Analysis
- max time kernel
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 07:27
Behavioral task
behavioral1
Sample
2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 692KB
- Sample260708-h97zlacw21
- SHA256 2da6bdc8505b720e97199f585ae2daaf9e9aef13458fb4efbecebcbb00e720d8
- MD5 9f222480d8961a56c7b3ec3563bf4c70
- SHA1 f797ba616fdfeb10fc8e5dbbda8ae5b724251db7
- SHA512 7abb1ee3aecf236ff1b7754aa5f5da104ee75e8fb5f5672355654675b67aa290ff91c14f00dc19bbc234a864a89fc9bc4d06bdbf491750a93a35fd7b6db30525
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCP:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOu
- TLSH T110E44907D69400E9D11E8134DBA54A12F7737C2217E096DB23D4E63D2F32690AEFA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/5636-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5e5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b29e-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5636-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2052-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cb-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c94-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e6-257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-562.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-605.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-679.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-847.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-939.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-958.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-989.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1191.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1357.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b319-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001ba3a-1671.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5e5-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b29e-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cb-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c94-60.dat aspack_v212_v242 behavioral2/files/0x00040000000198e6-257.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-373.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-562.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-605.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-630.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-679.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-803.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-847.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-913.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-939.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-958.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-989.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1014.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1057.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1089.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1133.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1146.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1177.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1184.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1191.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1228.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1331.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1344.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1357.dat aspack_v212_v242 behavioral2/files/0x000200000001b319-1402.dat aspack_v212_v242 behavioral2/files/0x000200000001ba3a-1671.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2052 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\RenameConnect.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5636 2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2052 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9f222480d8961a56c7b3ec3563bf4c70_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5636
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 692KB
- SHA256 2da6bdc8505b720e97199f585ae2daaf9e9aef13458fb4efbecebcbb00e720d8
- MD5 9f222480d8961a56c7b3ec3563bf4c70
- SHA1 f797ba616fdfeb10fc8e5dbbda8ae5b724251db7
- SHA512 7abb1ee3aecf236ff1b7754aa5f5da104ee75e8fb5f5672355654675b67aa290ff91c14f00dc19bbc234a864a89fc9bc4d06bdbf491750a93a35fd7b6db30525
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCP:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOu
- TLSH T110E44907D69400E9D11E8134DBA54A12F7737C2217E096DB23D4E63D2F32690AEFA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 807KB
- SHA256 c4857f3da1cb69a3330c44c97e52f610328222d9328cc916540a8cd53b507809
- MD5 2f2f8032de6244053f4cb3c1a3a563e6
- SHA1 b355eae6424bad102792d9eb7e965927778cc65b
- SHA512 a4b839fc4d43f76def8dd324e389c888a886940d99f89d6732e5763e21b77abc78baf7e36aa2c4057c90423280ef05d0305afb55549ed22c11f18a99b96153e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOCnRpAr4svndNIaUnE:A3mnXoZjzyaEFkR4ugsOCTjE
- TLSH T1FA052707E69410E9D11E8134CB954A12F773BC6217E096DB13E4E23D2F226D0AEFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.2MB
- SHA256 f490092eb8717971d9f8806afd6a96588430ba1f9e7491b9f4cd7fae0506da1d
- MD5 f3c04768339f3d52a4c5cd7e00e47bf6
- SHA1 e7efe0966669a5efafca5d9ccdfdaf820cbefd24
- SHA512 072dda765fdcf4d497399dde7686b4d1a116f9ab14efd7649b5ef7eab1dcd168b81998f54018ea58a9617283f47e20df6f6696772ba0367ca05155185621f2fb
- SSDEEP 24576:A3mnXoZjzyaEFkR4ugsOe0Le5ji0hmxNrM:A3kMhPji0Aj
- TLSH T157454916E6A442A5D02EC079C7D2965AFA73384217F086CB13D4D63C2F277D19AFA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 707KB
- SHA256 0e4184d8fecbd9a57fc8f4c2dfe9e0b11ce340e7f84a19b99a573703571ba6b1
- MD5 a398b80b6f22983a4aa7bc586a95cf3b
- SHA1 78fe97cb11122a0bb1992c61e8ec4edc91b27739
- SHA512 0ae777889f592d9a0aafa830d28ac0a7a57cab7594948a3ebbcfe79efac5ed9749851a80788381d5bd877de42503f834ca5c2c314526acdfe6924650dca9f650
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVC8:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOYa
- TLSH T150F44907D69400E9D11E8134DBA64A12F7737C2217E096DB13E4E63D2F32690AEFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 740KB
- SHA256 a9f531ef59a61640d0532fadabc07fc26ca8dae761e57c5c009389430a3488cf
- MD5 1a774124f96535d3c2d6c1f1fe731491
- SHA1 75d29589a0a9707efc4ba8020f2cf7f5b9bf809d
- SHA512 3782d80604bc75cd3380b26a5abce99b9ea2a795bc103eb3a9de0e84ff6d735045327089603651913332ad1781a8e5788554c79428f63d08acdb25786b4001f8
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCA:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOTb
- TLSH T13FF44906E69400E9D11E8234DBA54A12F7777C6217E096DF13D4E23D2F32780AEEA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 716KB
- SHA256 c7b33359898596d3598e5f777bfacc7b53494e1f716374857e2c11c2a5ac8e51
- MD5 d042e14639366ae9463bb3217e1d7db1
- SHA1 91bb2759066fea98dd6832ab7075a90d15bb5860
- SHA512 1cd4edc4783cae3b1d385c69a3deb04a6f9818073d65ed6053f0f0c4978e58c3329be35ff67eba62799981eb651f0ef1a805e315a9582c17fea545ce8dee5f8f
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCD:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOx6
- TLSH T115F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 716KB
- SHA256 a03dd5c00f65fdf061eaffce7618ab01ddadf1e2608e179f31a6d78454ab42fd
- MD5 22cfcc9686018f5917643071e6794f35
- SHA1 8b172ab0d94911074d7873819ec17e085d5ee212
- SHA512 8f7cb7e832968f8c90e215c23734d9ce990f403cd934b81fd1435e1f919caf46e9e6b6b6e2f6cc743365ca141c56964cafb0840a93b70e595490aad83f1b001f
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCo:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOJ9
- TLSH T101F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 716KB
- SHA256 295df599c24480c0e6f5108af625d171d98378364db13f8bf6cfc33f1b2ad3fb
- MD5 54a96576d99f32aad992df36f7d93b90
- SHA1 610272413c1fe9d57492af56472ca8f405fe3161
- SHA512 d035abce2df17335f474d2d6a2c8500cfd5be70b69fdeb4e0ff1269c7f118b65cebf8d3b7caffcfa594c54202ebf6cf9c02605d439978bf9a2e2639307823529
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCp:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOlc
- TLSH T1CEF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 716KB
- SHA256 eb60a322aad3cd306e4cc578c317d0a13191a34d15a166b21dd4f77a098252e0
- MD5 df6ec7b6ac4b03f9e80785275ff7973b
- SHA1 55c9141c30c0f3d6bba187f3d75c82f8b05b6915
- SHA512 2324c00d00b3d12577879e76a5bf94ad43b22c5f425128a3bb32c7a77560d271864f0134996810c02547a66bcef816f63cf7d96d59b1b043e05228164cac3873
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCH:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOep
- TLSH T1EAF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 716KB
- SHA256 afb54824b6b5689f0b9f953ec18a92eb2e02403ad660b2071bced3a4685c893e
- MD5 1f77eb5c7df3ef8db50a09ce209faa45
- SHA1 205933eb4787678a27cc813fbb8a8773cbf61be9
- SHA512 b041270c9b668abf11476393fdcb9f63fd53722a48d173b9bd351fab83c691626ee54ae5d9457d1cc7608c2a80fb6b0e0af657073fafa04a20e02ccd4f426a62
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCM:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOR0a
- TLSH T1AEF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 716KB
- SHA256 8c871951bc1e8688b8c7c1cdcf8fc4e56e94663df65ce8310789c42750ba0b80
- MD5 4b58d1f248fe4559febf972d29c95b6d
- SHA1 20ab6705d6b65bb8217ce27d8ca9507723398032
- SHA512 f7590b970d7c729372fdcc97818ad70ae3aea9cb54cc62c128a109d738fe8bc3be12bc27de0c814e84ff79f95c15f75dc3b549b191a5f75a5447cb469046c81e
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCa:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOzF
- TLSH T1CBF44907D69400E9D11E8134DBA54A12F7737C6257E096DB23D4E23D2F32780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 716KB
- SHA256 fc0296bea762ffce7403a1a41046987a7c35e49b078949184dcd546cf83cecdb
- MD5 5c5d43856af51f4dafd4e213aab4af61
- SHA1 7a0c0c937e1816bb413404173d6e8adaae6e239f
- SHA512 f34cd0e2f9a87c6c07639a5af3e858fc8cd50bb16a26e13213fff09544a89eed931a3bf1e07bbce2cbe73ed78610133e96dfa8f79d41a87f886cbc4194f89fa9
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCu:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOcC
- TLSH T139F44907D69400E9D11E8134DBA54A12F7737C6257E096DB23D4E23D2F32780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 716KB
- SHA256 5930d41c4e0827b8d7d564b59b094242312a6753994e71232cd7d7232fb6e17b
- MD5 ca3fbecf0243d40c0d26023933f2e364
- SHA1 8ae4271f6a5d95c7730e054a5123bd99ef0470da
- SHA512 bf707ec0be27cbdd94a55485f0fe5c711a1b40674dffdf2267985254b09a9742532bfeb2402379dc52239078cb329ceb9319dfc9f330eb62d524fe95532f8269
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVC7:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsO3w
- TLSH T127F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 716KB
- SHA256 d4561a6e626a611e1a8c9fbde250aad913fd185dba50b589cd3d198078ff1eea
- MD5 edbfcaa1e2e674c00e439cba15e8c593
- SHA1 d7cf0009748290ff2a9025ec5a321a6cf3e3c1f0
- SHA512 705fe219de483efaa03044dbea36918abff30ed22657a6696e1e42ede2c83e80ee3837aa0da4b2eb28aa1bf73dc5d026ba15a4ca0ff1879fcadf58e4a8ea0b58
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCn:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOmT
- TLSH T1AFF44907D69400E9D11E8134DBA54A12F7737C6257E096DB23D4E23D2F32780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 716KB
- SHA256 f4b66f285494d42dcec36b37da99d7823deef1ddc25cd672aadf64a788faacbd
- MD5 f9082dd3b3a6b055bc2540862c0a0b48
- SHA1 d236e56e24d5248acf3c6605bbf80091260d3679
- SHA512 e520f44b8f23805b45e3ca340ba7593d7365d047b5b1cc78c60371ab9f17acd5372bad449a2dcafe81590f98013c834acc75a6ca5008bbcd5ae718f8a28653c0
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCo:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOeu
- TLSH T10DF44907D69400E9D11E8134DB964A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 716KB
- SHA256 13035ce26ede3d1092409bf5ddc0b604b40edcba506b9e9e5c22dce2a1bd0110
- MD5 24f0f6b1f88f9581bbbee77774560776
- SHA1 1a80a341447e512679067b3c046d704771b485c7
- SHA512 48ea9d7183a5e995d21d87c0c19bd23e1be1e60dec5455679f7d511a425c06084229ce1bfc785d074c87ff4bc9b2bbe30655c273e151c50d1f5d02e2b5fe8772
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCR:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOYb
- TLSH T192F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F32790AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 716KB
- SHA256 bfcf08b4ce4f1ebedac2d189ecb78c7bf81d1eb35ff4c8210d53081177efddb1
- MD5 ad169178699a4c0f285b060b4870ad24
- SHA1 28da7bcce8f68012dfce3b79d2d9bee3568eb562
- SHA512 518286b5cde43dfa416bdc652fe8f966dde123eaff79654298807774c72e65d556f1c007f7586b46bdd2f7a6f20e6473e334885085a61c95487a7aba62f37873
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCR:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOGf
- TLSH T1BAF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 716KB
- SHA256 fa29bb525554eebcd28edaf8b8c6a800ce0685b6b312269d4e4a8802c35dd06d
- MD5 2553683a98bee2a227bf08e518560197
- SHA1 fe5d69068e257ad989e52880d1f2ae24aa62de5f
- SHA512 3a60dbd66ada3c3b30f8a51e442bca722e148cb2527e0d9a4172ae9ffa1c119c3ac477f7c160b87dcb22b24fdfe36298ea56485a4d541640ebf148b81812312a
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCp:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsODK
- TLSH T104F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 716KB
- SHA256 d8d527c850f3c34d12b3e19ff65bbb4ca885e359505847bb2a60af79b3253812
- MD5 29a4485d25aef0ac37a658fd03a8507a
- SHA1 187a9f99805bb76ffb277821f3572ee4c18c4e2b
- SHA512 5ca3a0bd61e8e6684dbe0ad1628a3052234d1a601c298ccbbf1109cccc8c5272b7c8fd5d3bf9db2d4ef5b795a86ca63300c196c7212da17072eec932b0449ca7
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCg:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOkk
- TLSH T150F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 716KB
- SHA256 ef68d62c58d1c31c464e883928297075f2b8b6687c38ca1ab443c6c7dd9dc0ae
- MD5 cf0c4060cea07f4e5b225800e1870b3d
- SHA1 df4c1c19d1cbdc4f2e5c11e661c305064e4ea5ab
- SHA512 af950be1062ae3c3a471b00da013c73fb5cf5d3486dea6cdfed25fa58cbfe03b92534268ac35cf436cc387f5ae07345cc2e47b84f97ca8b138356ce108b1dfff
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCp:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOt0
- TLSH T115F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 716KB
- SHA256 db20a7a42e90233fc4ec4b225ee653dd54193367a11027859214033ba5a5742c
- MD5 41ebec270094e445caabc6f0e47194b9
- SHA1 deec326a8586c3ef8d9fd2b05612842d7098556a
- SHA512 4750c862776dfd244b9f62481d4a612e282964f0ed3ea7779b691b383657fcb010bf7c701095bc7dd5b6fb28e686dabb0597e10fa253d4a33cdaf3f52b866170
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVC4:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOw70
- TLSH T105F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 716KB
- SHA256 2d4a41f3d68ed57824db6dbf0bb8839200176ab66f5a05c79a6066dc8a4d9b1d
- MD5 89986092f927da88d4dbc7b4d8eff08c
- SHA1 8b758ad879e7afa7812d36760e8ca8e8ab5d88ad
- SHA512 90ea4977f6bc6d215212b27a9c494ff455533bd58cc62239df4468bcf0a2af983b75aae93782e864b105ef73298e2b58c66b162c13146f5999d84ab84627a864
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCi:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOFr
- TLSH T15BF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 716KB
- SHA256 6868cb04fcc503b108f5256c841a1b34791ea369f2300a81490fd11265fe6f7b
- MD5 40b54684324f1fe271e03f04fd2c9152
- SHA1 5449499e16909999dbffc4c109e06a6f84755889
- SHA512 73f66ec388f7a83c19ec714fa3c59c8172e9185f1db01e69b3d2940ad4f443580b8104c728b769661878d683cc6958a2d56b7b6aca14dfc2d304e6ddfec9dc16
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVC0:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOPn
- TLSH T118F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 716KB
- SHA256 a6c475bccb0ecb265135544bab5c69df96d70710349a6e92c0050ef8d8092e4a
- MD5 ea59f509ac3b23a2ef4c7bedcfdfbaee
- SHA1 3ecf2e3d3edd08bfee126aa0340783fa6ee85d7c
- SHA512 fad539dd2b3378cd6af79ceddf1ec9b82ef755d270cc76ab7e510123bb053991850a64ed828bd940f590e07b7ae85060dae6c2b0bf7ef9493e6348360994cad9
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCy:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsO7x
- TLSH T192F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 716KB
- SHA256 e4473733d5087fb5cc4098e38f510e762dba711ceaeab99893d0ebc521eeeba5
- MD5 0deb6a56168d314156ad3cfc511f5820
- SHA1 1f91b9eba24eeec29e2570e972ffde80a4107df6
- SHA512 1804dfe1537ab3555db642957900df6a10fb78b0f999a5a2b5d91631a3f37f23e262f0f43e30e1d5dfc1d992e65ff2628c8b0fe8e812e54b87673bbc3d0add1c
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCR:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOpA
- TLSH T127F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 716KB
- SHA256 4a4bc9e9f088f3f42f1c16f0116864128d520fe7e48b6bf5489b47cb1ba0ee4d
- MD5 43eed82d230c4649e445ab1743d06a22
- SHA1 4acca9f432a7efe60e12caf440b1880caf82b54e
- SHA512 e23a64fff3843d83117cd13f8b77b37fb28f30fb836f15d5c2e10594e27b1f64abfd0f9349b51cd557637f8b3e91857d14c87f4c72be1f2b83e0a90f7efcc791
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCo:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOi9Q
- TLSH T17CF44907D69400E9D11E8134DBA54A12F7737C6257E096DB23D4E23D2F32780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 716KB
- SHA256 815a3fe3d3231ea605c6cd91998cf7752842e1502c9789c81bb9a1900c927d1c
- MD5 7bc4f692e5c11bdc575b76cf1dfda38c
- SHA1 851fd43960e0c6be199250a60960a850a7be1534
- SHA512 eb2937ff8937554deac1fda2337d99bfbe4f01f18bf7cbf6d2fb6abe10cf4f634227aeefb657147d758ed45b69ce25e74e1a03422e2beb484c366899ff384b37
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCT:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOH4
- TLSH T19CF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 716KB
- SHA256 c061321f4be8aa7444566fcfafe1aba9dae9387e36bda15ed2a006c740d1eacb
- MD5 a5683f36f83658ededab5ca8a2a49def
- SHA1 0ea3610b28fdf03523417172f120bbd61db215a5
- SHA512 43c0c652931d47588705b80487c960831f18b8998935d6e1a676f61b43d32c3bcf659155fbabfefb842764f7829c0f6979092f7a1755869beee715f6ca64b3bf
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVC2:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOmu
- TLSH T1E7F44907D69400E9D11E8134DB954A12F7737C2257E096DB23E4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 716KB
- SHA256 edba943e11ceadd19d2155b5156bd8c63d92274cfbdc31e451369b9464d55def
- MD5 560f7267fc3c577391f212fa8e3ff5b1
- SHA1 2ce4853461240fb227193531a948f2fcdfaafbe5
- SHA512 4c9b5a02eadab2f6e1c9f8a0440c3afff3dbe677abd1ef47b6ebb264a8764e84f56b4e3ba3b768d17baf95f6995d4b0ceb6ae4dbf2e0d04495a1caf94c291f5d
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCI:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOXj
- TLSH T172F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 716KB
- SHA256 5f56d5fa07f9b9b4054f63b8728b46ecc4f436e6e4d5795def032a2ec3fcff1b
- MD5 b170f26c3eb8e179e799ba667f38fb02
- SHA1 8587b18687e26e410e803d975bc0662662a66953
- SHA512 266b0bdd5d90087b60e5df3c80eca527e6e325b03000a6fcc98517378e2120d1457a827f399a45ee659a5abc7142b5edc2e6853b50687f1ae0eaf19bf4e63a57
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCQ:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOCg
- TLSH T152F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 716KB
- SHA256 facdc9df2b5012d221382ba3fe7457f595925f342bf7a395c962353142fd2698
- MD5 4711a34b0cdd3d13c383df9499e65a3e
- SHA1 167a847b7afddddb4d0555316f3cf8315b2fd090
- SHA512 42f30fe3854b84fa2abf9efa7be89f1a15e6c9ece354a65a50b3da4555ecd84476ab59cd3ba8b0147e202eb47f632986b3e452b2dad37bc8d4007f9732ace746
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCx:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsO9I
- TLSH T1E7F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 716KB
- SHA256 6af85a6128cbf763c37ba13d2cf13de213a47f3b0c9ff738f6971e3d58c78a22
- MD5 074dd3140f7376b5820969cf9d266096
- SHA1 e5303b414975a5a9052bc1860476860a9d4a1700
- SHA512 d34d3c5dbeaffe1021a3939b86bba92642af79dd9d602fe56de1c0da8dbfad812cfbaf3da10f2495810494ebd427cd76e3bba77a7ff1d380dd503dd2ae308084
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCP:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOvo
- TLSH T1ECF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 716KB
- SHA256 00710607486817317b8d8a8306d0fc2d7a51a97e6564acd945f95fc1eb8c40a2
- MD5 c4ea7532ecd387bdcc07d9f36c83f7b1
- SHA1 22cfb649d0f41bc62168e03343eec6870c6bec96
- SHA512 455f27d3829f1c832f2024770d043779104e832cd0456ea8c7d340a6b3a0d5d14b179b5d3ff9f0a7f01a5319abb20bbb75f839a341cdf670e01eb026af3227fc
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVC6:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsO0+
- TLSH T18DF44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 716KB
- SHA256 b0637551781c064035aa761bc26306b6e2828e2e7f130e6288f0f2b5ddd9c467
- MD5 6fbcfff5bc854c7d0e3ed1b6cb555184
- SHA1 eded163a3cd5594f1f36a2fad0ed2b672412ffec
- SHA512 ede61afc8086d7f68603526f9e9863cb7ce40c2a6903bc0bf1779cb803d3c98794a73d3533c92f77fa172d7d22f5ccb10fab18cc20f7435582f9fabda6ea586e
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVC+:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsO8Q
- TLSH T1C6F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 716KB
- SHA256 467c68a2eec980f32640b68331fdca6b64ad2fb7152e2c09bbd02acb867c7d8a
- MD5 f3e8b03a6c55b94280acd3579e96b79c
- SHA1 0ccd34ef0ec4d1ab08373af1fba9aa5680cf9b61
- SHA512 b9c86ebe50881cba7a54cbc71a5a8f4b9128e254efb851928ef966529f8d0916ce674e8fab670c2dc85c81395ed184b657f6e9d009e2ae676de98daf1ee97034
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCe:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOlX
- TLSH T10BF44907D69400E9D11E8134DBA54A12F7737C6217E096DB23D4E63D2F32780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 912KB
- SHA256 ab868733587406c79b13aa77d97ca2ebdf58510c1e01fa78418c17adf9f55d8f
- MD5 47fc6e5f88d55ba8bf1482bd5e3b51f3
- SHA1 53ce7c748ef9c6637b143c533fde5117bbf055a9
- SHA512 d7ef1ab40280b6a72912b161decca6707acf7f60d7e346b5d92527f972ce02ffc54010b5f43a39e6437e543346e19f2e846565b9cb143b6b32c47abf7fbe1ec4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsORQ0dWCXSyCq7IwZ:A3mnXoZjzyaEFkR4ugsOqjCXF7IwZ
- TLSH T1B2155916E69400E5D16E8174DB964A12F7737C2203E096CB53D4E23E2F326D06EFA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 716KB
- SHA256 43a4f33ecb169e3e70be5ac07d5076ad644cc901305618379935b2b1572c8c29
- MD5 55013a549403ed6baa9d3a79285beed6
- SHA1 338c1e12922c6fb9026b2ad85c5eb0559a5f17b5
- SHA512 d80ff8652999859f2b55c45233f9f7f481d49c660607f2e1867c88a0b065feb905eda78172aebaeab0a3d28933a575d78c631ae793804ef94e9a98472e8862da
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCw:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOHL
- TLSH T1B8F44907D69400E9D11E8134DBA54A12F7737C6257E096DB23D4E23D2F32780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 716KB
- SHA256 edb9d885df0cceb4c73b5f17137ba27c9983304ec94958df9ab7677225b43367
- MD5 d1777b060ecd05d1fd06fb152fe397d3
- SHA1 b58b1e81fd1714b69d2ffd1d29cc8282dc8f3352
- SHA512 dbccaa3e6ec618bda80292d0a5667bb456bfcf47ebb0cdc2c34e1c9791bab77b81e11cdf99cb1202a980486cca8a6d26e65c83d7bf016d73bd9b2149ec4a56b4
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCh:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsO9FC
- TLSH T100F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E23D2F32790AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 716KB
- SHA256 1d5f30b2fba9fd9ac912708cf070c5ba954f9c99f4659529ec5b920a8f5bb4b9
- MD5 332d95cb898374d99e6225015c4303c1
- SHA1 ef7987872f79290bf4af90c89f5cb55d70779b33
- SHA512 64855200f3b2c89fd9acb6dd5e67049c26aa4a9d656d336a8e56f30786b7a4a5a87072d3aa804577570dc69503658cf48087e5e558d62259a4ed5c238fd7363f
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCz:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOuh
- TLSH T1CFF44907D69400E9D11E8134DB964A12F7737C2257E096DB23D4E23D2F72780AEEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
- Size 833KB
- SHA256 6349e478a11c03d8ef7bb5a35299c987c23f68b3450d8c7eca32252f4e2e828f
- MD5 0308c3b3392023702d501997aaa31c06
- SHA1 623f91d13b4cfa1b10821248a55b9bd5c46c0851
- SHA512 7fc048bdb5cbbff515862d6d05695cc351b8399ca48c5bbf5924fbfcd9cc6894d9b3eba7a4679a35fb62b535ad5ece3b7f8fae8f36fbbfa690b706a7e7a107ca
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOtKRu9:A3mnXoZjzyaEFkR4ugsOYu9
- TLSH T126056A17E69010E9D11E8134DB964A22F7737C2207E096DF13E4E63D2F726806EEA767
- MD5 SHA1 SHA512 SSDEEP TLSH