Analysis
- max time kernel
107s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 16:10
Behavioral task
behavioral1
Sample
2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 913KB
- Sample260817-tmpqaathqb
- SHA256 994dfcebcf5846afdc6894e8de56148420e1d76ed35a05bf3d52052e648167ea
- MD5 31283885acbed43a16e6f55c7ea8681f
- SHA1 171046f3bdf3a0ab0329f8bb750756bdff3d70b9
- SHA512 e09fc1a331a4c00a15ff8a39a09caf8afd6d29b4e1d3cb518aa54208e219fcbb76ad9c766365cf7074233a812cd3cd53a95be9d4da2dc60d725c4ff21862a7d3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyp:A3kMjKx56rP
- TLSH T1CE157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 31 IoCs
resource yara_rule behavioral2/memory/4192-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c55c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4192-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1844-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c85-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e2-473.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-705.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-824.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-951.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1006.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1087.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1168.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001890d-1480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018913-1517.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018922-1554.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c55c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cc-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c85-59.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-334.dat aspack_v212_v242 behavioral2/files/0x00040000000198e2-473.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-595.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-705.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-736.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-824.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-919.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-932.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-951.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1006.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1087.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1137.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1168.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1181.dat aspack_v212_v242 behavioral2/files/0x000800000001890d-1480.dat aspack_v212_v242 behavioral2/files/0x0008000000018913-1517.dat aspack_v212_v242 behavioral2/files/0x0008000000018922-1554.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1844 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4192 2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 1844 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_31283885acbed43a16e6f55c7ea8681f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4192
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1844
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 913KB
- SHA256 994dfcebcf5846afdc6894e8de56148420e1d76ed35a05bf3d52052e648167ea
- MD5 31283885acbed43a16e6f55c7ea8681f
- SHA1 171046f3bdf3a0ab0329f8bb750756bdff3d70b9
- SHA512 e09fc1a331a4c00a15ff8a39a09caf8afd6d29b4e1d3cb518aa54208e219fcbb76ad9c766365cf7074233a812cd3cd53a95be9d4da2dc60d725c4ff21862a7d3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyp:A3kMjKx56rP
- TLSH T1CE157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 941KB
- SHA256 a03aebb3ec4546b927fe2ef2aaa8d1ee0b5b6d1e23c86f3d5e0e70f76908907a
- MD5 d34a10c1d06bf347b5fc99b87c241066
- SHA1 c4233ef0814257715f5b58ddb75064183de7685f
- SHA512 537ef6ae28bb765f9530bf6086de4f078daa70cdab2c18acd6aa460a5d4c94392338b515b0d14f1e4ca78d47e498b3036f43e08a39e07f56696b21b8dd4d4444
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyvP:A3kMjKx56rJ
- TLSH T1E1258C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 959KB
- SHA256 dde0beffc377c8886a0a3a98927fcae926782f507e9181cd17fb9b22b4ac5d21
- MD5 8f1dcde9fd6db46e64a59392c40af56e
- SHA1 7d46e6a74565a570e7e953fba06d687a9e1b8692
- SHA512 59f187a973ecb10f9fdd3f2da13c31412469f6d89250fb2a9d62b7fa2e4507c330481d412be1d97f624f81b7f2c742b80b9e92638076782bb402fc6e95af8ef0
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyc0:A3kMjKx56rG0
- TLSH T116258C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 965KB
- SHA256 84fe0e37deb7e28f723b74ab0dce79b177b1f3a3d0f3843afb5f932a092f6bbc
- MD5 09658ccff45343f0d5b55e6f38be1a9b
- SHA1 37483c2a6c4635514bc4c995290a24a61b141924
- SHA512 23b82fc60401b1b8be72da50ce9041157e74fe17c440d522931cbccbb61e4dbc39a80723b8fb721c701e569e5125f85c84f53da1e855e91abce98be420609030
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy4fj:A3kMjKx56rcj
- TLSH T14F258D03A7940FA5D11F823499A14662EB77BC525F2087DF1354AE263F727C0AE3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 b18dbe574d05eab928d1e9a2e2e2c2dfebc62d134d6184ac2ecd67bb3459da0a
- MD5 cdbfc6d3cf5b0b291a2774c0405a9bd3
- SHA1 a41546da2205753dbaff38b2260c2e4651aebd14
- SHA512 1c5164d44c15d6289f0570c64920af2f02219e25e17a50500a0d29c751337c3f63b745e4a81f2b0b0f4b94812c7b9924d6ec6ef28f2765dd7337be0e7abd518a
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyV0Le5ji0hmxNrM:A3kMjKx56r7Pji0Aj
- TLSH T1C1655A16F6A44BA5D06FC174C5E2965AEA733C421F3087CB13949E293F237D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 960KB
- SHA256 4c434a35107d454152872b26ad6bd9609fa45f54847f66f830e33f93f180ce3c
- MD5 d1a5f452f87be0e8480aced8f269be5b
- SHA1 4c3de4b47f330c5975a420bc9f17be230de7858f
- SHA512 10fbe527801e5ec40860b1a6a7ab589338805c276da707818df7252ed2b849987884fb96e27c9f2c75a09ccf8d341cfb5610d99c01952bc8a5ba1845f3b394d4
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0b:A3kMjKx56reb
- TLSH T14D258D03A6940FA5E12F823499A14562EB777D522F2087DF1354AE253F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 936KB
- SHA256 20da6e645a49783d88e97347d31cd04d747d4eaf1e8e54f7a81108aefddb3661
- MD5 769f9b53bd75e3f99bc2a5c64494be08
- SHA1 f423b7ad2b1c6270bcf66c579b05e7f5ef127e24
- SHA512 01675892dac26db249efaf6a66c61152041a2c56a94521259d0f7304b4d5e1814f57929cc29bdad7cf0b38be6ee2f2e566af0cd80f8cde3b4cffa4f7b0a82a6e
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmybf:A3kMjKx56rR
- TLSH T14E158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 936KB
- SHA256 f48628a4e0e66f50682ed362559879b2de8dc374d3ed54f363abd4e16e179aca
- MD5 e950e7770b87f5dfd6924cd9b034fb68
- SHA1 4fdb93102d58f96602c803dddb7655931f4e9250
- SHA512 0c28b516ff8d3ea5c41f3923e43586e271888ea674e75db091be07cf54578bede14a241a1be919e69e9a4ef25e87f3a314527ff31d7695ff950f9e00b787d735
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0K:A3kMjKx56rp
- TLSH T1F0158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 936KB
- SHA256 0a1214c2f024eba4e812c4b923e5886014637cae68e223e41af84537d8c98be3
- MD5 f27ceeeec6dca7b4a9a47d46554d1f44
- SHA1 c072a673e70f92ff940e6c637181b3c740c665e2
- SHA512 3e1dcdea7ff481836d412f32c997041ddb1d7b1e90e415b374866bc743ee703b9963e161e86650c6bac7265e5d3b7aff971c88623acfa7f7f6bc2810e90a9a35
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmypk:A3kMjKx56rg
- TLSH T15E158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 936KB
- SHA256 8bb88e5ffa34d05e5f1f56752d0a7ea9bdba44488437c2f66b87929e8b0502df
- MD5 87cd88ab08ab5d303ba14865f7f946a3
- SHA1 6174dd2b6d3033f656a6883e0a7ac9a8a53d8e21
- SHA512 c3845fc5e964c088550d6fa1cd3e3afd286c5a0a3ccaa7f483be515cc1329d37d1fd6b38f87a53b9179f6bec92f91be8d8d7d560458edbe316cb3508c4ead044
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyG0:A3kMjKx56rp
- TLSH T1C4158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 936KB
- SHA256 e2502ea3e2ed40a0141289073491b8a7aadff8d31444244a746447af527da905
- MD5 d2d5121c374d552e1db6d2a2751cd7f5
- SHA1 356f4d89bb62b19299f976dc3936376ac2756f87
- SHA512 9fbbafd856488ad5f4251ef18b54a577b25208831615e7437075a1a650ef065989dd3537ff58dcff285724e4e114309b136a253253ab2ba4d4cd50a834192523
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyVg:A3kMjKx56r4
- TLSH T1D0158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 936KB
- SHA256 b879ab2de7a5f84e3bb4e5618dccf70c5b5313e125ba7c3e4d093ad198625b68
- MD5 bece8decd095da59ad571866f8c6020d
- SHA1 619834b42ba1a1f5271801369b9361c00f6de311
- SHA512 8fbaf56bae4abff9ca3f53a71927394caac8306b64d952e0246ebfe2aab80096081aedef0a83ea6c16022ce526837f8486fb7037707ad409b5dfad16596f01e1
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmykr:A3kMjKx56ri
- TLSH T13C157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 936KB
- SHA256 943a877eeaa9733fcf924463f958f56cb470fa0743511ca32df7b80ffaa9ccb0
- MD5 7e31594f73fb6341cd720617d8656fc9
- SHA1 60395220d896fd6f8fb631aa890cfba884ec9a78
- SHA512 fd54a1e6a5517eb9fb2ad5f41097d48f6f79589e1ccca5f7df6b7974579367d7af6241e3cef91d66cd82ee9b5cbbc9b20505218736378037cb0184e0c50dad7f
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy6n:A3kMjKx56r0
- TLSH T1E1157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 936KB
- SHA256 1169420fab57060c6331ded6f673d4e4fdb3cb1700f3efefd111c6ae3387d499
- MD5 a77c8f8e4744e950700c821d53cb7c3d
- SHA1 65b42453cfa03aab05b7d1191f50576f53aad8ff
- SHA512 7fc3fd172a458e4f8b9a549a7b44d8d15e66183c41f87b13d40c41e211130549bcab9d464bc8e402d561bb52f7dc0f1c4553031606560f4136294c2beede1ac9
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyQx:A3kMjKx56ry
- TLSH T103157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 936KB
- SHA256 c6bea8f6d5e7ac9cbcaa4dc9cba934c4d9eaeabe737cb8f1b0a7f282d76f3415
- MD5 e19c5efd86bb2d31aee8ab2826b2acbb
- SHA1 23aeb154f71c6947b14f7e9caa11efc15f4e0f87
- SHA512 b639995e6498c1f5a287010dc9c7f5fc7b62377c085035a71c4755877e07521f333a28740ebbd62d56ae87d3eee5439bd253c6377d8f804b71c0cebcc9bc7df8
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmySA:A3kMjKx56rR
- TLSH T15C158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 936KB
- SHA256 2015f2ade14117e493b0f8351ad706011644424ddd1fa764985b7ecad512a084
- MD5 b6a59e479c15c562f4f561fd9efdca00
- SHA1 dcca4080be2171d2efcf0f49f5e911c2f70e9173
- SHA512 cefec39e25ee90f8b8323a61a89db50d2845d41dd355f985b61587758321a3a782e94e26695de323bd5456b85bc2d2a5fbd8948ec250c0769ae7a15bf69476f3
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmyr9Q:A3kMjKx56ro
- TLSH T1AE158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 936KB
- SHA256 d7d01ce5cddd1da19374e8d85bd7145d25e8f64663439ce8f7d584633b243911
- MD5 a0a121db65952cdf376c56a90ebf511f
- SHA1 8095dfd7f08136e4f90303807d1f58bcd24e4c11
- SHA512 64f2bdc9dd5dc451d021849c8ed0c32d6f5c071c76c1ff94d0397f61e3802f296069eaf950a6933144d8788a3af425995dcc4907373a332ac725515a72a837a1
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmya4:A3kMjKx56rT
- TLSH T1A9158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 936KB
- SHA256 29fbec5340428da6f0197b4bb439fd28d240a659e7beb92ccb76f425cb3005c8
- MD5 5cdc13d1e64a695f77c47163a0fd2456
- SHA1 76d85e22f0ee4817ea7c5a4264f7a090258b32b3
- SHA512 8142d9dacc1494744cbeb7410cc0cf3ad25500123b84d0483d591c1875f761191242981fe5ad142a46571310199b17946e6f6fd910151a2857349c2a8bf62f44
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyBu:A3kMjKx56r2
- TLSH T1E8158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 936KB
- SHA256 4de9511a32c2d81f8a92fedf6346a466ac7cfbae7e8adacd0de6049cf1d67609
- MD5 5b19f1e209bb5f2ef15bde70cf7f5c07
- SHA1 23a4413859e85f0ecef175a1cf84fa41673b5e1a
- SHA512 614f4bfd4fc9e852c8508a00836a1fd2ebc970c799b0d44b5ca43f5da9446f0f6e31ec1c85aa75b35ef672ef7434007d23e29fbb2c15bc78077d3f963ce27076
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0j:A3kMjKx56rI
- TLSH T1DF157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 936KB
- SHA256 4fdbe6b551169e5be1abcea0100585b939197760e1139743e554ad965d061730
- MD5 a090e62f6a1aa84b45cef4e9c472a4be
- SHA1 aaa6afebdb48a6c9a5abb9233db8dd0bc6a272f2
- SHA512 ff2feae42b88660abe564d71a31208e468ded8cbf3162d45147266fb46d5dde451d366d8a91c880790497936022103621e1d338660ee9c19a647355e2e23d023
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy1g:A3kMjKx56rQ
- TLSH T1B9157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 936KB
- SHA256 9936f9bf8d3f5fbf4aa631129efb0934f12c0e96ed88eb59b363cc75b0228947
- MD5 09634026a373b48366e9655fa224f62a
- SHA1 980ad39d1602a5a9625bd1f3ab59da96204b2da9
- SHA512 ba2c2a0a73f21a59d3ba38f833aca92b59fd8e73ccd1b070d61f1e897948ce9b18cd985e87df2182ddfd4c7c04041edf7d222121078a31160089a4beec0ead84
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy0I:A3kMjKx56rx
- TLSH T1F6158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 936KB
- SHA256 7a5cbadd6bb6cf94a3c79953b67cf2b2a4253cd928c7694771d1659725cc0034
- MD5 5d6162d29e86e5aad02b7bd20246acff
- SHA1 4816cdaa320184428355328433a668bb7bc4f403
- SHA512 340fb9f4bc5fe04e0fb806015b30aeeddbd2d607c621c2444d024159442cc64e1b38fe7d485f1fe5b5219f74326f5761563540e202ef7678903247ff819c4a8d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmymo:A3kMjKx56rP
- TLSH T1ED158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 936KB
- SHA256 c6628b6c23398b8bf4f46cefcd8c89ee3fa418f5b000f61db41d9cb5c22eea51
- MD5 6f8fdd303520bb33a745b533b8020d25
- SHA1 01a89709b5fd856ec51e977788522adbb50280c2
- SHA512 0f6395b75989633a19b9b5f1757bbf711ad364f111514ac386aefd7cafe4c8cadb241a8488f0f6c965ff17e3a497644f6d6fc0574406f33304eb2b4f023458ee
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyN+:A3kMjKx56r6
- TLSH T10B158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 936KB
- SHA256 4ab295461a7e35f307cf3c07bf1c6cb30a59dff644933924136f9fa16793b884
- MD5 4cf664098f9a2ed9cc1d18cae0cbdc93
- SHA1 cbb26011b0e187cb3266a5f4b4533470e440e40d
- SHA512 274dad5e248df349c3e813012ab553210106581ea30224d562d85db3681ccb09185ce3e0dba0be2adcd481b60b07ff0a6709de59f7c3b0310bd864554deef09d
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5Tvinrmy7Q:A3kMjKx56r+
- TLSH T128157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 936KB
- SHA256 46b5082c63e2312f75845b50e9d16a21a035a94c98cd3a428634a3c07ccb8d7f
- MD5 cd546f8a0104167448a14e41ce442ea6
- SHA1 bf9681462ae6f22d2c3ca91ed70708287bc02638
- SHA512 2173bd6efc52e59e33015b9c1ee371706b7fd8b60ffbc6ca6a7b13d05c9e81019e3b672a59d9df83e14f108276b6e2911995be6f67b37fc66603181829202353
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmywX:A3kMjKx56re
- TLSH T1D9158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 936KB
- SHA256 994087ac2884ced1a277e6d87b26b81aaa754f4fb19e05a26b861b6587d625a0
- MD5 b47e1cd49aefba02d0583ef442ec50eb
- SHA1 80ff10f26a8c99d9eb73f4ccc2d59df8481d4993
- SHA512 4a32948e576cecf36712972af58ecbefe80825e0654f068457a076663012f588c44eb5031438d97fbca6c26f3d3ec0ea2afad54f9ea86895f3d56d6d87b640e9
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyGL:A3kMjKx56rw
- TLSH T119157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 936KB
- SHA256 c9ab63f939720bc08714c2022385b9fef0f35759ce461404bbda0b3ddb2b60af
- MD5 81d0a350df4abfa5033749128ca8dca0
- SHA1 008cd4d377f3940ceb363ffd3f2f3b3fde3f324a
- SHA512 aaa802359fdc778ac9d3dfa7755e7739cb228a7d312beaa5701fed992d9ed0d59bdcd8d319fd306a299ceec1d0b3bcc6d4d650d14b3cdc841f56e587776fa4e2
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyaM:A3kMjKx56rh
- TLSH T16D158C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 936KB
- SHA256 d1f164a3ac63e92428242d6508f6c14b512d2212c1041e318264f0a8e136e121
- MD5 1b771a3560d16779fe0b214d3e59ddc4
- SHA1 67ef7917d8f971206f0a0c3162042ead822c4ee3
- SHA512 93c6487106f69e28708a464dd1b8aca55a101975f5bfa20118c483be799d72325893e043eca7d0d69e2f0f179eaf338e7628a042b5136d5db96be4afcc558651
- SSDEEP 24576:A3mnXoZjzyaEFyKUJqoNaCb2zD5TvinrmyLh:A3kMjKx56rz
- TLSH T102157C03A6940FA5E12F823499A14662EB777C525F2087DF1354AE253F327C0AF3A767
- MD5 SHA1 SHA512 SSDEEP TLSH