH T16D158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 936KB
- SHA256 d1f164a3ac63e92428242d6508f6c14b512d2212c1041e318264f0a8e136e121
- MD5 1b771a3560d16779fe0b214d3e59ddc4
- SHA1 67ef7917d8f971206f0a0c3162042ead822c4ee3
- SHA512 93c6487106f69e28708a464dd1b8aca55a101975f5bfa20118c483be799d72325893e043eca7d0d69e2f0f179eaf338e7628a042b5136d5db96be4afcc558651
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyLh:A3kMjKx56rz
- TLSH T102157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe$
- Size 937KB
- SHA256 59e5e20c9b4c89505faaa67acae874af42999ccc0632d7b600a27909d413bfda
- MD5 4f580cf0922974b712355842db927b98
- SHA1 3eaab19d219910b083a4e056942df91729e1e703
- SHA512 6d68341be78c0937be507650756a98264560a26dc545855b3584fbdd5102ddd7b90f598752ee0577ba10c970232bbe7eded688945b75e1fbaf5ae49aaf3a697b
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy8:A3kMjKx56re
- TLSH T116157B03A6940FA5D16F823499E14562EB777C522F2087DF1354AE253F327C0AE3A76B
- MD5 SHA1 SHA512 SSDEEP TLSH