Analysis
- max time kernel
107s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 13:25
Behavioral task
behavioral1
Sample
2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 653KB
- Sample260710-qpfcvact8x
- SHA256 641b8cd17c8e54459df9bc5830b42ea40441a2db9f980952ade5f9bdb81cac1b
- MD5 a47bdc471e0c3bdf8f0b3690f6b6c814
- SHA1 06cb67a87e1d9e9623abd792df2ab5951e121f1c
- SHA512 3ef065919688feef5919a659bd4dd51856d88694a651de32a168425ddb3048b5c3c8cd70401c2862c64371a402d6198928efaf9f74aa7b678e8e7260b0458ad9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya:A3mnXoZjzyaEFo3+aWiauRaRaB2ya
- TLSH T13CE49E03DB9010F5E61A8130A9E65A23EB75BC221760D6DF636897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4532-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c66d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4896-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4532-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c72-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001ba91-444.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198c5-481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-610.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-708.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-925.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-938.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-957.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-982.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1013.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1070.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1145.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1158.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1190.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1243.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2f9-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066f9-1849.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00120000000064b6-2063.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c66d-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c72-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-281.dat aspack_v212_v242 behavioral2/files/0x000200000001ba91-444.dat aspack_v212_v242 behavioral2/files/0x00040000000198c5-481.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-579.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-610.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-708.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-828.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-899.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-912.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-925.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-938.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-957.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-982.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1013.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1057.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1070.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1114.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1145.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1158.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1183.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1190.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1198.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1243.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1331.dat aspack_v212_v242 behavioral2/files/0x000200000001b2f9-1400.dat aspack_v212_v242 behavioral2/files/0x00020000000066f9-1849.dat aspack_v212_v242 behavioral2/files/0x00120000000064b6-2063.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4896 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4532 2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4896 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_a47bdc471e0c3bdf8f0b3690f6b6c814_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4532
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4896
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 653KB
- SHA256 641b8cd17c8e54459df9bc5830b42ea40441a2db9f980952ade5f9bdb81cac1b
- MD5 a47bdc471e0c3bdf8f0b3690f6b6c814
- SHA1 06cb67a87e1d9e9623abd792df2ab5951e121f1c
- SHA512 3ef065919688feef5919a659bd4dd51856d88694a651de32a168425ddb3048b5c3c8cd70401c2862c64371a402d6198928efaf9f74aa7b678e8e7260b0458ad9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya:A3mnXoZjzyaEFo3+aWiauRaRaB2ya
- TLSH T13CE49E03DB9010F5E61A8130A9E65A23EB75BC221760D6DF636897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe
- Size 752KB
- SHA256 f0a613030c06ff2d3f9710d08e0a95164db3e5ec57502bc14492a646dc0fc7fe
- MD5 3c7f2d499aa98629516724dc304812ed
- SHA1 5cbbb2acbb88d9155e5e7b98fc0c8f932ec960d7
- SHA512 2b5ef5f0c4956066c86cfb75b252b069e7f68bcbcbc459aa68079f22bfd68ebea47c0982cdca6a02964d18cc87e4a77aad0d66470f75011c80590916613ccb17
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya82LoqDB+Uc:A3mnXoZjzyaEFo3+aWiauRaRaB2ya82C
- TLSH T19BF4BF03E7D004F5E256853099E55A22EB75BC221B60DADF236897252F327C0EF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.2MB
- SHA256 d16edb53648ee46579c4244e7f6837a5e4207bde5e0405777ea9a1fcc614afdb
- MD5 1e43206ade378a55d6e3eeea329a3914
- SHA1 d79dcb0df5bbde806fc107dcacfe37516b1b47c0
- SHA512 17a17fdfb4b8836cbcedc1aad6f64e0be785b9f6335fa9f6e53359036c8775f0145c4fa2d5555f9a3feacca1583d300c72917c7148809c344d69db3ebc33febc
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaB2yaP0Le5ji0hmxNrM:A3kMMPji0Aj
- TLSH T107457C17F6B442B5E073C079C9E2A65AEA7138421B30CACB1355C7682F27BD1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 668KB
- SHA256 f8136adc24c758932c82aa3c5033b533d5e9dd0506e14787c1cf3612b202a55f
- MD5 3fdf03b62fcf34cdf3576195ef922261
- SHA1 f17abb59214c193288c07eb5412cffc31cce92bb
- SHA512 7e0170585ea8f473bda960cb71510fe3d4cd6e6fd6526622290fa1ba6444f7a960078a56f83b2d4dec20311813da04073ef78c212f0d2353533542478291b738
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaRa:A3mnXoZjzyaEFo3+aWiauRaRaB2yaRa
- TLSH T1F4E4AE03DB9010F5E65A8130A9E65A23EB75BC221760DADF136897152F327C0EF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 701KB
- SHA256 2809c92b3038a5605bffc430ca162a357087b9a218a9e8b84a3e2acd936c3f62
- MD5 2eb2c3ee37943e2e95de8d50c211fe79
- SHA1 71c609e9921171aa99553ebf473ecd6a62c7b125
- SHA512 24b64904c2971b06da99edff16e959bde6e31295ccf20d3e289df5a142d40b92f489defbf77475a1fff9032b4f1a73af0536986eeadb32478a4505659e8d8f97
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yayb:A3mnXoZjzyaEFo3+aWiauRaRaB2yayb
- TLSH T106E4AF03D79400F5E65B8230A9E54A23FB75BC621B60D6DF236896152F327C0EF3A7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 677KB
- SHA256 c75b5ecd12a17482f053e0a02b9bea33cd093deac34441767b0e48674ccbb683
- MD5 2cc5fd94b101d15d1225160b58392adf
- SHA1 af226c37073033fb9d1dc06f916968a5a23ced32
- SHA512 bb461a223040f516a663b664fdd09a7bcfd2652a2cb5947fe8165aa1653b43e30561a9b2f6f33b330964decf310ac83c7afb3e8e4969aa4a6930022c87c13f62
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yag9:A3mnXoZjzyaEFo3+aWiauRaRaB2yag9
- TLSH T1BDE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 677KB
- SHA256 0bf848b5f7703884e1f7186cbe32ceaa52409fbf6286d66a6d17bfed35438a1d
- MD5 e027ac434602fcfc5f5fc97153e1c31f
- SHA1 49c128ed82675d0cacd6cd51f83923a43bd17437
- SHA512 10eca6749e8aa9340431d22b5ec957f0f95723b32e8d0faa5cb92c3138afe3e2cb48dac1efb87cdb48d45e4bb07fceac496ee814922aa151f0176d7be54bf7c2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaoc:A3mnXoZjzyaEFo3+aWiauRaRaB2yaoc
- TLSH T113E4AE03DB9014F5E61A8130A9E65A23FB75BC221760D6DF236896152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 677KB
- SHA256 6b437e8009de020b5695177e989a619167358a5d8bb770c6c46f3fae054f8bb9
- MD5 d2fb3877bfb3b48e469abb2f78f7cfa5
- SHA1 ee22e93cfed9eb0fe1c1f32a5ce569cac8e19c08
- SHA512 d6ff99db907dc5b51a072097ebe8c6cce2d79a409ff79ead196e68b82d6cf07b9e63a3cd05993daaddbf37dcd3714e5cdcf243ff38a85b942f09572988d4e7b4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaBp:A3mnXoZjzyaEFo3+aWiauRaRaB2yaBp
- TLSH T144E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 677KB
- SHA256 22ca78a6b0e8212fe8ad2c9aa1a636541bf013b2db075cacbe14fe39759a9b52
- MD5 66cf2e2757866bbb8693e18393d4d20d
- SHA1 9e24ef2a650f6978d9b4d52e1b810c644eadec74
- SHA512 6e3bdfa017f480b83403416d187934684df4b2f834777732dbb9396d4630f790de6ad61d87b381853f3bd03725bde5fd1a64e5dc49436b26b98f02c2007abb93
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaW0a:A3mnXoZjzyaEFo3+aWiauRaRaB2yaWN
- TLSH T17CE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 677KB
- SHA256 6621ff5d5334670204374784a362fe8a128fc25766d67e9cedd9565e36faa28a
- MD5 7c434d7a7b2270c6b67319b61982bf82
- SHA1 493bba16b0b29d7a20227d8a5fe33b7650c53203
- SHA512 7bcb9923deb072f8e98b44ad507601c29cbbc0e22aeb496d786175b2fb93b20d22e0833e84fa9052d92e97f2040d4785e37c50c3e56958d26c1cce8fc86ca4a8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaaF:A3mnXoZjzyaEFo3+aWiauRaRaB2yaaF
- TLSH T10CE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 677KB
- SHA256 78ab630de92d005e90e2d4e427d9b7ebb7956ded1a29f7db0088b8dc4dec60de
- MD5 190835238800be55925771a027494270
- SHA1 f45d633f287e3a1dda5e6c8adbadded63bfa148d
- SHA512 d27b049e266e9c1a36faa207c5d4655ed5de0753d52c01b6a5ed67acd68757091c95bd7005a6ac09c286beefd08c090503640005e5883dd04d967327bd438636
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yavC:A3mnXoZjzyaEFo3+aWiauRaRaB2yavC
- TLSH T1FBE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 677KB
- SHA256 ab4fb700e32285de47cf8759ba1e0afd5441ee97154380f243b2a7566ad8ab44
- MD5 4e914619311901e184262dfd2985ffdc
- SHA1 b00b16455810468b8e206f8dcf67421c19651381
- SHA512 e4eed2d2aca32e8d252cef8061ca2127cd8de23a9935053204756415e799b18f0c55b7da2bada994a7f01c3090b17583f8da092dac832539a22da3dcd8fd2401
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaQw:A3mnXoZjzyaEFo3+aWiauRaRaB2yaQw
- TLSH T183E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 677KB
- SHA256 88963fb804f39548fb6cb2e6add1562dba2a4234097dc5fb7c7060cf4bc4c3be
- MD5 a78d4bc2c7fa9c891ed006297720bd39
- SHA1 9d677c08cb500f7093a908b57dc2c40f4a64b05a
- SHA512 f5f4f9065ba6c996ccc060d179c778af4282f09ff4b29181ef9bc5811258f7191f5b07a276e33cc601d38a31e2102432e5cff60cd32e5852e09de35aeecce584
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yavT:A3mnXoZjzyaEFo3+aWiauRaRaB2yavT
- TLSH T1C5E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 677KB
- SHA256 da0d4bd0ac1bd6210fe652f244a5efa6a2dc17beaf4c887469b212b1ff5ee9eb
- MD5 e38d509c0868fdf593e2dd1459ffca44
- SHA1 d47aed9ab65529bbdbcb1f4a3f8beffd2d52d913
- SHA512 9f346574637bbc701a79445f7c038493bacdbc2327558d1de01ab6b68b2618fbca5bdd661dc963e481e571a3b7bee3c2e21e0bd6d54e7a5be4973a6141abe733
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yapu:A3mnXoZjzyaEFo3+aWiauRaRaB2yapu
- TLSH T1CFE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 677KB
- SHA256 f628bc04a6ed8a6ce67d60dc3fcef610b786a1dd5d009be9a95877b088bf531d
- MD5 d1307583662fe6f9b02e44d80b7a7e1c
- SHA1 151d3fc05e883bf436038acf6852698da39ca376
- SHA512 bfffc9f4fa768c042efd405b4b6a887a0f3c119c56bdceccbc34b2bc9f3e0cfa6a9b57a0f78409f542e534d0f763ebae03377a610e748f3d2f5eea73b213cfd7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yahb:A3mnXoZjzyaEFo3+aWiauRaRaB2yahb
- TLSH T106E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 677KB
- SHA256 964eabff2df4bd77bc611bf40de87ade4321910599f8410e90ae069a31be22df
- MD5 c9274073156c7f3e752ea20695bb6616
- SHA1 5a55b848a5f8f2e233486862087bb78aa5249dcd
- SHA512 3f24ae26aeefacb343526be4cbe316ba64c45cb658404967e9077784844ae51958cda8916038fb308f9667d7d79d88f6d084a5fbf5b2473924acbf98bca75618
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yapf:A3mnXoZjzyaEFo3+aWiauRaRaB2yapf
- TLSH T1ABE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 677KB
- SHA256 c912ddcc75b22ee0c1d80a4a93460269af712dc8d8dc8d0b50d86b2a775f2950
- MD5 cb34ac4a1af8db11b2ec3e5a48cf7631
- SHA1 25ccc467c09db5c79ecb45b00bc937e1725a260f
- SHA512 af3f12585c30f66bdbe510b47f11bc6697c32b37c78b3bec6cc0ea138d9d99f385b3da538e3af18c01afd2914fe090b58a952d26539526c6f84e4cc33243a577
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaSK:A3mnXoZjzyaEFo3+aWiauRaRaB2yaSK
- TLSH T122E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 677KB
- SHA256 a5c9a27109ec79de85500dcfadaeee802fef3c1f8772bb6293fee269f341e5d1
- MD5 f9b7afba5054651b86aba6cfa9be3fd2
- SHA1 9e0bc322e6ba7ef9bd561df936568d090acdfa5a
- SHA512 e1c93f5b507f0dd804e4033c79e76b2fba87eccf7f7df3be85eb77b5837e7fd2bea5a051c9a58cabc29342eaa5cfe6a4987096a73747dc6453c2b2b71b57489a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya3k:A3mnXoZjzyaEFo3+aWiauRaRaB2ya3k
- TLSH T16CE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 677KB
- SHA256 faa7b39e4c4906adcddfaf4abeec9021fe0da2005975b1f104b3fb1e6f6941a8
- MD5 551fb04920e71de46171af88759e165a
- SHA1 3fb1ec86de3f43be125b736ffeafa6cafb95282c
- SHA512 654d1d9ce0041c31b045cd957cd62e0f0cf95ddacb3211c7715567e107216ed6a6fb89f7e1ae6df7b0104f115c42d38e51d8bdeee611a423d747c6c6f3baea0f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaA0:A3mnXoZjzyaEFo3+aWiauRaRaB2yaA0
- TLSH T1B3E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 677KB
- SHA256 126475a86662328343f7b1f17bfa95d5ba81f643d20a20edab5210ac80b13045
- MD5 c40340082d3cadede190812f618542fe
- SHA1 14580cfb572e42a9bd90efbd55cfe0793a897c57
- SHA512 9252bbd57a64265def6ecc50656186c71a68d40cd8848f32d7b591345fa6da7af52ab18fc4d66de84f547b9196359b18a0b6d465d51b5c637b938bda44a1b6cf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yab70:A3mnXoZjzyaEFo3+aWiauRaRaB2yabg
- TLSH T18EE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 677KB
- SHA256 8d9a6e886fbcef5f50c259d7b8925f8d41756539ae1162c04acc40a719645829
- MD5 3bf6eb60c41406b23a7c95fa6c2689fd
- SHA1 7577e351295abc0170c8e21e9154fb230edc22bd
- SHA512 ecb4699726b68c018d4c4a51feacb17c450f6d4c4fadb0ac488a2b5e4758bbd00869c5ef945c3dcbcf2ce3726f71322bef680787a17da609dd3d200580f2d4ba
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaWr:A3mnXoZjzyaEFo3+aWiauRaRaB2yaWr
- TLSH T16CE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 677KB
- SHA256 dabfda951a8f98825abb742899178828b8ffee277b7fbdc070a90563d015b062
- MD5 705eb1e877dae753226dd2427b9ada5f
- SHA1 89e17d317697de271b21422a938a70071b1d9ecc
- SHA512 1a6e9527faf06c324c3f0252ff26c91d1a1976a70f9f5a1f8eb3a040fc4bbca6bb4c5d8adb40b23470afd33e711d7d2b1d28358b46e0a8d34c63db4afbdf7e6f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya8n:A3mnXoZjzyaEFo3+aWiauRaRaB2ya8n
- TLSH T1F5E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 677KB
- SHA256 275fea631a4d522ee8a6c7e0a719d06f0461b0d02f20dd3b63ac446a02c3afd1
- MD5 c3d3f1fca4e1fc4d4c95148758116127
- SHA1 df50bb8faf7ad68077d90f8993cf995284261332
- SHA512 0cda524682af239b7f95b05f70f641cdb21b7f9446817c5cb94b1a7106993c4d574b451876801d5090f086fc72831d62f9883f02d22fe9e8c19d6d53192c933e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya6x:A3mnXoZjzyaEFo3+aWiauRaRaB2ya6x
- TLSH T1F8E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 677KB
- SHA256 43c84a6de3e3814e854a867a6fcfb572ba5765b120b6b30a5a1559dd20408448
- MD5 5975ec5204c7e88a68514bfafe640dda
- SHA1 245d3f07c1f2765a4c54a67f45b0fefb0b130ff1
- SHA512 1239a2ae6aaaaf935d1588d9dcc04eeac968ae03c7065f5bb5ebce61bca2a812e9091fbc22b5eda0043567c365c8dc99c8a36b6b93bc744a0855dc4be1570664
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya8A:A3mnXoZjzyaEFo3+aWiauRaRaB2ya8A
- TLSH T170E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 677KB
- SHA256 ab9c92ce133d0cdc35b1cd2107c74371b63516dfce7c9a97a41fe7977255a2fa
- MD5 31162fa9b15634d7e23341626fc5fc30
- SHA1 734520a6bb89e7264daac6da9a5e9c0da9d476cf
- SHA512 55b2a9fb28b942843154ebb66f29bde49e293dd036b7ce280a2597b2ae9f58da3244e73597f0c050b4e978f23e81b17598823fe1e158a9765c165a056067fc6a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yal9Q:A3mnXoZjzyaEFo3+aWiauRaRaB2yal9Q
- TLSH T1F1E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 677KB
- SHA256 ab2d748e778cb2758b0a4b50522c818d7c516029148d0b33434c857638ef3c14
- MD5 8db93b997e2a859c9655428e93e2281b
- SHA1 fbd50a7b6fb2a9151933d3b844a94a308807d17b
- SHA512 ef671387a6b6658356993759a57e4de61d6994c111de3c4869c7970c39e691109112db9e7b5fd5a0d5f4c5fd1699cfa4a392d9de05715960d94020b0dc4582f1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaQ4:A3mnXoZjzyaEFo3+aWiauRaRaB2yaQ4
- TLSH T1F9E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 677KB
- SHA256 14f65482312b93fe55bc47e4c71baab900b848eb93e93638e9fabe60d4e06c72
- MD5 d755e7cac2c65ce1c1b020179c0e1422
- SHA1 ae1c339041f5a5935ff137690a66dd6326ce7eef
- SHA512 c4837bd979f91d6501d0ccd843ee1b2e6eb13282987fba46bb6615f1aaa3f8339a4505d06d7e1dad0ba466835012e89d44ddba7e4caca45ad558501a5e4a51b1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaTu:A3mnXoZjzyaEFo3+aWiauRaRaB2yaTu
- TLSH T173E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 677KB
- SHA256 9ea2e32f04cfc21894825226bd4b3aae010f579e7d26f9f711986f80109e550a
- MD5 c2dbac04810724dcee85671359c0f5b5
- SHA1 4c550db18c95e73240bd30c9279bbcdd58018685
- SHA512 4005459cf04b49c231d1957f202fbf42c3948eef3f5d51ed0c5ab96db0536a38f52ff613609bc857a8c988d4942a00fe6ae620b73bb9df33d9fa37d17aa85cb7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaOj:A3mnXoZjzyaEFo3+aWiauRaRaB2yaOj
- TLSH T19FE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 677KB
- SHA256 04dd49746b1180bd7430154fd8d782d9609b90120874d97a11d5f863222cf362
- MD5 7d7278b6efe95b2f60e3b4442f1c78f7
- SHA1 fd03d3da08dd207217625e20f8cde75b6314af70
- SHA512 b233e598a19e10e86b8eac36d509c767fba0600d428aa23eb1976ad9bc4235593a1e6605626e636f96ecdbe803b359dd837a1f2f35f63f7420a5b69b168869b9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya7g:A3mnXoZjzyaEFo3+aWiauRaRaB2ya7g
- TLSH T1EEE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 677KB
- SHA256 9185b26ebd53554beac1ab89cfc787b02835db22f878245c6c83f2325c33e7d1
- MD5 f6fcf7fe0a2229ce2e3857d9cafb2e89
- SHA1 34959a0ebd1f0aa7714e1d64db7c7aaeadeb18b2
- SHA512 92323028c0216192a8efd16661ea6d7f0dbf099de2912d470122c8aa4ed904caa066f882ed1a5a03edd2707da5ca445eb68e3d44f1730c7e58cba13f39fcd693
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yamI:A3mnXoZjzyaEFo3+aWiauRaRaB2yamI
- TLSH T158E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 677KB
- SHA256 082a6136750d109991e2e702d66c5a382f54005914eac45f1a8096f33f8655b5
- MD5 c1e9b4ae8f6f79f15d984e835d0e5aab
- SHA1 1dac15bd4864f46cc88584992d2f645999f4f359
- SHA512 0f23138aeb034eef6e19daa4a0a9f0430c34071fde99bd41cfd7fb3f928176d9b2e626ac97ee3eeca622ee647ab082161d5a9fcbe43b7b3c12cb7a7499481614
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaUo:A3mnXoZjzyaEFo3+aWiauRaRaB2yaUo
- TLSH T110E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 677KB
- SHA256 f50e701be6f927af13433f2d30aa8a68970ca84e93aa75b957767b1f89ab396a
- MD5 22bd1057825c0f284eaed632fc14086a
- SHA1 333bb1ca408cf84a3fc032182c5688d981aa8b91
- SHA512 53f87c23a72272ff9ec2a19983e33f0c1108dd41103e389657c3f6f9b6e91aa03d7e1a6e5379b16be7bfa3fd5e5482111adad08e2522e71b2e7528db421c0c36
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2ya3+:A3mnXoZjzyaEFo3+aWiauRaRaB2ya3+
- TLSH T177E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 677KB
- SHA256 aac31de3d417b4dd8e22907e6f11ac586ebd7e6567f5b8304732d1367b50b3ef
- MD5 1bc4ebd9de56aa4b0b79b7866cf88cde
- SHA1 d06b528c796bdcde4f151fcca6c908622405084e
- SHA512 01ee33891e8096e4094192ba86abac6fdbcf749cc01098bb70ad09e701c7be94d5bf0150cc069dc1f98316e6627a88a2d0881815dff680c1321b98cc14668b4a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaNQ:A3mnXoZjzyaEFo3+aWiauRaRaB2yaNQ
- TLSH T1DBE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 677KB
- SHA256 4256411968fd3c858a78331caf528a48f5a34c78c2e988b54862a1ac0a2aa995
- MD5 9bf4f4f5eb829eba60438e543c2c5d04
- SHA1 dd5bad124c3599e09c9d1a861ddc3cd2b3da2356
- SHA512 0884585417b0bf2d77466866d315bdb2c35480c11a5a4331b9029eebf21233ed259b491cc0cc6377aeca476f786b2fbeee38eefab50e079be7502890c80b7401
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaCX:A3mnXoZjzyaEFo3+aWiauRaRaB2yaCX
- TLSH T1C9E4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 874KB
- SHA256 fe52c83c1b69ef01662c04286d7b1b3c48c2c0be8b9806f400c10acdc2d5ff7b
- MD5 fd0584f0580538d53a1c4bf4339a2149
- SHA1 93a4bbd994369b60dff7f4c37cb40af3406fe2f7
- SHA512 ea6e0e18a73273b6193cc7d5c7e581f05688ef02d338903937ee3defc901cb3f994cb145a48bae11c20b22b8110cc878b87ced2c8f242100ed6b94c5a8c84c39
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaB2yaJjCXF7IwZ:A3kMAC17IwZ
- TLSH T1FE15AE13D79014F5E56A813499E64A27EB75BC220760D7CF53A883252F237C0AF3A7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 677KB
- SHA256 24d8e703c9aa8b3c2e5a35ab40030d1ef720b57e77cb9c7689ed46e35cd815cc
- MD5 4ff3355e365e9774d70c3f6cb13e8ff5
- SHA1 a1905968a054607f386d41f45afad4571f4ae7b5
- SHA512 7e6d1ce51389b5604beb3fe68f0fcf1c0c1da1822c39e8aaef06b7815d9a455390e3b60d15f998ab86bc380c598e7f17ea89f03e12190b5f211fe115f7d537da
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yakL:A3mnXoZjzyaEFo3+aWiauRaRaB2yakL
- TLSH T11DE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 677KB
- SHA256 0bf670a260e837e45f647a2c05704a0f51a95c43a15c8c44187958a3abb94d59
- MD5 e95ca23440e85489226ff85d70e73233
- SHA1 6bb45534c1fde894127188f1cb2ab1037a2d76a8
- SHA512 8732474eb96b7b10182f50bc18444a825c298067a5035805297ad3dd1c7b8bffad21ec22c2e6ed7bc15adae28ad9c98156d7e572ac64a0628fcac2fda73ee4fb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaAFC:A3mnXoZjzyaEFo3+aWiauRaRaB2yaAM
- TLSH T1FDE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 677KB
- SHA256 56e4e7fa6821466c2d471269569ef4bc8b86823ac2623000dae5de8cb8a19473
- MD5 2ff5e1a65e75c46483b61cc2ddc4d6f1
- SHA1 89ed1cbb5a1549abf72e29db921c74f5ac63009e
- SHA512 e6b5ba8c2b2e0f9ee0303be298200beb9ecc9eb74a6d329c99cb659513a156a32e56b3e4896f2779d69a1e13664de8f07e1f499f301fda18b938fa648ce88288
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yahh:A3mnXoZjzyaEFo3+aWiauRaRaB2yahh
- TLSH T1EBE4AE03DB9014F5E61A8130A9E65A23EB75BC221760D6DF236897152F327C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
- Size 794KB
- SHA256 c18151b2a1dc2d146c3483f05a95c027af0c78992c4510aa75d071a08a8a933d
- MD5 01786abda843da1a13b2a06f689c8148
- SHA1 3742a897a92b3e1a2d575071201cb1f7250276c5
- SHA512 f802edc7dfab5071548b228e7ef969bd4e37d8b3b215de790492b8fb5d8b7557de58af4e6e5eccb33a04f8c97d44f5c922a286a42392493e58a104938dd18a88
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauRaRaB2yaAKRu9:A3mnXoZjzyaEFo3+aWiauRaRaB2yaru9
- TLSH T14105AE13D79014F5E21A813499E65A22EB71BC221760DADF1368D7252F327C0BF3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe$
- Size 1.1MB
- SHA256 47e8a9f81f73816bb84acdb50e76f633449bebc6760c9f884a3f49243df08534
- MD5 97f138ea718d2f7580a149cb865a0479
- SHA1 a000bbee3af33cb9780b272c0de61ff10a63fa0e
- SHA512 e4c3ba1026f6e2ba7c98b7004dd1ee548b504c402965de18b8982815018e2027e49583b35ea33e3a5fb6f19033cb80170a479c302f9dcf446fa883269208a04f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaB2yaBBOkUhMXcBwcy0G:A3kMAUasqci
- TLSH T1D235CF33D7A000B6D2A60172E8649631FF79B9152B20C5EF9354DA292F746C1BFBB352
- MD5 SHA1 SHA512 SSDEEP TLSH