Analysis
- max time kernel
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 17:14
Behavioral task
behavioral1
Sample
2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 832KB
- Sample260629-vrydnab16n
- SHA256 96624029a16e87accea536a42113737d1572929f01d4a6e12068079ddad2d3dc
- MD5 2deb29d06bde2d6834ee6b121da89ec9
- SHA1 f42d9f2cb1ed78e13ba09e828d163b67d9ac4576
- SHA512 faa89ac96455462d025ed4f19c9923e58734680078ae854f8200c15ae5bc532bb3b0c34dd888ccbc92242711a0f3ee1d2d22002923e2d01f6fee7cb7cd8888d6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmC:A3kMd56rX
- TLSH T17C058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 52 IoCs
resource yara_rule behavioral2/memory/464-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c45e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/464-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4916-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e4-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c73-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001896e-198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a09-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a15-212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4b-231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-286.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-305.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-362.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-413.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-465.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-467.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-468.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-521.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-558.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-656.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-767.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-817.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-962.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-981.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ab39-1080.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac3a-1245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d62-1367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d6b-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066ad-1883.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c45e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b7-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e4-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c73-60.dat aspack_v212_v242 behavioral2/files/0x000400000001896e-198.dat aspack_v212_v242 behavioral2/files/0x0004000000018a09-211.dat aspack_v212_v242 behavioral2/files/0x0004000000018a15-212.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4b-231.dat aspack_v212_v242 behavioral2/files/0x000400000001983a-250.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-251.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-252.dat aspack_v212_v242 behavioral2/files/0x0004000000018a48-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-286.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-305.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-324.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-343.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-362.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-375.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-394.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-413.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-426.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-445.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-465.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-467.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-468.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-493.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-502.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-521.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-558.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-631.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-656.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-767.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-817.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-885.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-937.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-962.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-981.dat aspack_v212_v242 behavioral2/files/0x000300000001ab39-1080.dat aspack_v212_v242 behavioral2/files/0x000700000001ac3a-1245.dat aspack_v212_v242 behavioral2/files/0x0003000000019d62-1367.dat aspack_v212_v242 behavioral2/files/0x0003000000019d6b-1400.dat aspack_v212_v242 behavioral2/files/0x00020000000066ad-1883.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4916 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{61D7035B-BA7D-40D0-A332-CBE11E8DDAF4}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 464 2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4916 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_2deb29d06bde2d6834ee6b121da89ec9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:464
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4916
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 832KB
- SHA256 96624029a16e87accea536a42113737d1572929f01d4a6e12068079ddad2d3dc
- MD5 2deb29d06bde2d6834ee6b121da89ec9
- SHA1 f42d9f2cb1ed78e13ba09e828d163b67d9ac4576
- SHA512 faa89ac96455462d025ed4f19c9923e58734680078ae854f8200c15ae5bc532bb3b0c34dd888ccbc92242711a0f3ee1d2d22002923e2d01f6fee7cb7cd8888d6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmC:A3kMd56rX
- TLSH T17C058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 930KB
- SHA256 af5129c8c13069a195461d3bebd9179063492bf29b74e364564ff829ea2308f2
- MD5 5acf5efc64be5e902a14265cec326843
- SHA1 3381e7ac2367ca6bee7565124037ed49cdff56de
- SHA512 4941c283a3d7a476cf5206ec225c6c2024c5986a3170a7e22f2d41ced5caed63b0b481f37c1d54caed1a8edd3a696437dc1d9ad60441e5664ac0fcfb52e06961
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmR2MqDBxc:A3kMd56rnMqlxc
- TLSH T16C158D03A6940FE5D12F813499A54A62EB777C125F2087DF2354AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 d156c7a6d072fff692bb871ce906f9568f19e9373e016b8864785c68c7a1e953
- MD5 c77ebbcc94fa87980bae928724fd8b61
- SHA1 86a02180bfd309d1b3094e5df89aab2373d08888
- SHA512 dee196004d1b849626551f89d3739db9e60f8bbb16fd38235b393e1a662d8518dd490dccd8334c18626a739e5d3d56086ae5be43a4f5e4e875ea7f7d36c8790c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmC0Le5ji0hmxNrM:A3kMd56rTPji0Aj
- TLSH T1C8655A16F6A44BB5D02BC078C5D2569AEA733C425F308BCB13549E283F277D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 846KB
- SHA256 de95ecac10e6f2775d1a38cb3e4b736f53635f84a6e7773d41b51d99828da364
- MD5 aef233b7be57a0debb3cbe53fc4134d2
- SHA1 33800f1f373807768d5cbf31dc9a4aa349c60412
- SHA512 509699fc6bb9dcb929fcc5bf566a4b2f109362b4c48aff9fe7616b33069f3746d5cc859944b2234367a9340ee0767fc199c523173b104ae8a1d468e007108b4f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmMa:A3kMd56r
- TLSH T12C058C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 880KB
- SHA256 8cbad3ac2eec19a63074469a91bd559169085efa518af83d4fe7e6f6946cfb1d
- MD5 22542da117cb977dabcc976e081753da
- SHA1 6171143b1cee6a425b7c417c584c1119194b95cb
- SHA512 13b46f62fe57e382921a5d496f44795aeff2a309f4b1e4053d9ea3cb9a2fdff0f298d219e22b8eb4f35429503b6efb4bd6ecfa62009b65ff423ccf8d00b80444
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmnb:A3kMd56rWb
- TLSH T143157C03A6940FE5E11F823499A54662EB777C125F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 876KB
- SHA256 0eed6e79959891c580ea02132a3da8794df1cfe7dabc3f2dc1876bcc3243f383
- MD5 c1241c3d34d5ab19494ad6156f49cb43
- SHA1 9c064f97dfdcf5fe7eb0c7129802f6a17484dfc9
- SHA512 77b970577fbf103f9d6cea45bd5379c24711339d5e234d0283672e4f117270f42b3370bc7adf2052d3f7fc923f3467d7db57ea95c6b2b3877a0a2c6317173f69
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm9:A3kMd56rK
- TLSH T155157C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 856KB
- SHA256 788fc469a6c7f3f9233ef19213f18212e6ed6b06a170896a190c9edc5c49e179
- MD5 08010731276124e7cfe8ff4fee807b11
- SHA1 cae02406f43eb606ef0c3ef89abc5dcc4490d377
- SHA512 ac2d904eccf5f77acfe8df75cc6c44c58f31b03fb34ea6191309813b821c1c48c4b47607db015b3db83e33d42d203041a80369141d0c6db00b9051e81ebb623a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmGZ:A3kMd56rH
- TLSH T154158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 856KB
- SHA256 be651afbcd54a10a8bae04e9390361384a07d20a47e301d8e817552e72e7515f
- MD5 a3da244a9d946f81ad02286996a9f2e0
- SHA1 48ae76fce496c02dbe29552d3d67fa30b932e7bb
- SHA512 e5ac0e69bdeb858e24c4ca53e42866fc86b4f1ea101c55e51c374f66c07be7ccb5dfc5c21d1403314eec08eacd66138db88dfbbb703ad4aeff411679cf679546
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmx1:A3kMd56rA
- TLSH T136158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 856KB
- SHA256 0f70c6c8a5e97b8a1ad938c53dabb12bf1630b9a35a61b2d7d39d23baa643bf8
- MD5 e47320470d1e185220eab9eaddfe13a0
- SHA1 697357483c399ff5ad31f500fb09632fe05a5422
- SHA512 8956c28556c019cf69e95117a75cffb4b7dc42a1ded9230b999f73a9ead3bfb6cebc7d7f92262a6f58e1ca1cd5a942136fbe1f86a1a234f65c7174fdfb5ce471
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrml6:A3kMd56r7
- TLSH T1FC158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 856KB
- SHA256 b27cc143266784e072ae43f86b8931790ebe75c0bae3553ad05bf13f32292ef3
- MD5 4eb026bc2b7716190cf5e04a6bbb0370
- SHA1 78cf37e5afeb325c3d32ff4169e247bbcce51052
- SHA512 8adb2bdf7cf5fea977b36cc301bf91b210f3552ca80491f404f6c49b918eb1665dff63dc8fb57415a10bc6d25009a95e259a335987376097166577f9e1d37c8f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm7N:A3kMd56rm
- TLSH T1E3158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 856KB
- SHA256 ebd09db2b499b858bcbe22e1536a187fcd54427868c062434bcf08264db2ff0c
- MD5 6a91a09fb23f868ab1eecafed43b515b
- SHA1 54dc980f29eaa868947ecdcd31c04483543d2468
- SHA512 723f2678ba0a94bbe451c093b5cfdafdb4cfd4baccb415b6574d04d8e6a3a9d3bbdc1dadc654869f30dbd0d28cd9e34b1f5805f5a795e44f7f91dca4db959373
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmZf:A3kMd56ra
- TLSH T166158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 856KB
- SHA256 315fee260f9eaac6887e4c5d98eaff01b7a3cfa3e82b70764450b0e79a71cfef
- MD5 31d613e99879c137dca178488124be15
- SHA1 26c4910fac33af0a7f688cc15241514a70a2a937
- SHA512 6b87396450f3959bb1657da14204da96b18a4fa051f3299eef0b0a9e8173bb5d9fae81b7b4779fe4e74004ff6a7473c670b8caefa6a8c7254cdbc5cb295df9a1
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmbo:A3kMd56rj
- TLSH T104158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 856KB
- SHA256 bdf32122cdb7c0a5f4e912d277f960be31d4b852ad040021190aca498544748c
- MD5 f63ecdf65eef88566cb2ad789d8fc2e5
- SHA1 2b2f8cbd164d8f17ce06dab7a24e2cb4d2058947
- SHA512 058070c03447d22c75dd948454dc4b95cb4bb9ed39f58fc894fad1ba9fd799d597d63ca8d9bcff96f0d78c207216bcc43f0528c77f1dfe24aa2bcbeda1f3a3f6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmPu:A3kMd56r1
- TLSH T110158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 856KB
- SHA256 1fded4e03a7d541d71caad73728ba1bb6535bc7f7e3106dc5d6cd5830c0db5b9
- MD5 6c7f1b70be78e2ad37e0a5607f5c98c3
- SHA1 2fcdd6ea00244393697ac9803aabbc1b3f2ff12a
- SHA512 987ec90d345dc825f5be0a7ce6b9580dd0a54e8974a61d0792954a04e583ddce0f5075b6ed73b2b61ec088adfd715c6da7b5363f6f094aea889cf55c6c802dd9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmd9:A3kMd56rA
- TLSH T16E158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 856KB
- SHA256 af2e6040d246c71b7500fcb06465abc28c1155a3a9ffc79ea706c60c9ef156fc
- MD5 161094c25d92631190d7f7ae4f9a43b9
- SHA1 9b695bdcbde2bfce9947bec80e57a394eddb3229
- SHA512 717aae71f92e7ac814aeab13e1de3d67a2446ab310c37c9823fb7b8231e2948d5174177649d15a4178b363d54e316c74eb9f39d2f18967a6329bf7196a49b954
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm5c:A3kMd56rx
- TLSH T114158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 856KB
- SHA256 31e277f8b73e4b5d1155505af944125e744aaadd223d718b656d2f47da6c5f35
- MD5 319295d465a5c5e9ecea036049b9c73a
- SHA1 0f728d1f2ebb2edfddb52bd200ee403843375c6a
- SHA512 84c6f50cfad9f592051077160901e43ebc421ad37a44536c0f8dea5f1b865e6e4ae6326c9edef68a8a0f6c9442b0e6ba33383504a15ac99938aea298427566b9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmyp:A3kMd56rP
- TLSH T131158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 856KB
- SHA256 f09a2713d20e9d44fb2302e31370b61144fcecf33570f68b8534164dff137178
- MD5 2130d1f0568c5945ba04ae9b4c5afa8c
- SHA1 f58277d3aad528e8706f898ec14b8a4ca8472f89
- SHA512 843901cb73631328dfd17992f9019991fb51020d9cb8f4e28e208ad0ed4b26e045e7a4f9d0d0b192c4c469a3916924a3467ad6977d707ea60d47276f0f7f9b7e
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmFN:A3kMd56rE
- TLSH T1BB158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 856KB
- SHA256 ba1fe8dc0805e34bff119586905a57a2498cc19257dbce0e8077ccc3b30b18a8
- MD5 3bb5ca5d5ee659a2e26256f79c069fb4
- SHA1 ed5a70b2b84d523748cf8827f0168afde5c78340
- SHA512 e701036efe10ad42b48ff0b474912567c7248db66e2487bb46f686eade5da9156a14bcbf204f3d11cfed3ed4f69f82a10d2ba3fb9204396bb7f3db32aa63e8d1
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmXF:A3kMd56ry
- TLSH T151158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 856KB
- SHA256 3ba121e0410504019690c3c930db6a768609f4ea1b2d78aea2d30e18fce03be5
- MD5 accd8c4e4c5243877d456da1d08a02bf
- SHA1 25ae20e8b3edf007fea9ae4f2be6de9cfeea2d6a
- SHA512 91c607ea6d7f6fb79b2868360e8ca4b99ebaf499456ac3e5c2c08d48b58d80e700c5985d8aeffac19ca01799916abc6003250fe6c70e0094967f63a344bf3090
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmoC:A3kMd56rG
- TLSH T158158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 856KB
- SHA256 c546b650d8bf2aa3056d0e18acc7bf45dedbe0fccf8b5054228bf23677534b85
- MD5 2cb7bef8c4c076eb6a621d020d24ea12
- SHA1 4376d6bce57cdda468494fb3709c3102cd481067
- SHA512 a0c9e39b1d96cfe16249f8e46c6f79442c7a54a9bd4e7393baa123b47d3280619abe515385facf1539f56d2dfd26366505f1eb1104f3a7fcf1e767fe1204c8c8
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm7w:A3kMd56rz
- TLSH T18F158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 856KB
- SHA256 9a9071d2c3d1062027849b81d82bcc66cb9c27f86c109e41fb8d5f1fedeaf1c2
- MD5 fbd621f9efe424f6d70456457eca5a93
- SHA1 7e8b8e9b04ab3feee560ae1b7e5b54cb927f7de7
- SHA512 9d869c1dbec36f18d759ba7b1186f1189e79f844b2ea9b266e800a743e54b157b411cd5096a31f3c3142ad476df31b073d8bd7f3a74340b5b6409fdff0958126
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmCT:A3kMd56r/
- TLSH T1EB158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 856KB
- SHA256 921a0a013aa6b005f0a06dc67c022b1a562be2ac8c6177558c8b5ad3c3e22ac0
- MD5 7f1a28362c8f89ffc74fe0a4e6de7ac9
- SHA1 73bab24402ed2abf633d068ee8fc564b8f370966
- SHA512 a90e67799d081ecda5c349609b55959d56bd4af273750dc12e67f42debf35f20389455844b84c964aedfb21b50452aa3213ee5ce314c6aa89e1425c7e4f57ca6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmSu:A3kMd56rQ
- TLSH T1FB158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 856KB
- SHA256 58e835a4eb007a5070b8a2623a34f32875a881e5e7a3fa5d576987d5ff103215
- MD5 e1fea8182bd16b3204d0b223d89ad66f
- SHA1 63de737f320ebfb9c3a0715c0ad245939ca93ecc
- SHA512 848ed48a7cefb9f1ae79131ac75e877936f6f4456a516c22ecdf74d36382017e32f1878d2906f847deed9829be7f6dd2734ef5d2d837a0e24a84b60496240fff
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmMb:A3kMd56rJ
- TLSH T133158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 856KB
- SHA256 844c9e196500d7367bbb2d7923f81a1e6e0b0399433235bea8b10f90a3d25a58
- MD5 e9147d284a4f4e44374771eec1a8d060
- SHA1 6c855a4a411fd084d7c334bd11608a8af6752c18
- SHA512 85c56adc6d7ceec1deec2bc9146496b63190deba41e8c086b00efb2fb57ad13f0bb07a76d6479afdacd6b66c06b3dee84c3ec51791cd6202ed3aa99c3701daf6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmyf:A3kMd56rZ
- TLSH T146158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 856KB
- SHA256 17cca563509f0d16ba077d50a900496d233762731f0b89437fd4b9fd604f4876
- MD5 89a457563dd23012bed5615938e6df80
- SHA1 7cfc6c1cb05bc9fb46d73b73b422ddd2c79e3bab
- SHA512 346ce41977a476acbff70f63d45d88768c1aef5da44de5d764104e105610f5189af0ce8c174474a0bbadec95c0dea338b0fc783a72999e3911d2529d8ae0d54a
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmfK:A3kMd56rx
- TLSH T1BE158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 856KB
- SHA256 827caa43d32e60d067416f408117d59c7bf997237587fee86e760063e8dc89d4
- MD5 8ba9d2925d459f82b2e2d28efdcb2663
- SHA1 c1c46bdd978cfea83395224cc4d0a634d3175f50
- SHA512 20ead43690dac07684d3684f4ebb1d2566129b4cf356a843cdce0ef3790d49471c9bd88f4fbfecf2635b6df9a0e6deae824b81d2d4212e2c36db0bcb617c1dfa
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm4k:A3kMd56rY
- TLSH T19D158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 856KB
- SHA256 ea505da428265b6c3ca58149641bc1244cacc70230abf8c0e4798df011c97496
- MD5 1124ada7599525b29a5a7fc2b4035b47
- SHA1 5b2d9176125c0e27732a7bc545d7c7badae85d88
- SHA512 26dc86aeb0ee146d79aebfc80948abd27e34eed60fee58b7d03bc229693b88089b883b9a54db5767dcbf1f6461f7370d73d1eefc9f179f5885d186dfec5acaed
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm50:A3kMd56rR
- TLSH T1B9158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 856KB
- SHA256 bf14fb1bcd777866005e658598609b448f875888f346270b78af70ee327ad8c5
- MD5 02b9d0aa5bf128fec61192debe19ce05
- SHA1 512722e32084def0ccb51788a5547a53d38ab3c6
- SHA512 8ee9f8c50b6127bf892d8a3254f1d99701ced26812652080486e44b75849438312b65c39bd009c006e8f3ea76c80147df794b69c3cb6a5d21609609e19ef135e
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmsg:A3kMd56rw
- TLSH T1FF157C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 856KB
- SHA256 992796ad86b656ae7561288902dad03015b6a05d3531ad5a10a31512c78126b4
- MD5 4d92513ce85b6caabecf7c27d5b43e9b
- SHA1 c5dfe1991ebdd3998642e1c66967cb924d1bbab3
- SHA512 bcfb0678576f89180ca951a692e0299c13c345f93b0b965242c0f4becc634ba8397937ca0d4915faface4daabecdced2a1daeeeb38f3f207eb7a51d9f01e5c22
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmJr:A3kMd56r6
- TLSH T1F1157C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 856KB
- SHA256 857ba14574d01c0700119ef54479f71283438e38516910362b1ccffe427d68c5
- MD5 58febaa742cd4e85f6bac2f6f0ef1f80
- SHA1 d955f4746ce95a887a889686687cd1076e7dad18
- SHA512 ec38626815eeebd8a4c8041508682cb8f6e8dc82104b7d8f94d1aaf7ab712986a7202a27e274041f77f209043fd2991cbbaebc5b70895a50cc42cc032307aa0f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmrn:A3kMd56rc
- TLSH T18B158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 856KB
- SHA256 7fedda0d5d0b4fdcbd5f3f108b015200d14ab4b3d29414b24f653a32f880c43b
- MD5 337273c728affe52b73d365955f8d2ab
- SHA1 d8cf967966c69aecf87367116e652f31765dcca0
- SHA512 4eb159ffed6a2b80a7b02bc6a0fa11c25a81f49927d95de56061ae4d10c7123d47092fc9c51c14d86ffc7a65822d317278e8f75d8e3ebd70935be8cc54995679
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm3x:A3kMd56rK
- TLSH T1DF158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 856KB
- SHA256 071545dc65121cbfb72fdca115a3df69d8f1afff9fa7e0871f453ea545f8b1cd
- MD5 7b326a6d491ad8a8c10aa7321c7889ec
- SHA1 7814eb251c71bb10891540cadb7a99db32d1bc56
- SHA512 e326a6f1ae694c97c8d42be476c3473743e623fbf27731befad778770137d59a81a1b9d0e58d887e0b669789ebb187c58713cc0c41b5a9ebea3b6887683f7556
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmtA:A3kMd56rJ
- TLSH T16E157C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 856KB
- SHA256 47ff5a43bef56b5c047b85bb146d898cc0b1f0e601195556b56a6e5dc1d6d6b7
- MD5 81b2d8de429191b1c81e94f6d31dc5fa
- SHA1 d199384d2d8fe4ca8a3ceed905c875667403cae1
- SHA512 1f1b9bf59509404d5cff7a54a23b9df250880db1242346935bcb08110d0737767a24f1b37fd42ae6c406705f0c962fe87dcdd19fbfa5069231fcf7ff71df1797
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmm9Q:A3kMd56rQ
- TLSH T149158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 856KB
- SHA256 43e935305c134dd4496897fc10056e63e05dddf461f380f2b42f96b304d55718
- MD5 ba066ba790ba1e0ffc70e94643bc8a61
- SHA1 041e59b8f15d972b68c1ccc8609504e4bab49c4d
- SHA512 2dfea3053500459a683050c717b7cedb9fb8c8e9b72a9e8a71f77dcb503df541611ce39721f0506dfdc0ea5f39e33499aa7983e591a97378918a01f1f3cbed36
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmD4:A3kMd56rL
- TLSH T146158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 856KB
- SHA256 9bf175fdd851603ca4e1386f043b85365ca3c42a6ff7d74e83e268e935cfbbda
- MD5 4eebc7a9243d6676b774dca7423be16f
- SHA1 a84005b0650c52ecf4d2f3f41fd4525205a30c40
- SHA512 7fede6b9ed870d5f4cb7f6f0d19b7938c3026d31da26ba560f34e8e7e132cb456b4decf739509e83701c807b1f1620071084726d9bd296acab7d8500d013c6b4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmqu:A3kMd56r+
- TLSH T1A1158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 856KB
- SHA256 ec4ee7932202160cf58b3e9ddbba09bfd06e35f93a0721cd931296693e7dd67f
- MD5 d63e0db528cb8dbb4611f1aadbbcf38a
- SHA1 6662839a7c3ef0d87aeccdc63f1088fba8fc48e7
- SHA512 c9aa71143ef3e212adb442b0a0da597f37fa0302cdf5bf2a0789b99611539811cc61f1c8d68538419a1674807ae913b4e8cd2d3a2599c67f66a45d1d39388626
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm7j:A3kMd56rw
- TLSH T12E158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 856KB
- SHA256 d1ceea12ff14f86dac10c663cd1342d5a31ed8f42638ff1a6e1b477e48f37910
- MD5 9afd0ba0bbfa87c96ec13510f3cbcb5e
- SHA1 bd1bb6066d7494a939c13202cfe5252849f303c4
- SHA512 db639b541083c47a348b2567248524ad5624522862aa18a55bc8bc866ae2e49a6e3d046fbad8e14fd5f17fb9673b9fde55a2368f12b4354d66fb2bb0538c508b
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmGg:A3kMd56rI
- TLSH T195157C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 856KB
- SHA256 7636b4b3db8f639dd826ac05b2ebc1433177124b1121cc636f1df1e35c883b3c
- MD5 2c0c5c0cdbea5d916c41b29340711fc5
- SHA1 128f2be5d6bdc354332012289349d8d2b54b7b2a
- SHA512 0957ba355042bdcb807993c9e49ad747f49c8c10a7a21ee22ec0a0076bcbb79491effffd5f9c74830a9603a80fa096334cfaa9a5d714d9ef2ee0a07c8b5ca5f7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmpI:A3kMd56r5
- TLSH T171158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 856KB
- SHA256 3690432c26c0467b0c4a5a2de21f3e2c0b018d57b7800c25722fd1dac4f5dc8d
- MD5 00a1d3fb5dbd1f6bc333ee1b263108e7
- SHA1 a11bb4aeb949a9729bd38fbd31e2bbd45aa16a2d
- SHA512 c60dc27973abea0e47b7210fdf0f01ffc98b1c0ebf97b498b36da410551ae7f8b4fba187735743d3d2e016ab2ee3a635100ae0eb39331cfe97154c7301ae8188
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmLo:A3kMd56rn
- TLSH T132158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 856KB
- SHA256 c879c91765249940de0f22b2cf15339f1425c0d255347f662cf0bc4d5c7a66e6
- MD5 e1fcb3b0800902af1ae1c3fcf972eadf
- SHA1 3c18e2ec666f71097343382bc51c9689387d631a
- SHA512 d51080d84b5ac12d761af1d9b52e319f76f42915036f610a339891ba080d43fca69705b5d9df51fbfc3f624ee0118aa96cbf3f9a2f34fb10f7c032318f84ad29
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmw+:A3kMd56rS
- TLSH T17E158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 856KB
- SHA256 a8346f8197d48fab7ef14758dd00b169252422da4781db501eadd5a981fb6d0b
- MD5 976d12e4389d44100099fe3808f41f24
- SHA1 938490117bec36241603e6392f76eb0c222f4864
- SHA512 fc7b45ee704b1f8909c1a92c1d09c6da1a10d5dce881cefae42a76c8078daf08cf98ab7f396f0890aac2c2bfc7159c2ea546f14dc9739f6d6be821ab2b910438
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmIQ:A3kMd56rG
- TLSH T114158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 856KB
- SHA256 87039313db2a7e36c1357a5797ac1ecf29c3a8ae5293cc0c05dccfbb461d40a7
- MD5 75138a53adf9e52e72666a60d27edc2b
- SHA1 c70fa36abc7dd41ad2336f7e972e8f8546c20793
- SHA512 1d9973fbff85d42b552ab88e8e57cd80509aa07eb71cf805ba25eb8fc915c9864a2803f0ea6497d0c5a9b0a36d05514de75adf2a97019dbd0bcdc36f43290bb6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmBX:A3kMd56rm
- TLSH T1FA158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 856KB
- SHA256 892c3373158f9d48568f78bdcb81adfb6bf3bbeff29e68a5742ff4ce6729cb2b
- MD5 1be313a30aa016991b357e2f84028097
- SHA1 f773a737fbd85ec4915a2e7057a2eb2053e8428f
- SHA512 af8d54b9968fd5617411eee9a9dc34672e8b81f7c0f48a58838fc51d4525bd9136aa7c2f96bc60b3b8982ac4cb7940f64ecb26e1475bc3437b92e041964740ef
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm7L:A3kMd56ro
- TLSH T1E0158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 856KB
- SHA256 1e343bb4f8cebb31ad17e7441a418fb29309da1b4a3d877746a92ede80c811a4
- MD5 6904f26c0f46c0eca91975583c2ed766
- SHA1 a6e120f6eab235522b60d3f4b13c1055512e6af6
- SHA512 a873069804dd609bb099c56af0ac22bdd5400bef1222700fadd4f19f71b0e593a17819e1221167511384ea90483f22407ecd33735d9a08a800f2733c2e004c0f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmBM:A3kMd56rp
- TLSH T150158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 856KB
- SHA256 67a30a20b090c77d7ead1227aed1bcbb7f8cc345804cb6c86749bec4e3641d21
- MD5 4c9efaa8192f0e02e002db15d5527955
- SHA1 74ecd6e4393a187dd1d44c31a4e37b48b8ee0458
- SHA512 9c7f2b57cf645d66e9fc96bda119976ccd1a7cc891f91c76f46bd3d800cadacce2ba92305ca7898173444786272586d8a1f2755805ac20155707e9df1497d8a1
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmqh:A3kMd56rb
- TLSH T1AD157C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 876KB
- SHA256 dc885b380883e317ff9d9132c2fd96632374c7e35a1f99775831f3ea39ccbb2d
- MD5 2b0466eb6316ced534f436432b473a30
- SHA1 4cbe6981a07d3f29283b6f320376bc54a39549ba
- SHA512 8a9a7e2c81d0682f679eeea97c7c92849eb4d74cba6b359d57d92ead24a75aa65d0758a9260eb32eed835f26cca8d8c7cfe7d035b4bca3c7a005346376b507ed
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmLwE:A3kMd56r0
- TLSH T12A158C07A6940FE5D11F813499A24A62EB737C125F6087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 887KB
- SHA256 07c8ff0cfe4d6e454ce76c709f59b85855cffb70ae8e5f9325b2fda66d7b1437
- MD5 7353ece7984e1d89fdb26db3720998fe
- SHA1 90bd2b37c79a871627ead9f04c3ec0e6a773ce1f
- SHA512 6d2dd1637b8b0fc74a066a1efd58e6a5b35d23c37e0b4783555c71c86023d116dfded624f765f9bf0492d4a5d1ef3031ca3b411d9c1793b6464c948492e49c90
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrm42+:A3kMd56rA+
- TLSH T12C158C03A6940FE5D11F817499A64A62EB737C125F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 893KB
- SHA256 b6e7dbc403cb831e21b52f4db9e69ff078ba196ac3e24d9d8be9430592a1f117
- MD5 9e5a29b68471f8bf9cafe0c386b501a6
- SHA1 53e8b715af59cf0e084051bdd2082ecb12621254
- SHA512 2a7b7a0b546d9d026d43a172a91586149183e170d97e19dc8bc970864d6610dbbf8447567623f88a490ae923a6076c2572fb1944b25b5751801e1fdb2b493123
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5Tvinrmf:A3kMd56rw
- TLSH T101154913A6940FA4D11F913095994622E773BC1A1F2087CB177CAE253F36BB07A3D66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 911KB
- SHA256 ce24f53d43acdb3c1d2660bf19b1ff030b1fa6586eb6c7998ea8686b20a455c3
- MD5 22924b74950bf8b6e326239fd019e963
- SHA1 8e555e90e00b0d402aa9fd5ce8f3db2eccebd57a
- SHA512 409061343459cff31f3515f960c4445a2507a9438a264ff1ed2a044a09fb09d7519596e232f37f74c1a8234de19cae86f703180d78d450bfd118a182e2404855
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEmqD5TvinrmgF:A3kMd56r9
- TLSH T156155A02A6940FA5D65F8130DD964A62E7777D520F208BEF1364BF253F327C0AA39663
- MD5 SHA1 SHA512 SSDEEP TLSH