Analysis
- max time kernel
91s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 02:55
Behavioral task
behavioral1
Sample
2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 672KB
- Sample260711-dewwmaay2m
- SHA256 2ef37917cea9d1bf2b4be6bc1d39f84d2c53272c1b6b8071bf919eba440aa42f
- MD5 8ada8b39f4d5105255314aef5912c784
- SHA1 30b3f0b7c3b584023f9ae1a8e8714d5e000440f7
- SHA512 6e3ff02cc3030708b36dca622bbcbf2e984f429baad10863356033199a56784e1bdb7f623e13154c51ea51f6e467bb7eb4bb393732b0bf7c65dff37ca2e689c5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQw:A3mnXoZjzyaEFo3+aWiauoEkoQw
- TLSH T157E4AF13DB9014F5E51A8130A9E64A23FB75BC621760D6DF236882252F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 35 IoCs
resource yara_rule behavioral2/memory/2360-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c617-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bab9-125.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2360-171-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4796-245-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019983-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019988-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998c-596.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019994-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019997-688.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001999e-731.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001999f-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199a0-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199a1-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199ab-844.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199ac-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199b2-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199b7-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199b8-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199bd-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199c1-923.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199c5-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a50f-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a59d-1077.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a725-1126.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac39-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001ac38-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001ac34-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018953-1515.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001895b-1540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b6a1-1897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b69f-2000.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000187f0-2106.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c617-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-39.dat aspack_v212_v242 behavioral2/files/0x000200000001bab9-125.dat aspack_v212_v242 behavioral2/files/0x0003000000019983-492.dat aspack_v212_v242 behavioral2/files/0x0004000000019988-499.dat aspack_v212_v242 behavioral2/files/0x000300000001998c-596.dat aspack_v212_v242 behavioral2/files/0x0003000000019994-621.dat aspack_v212_v242 behavioral2/files/0x0003000000019997-688.dat aspack_v212_v242 behavioral2/files/0x000300000001999e-731.dat aspack_v212_v242 behavioral2/files/0x000300000001999f-744.dat aspack_v212_v242 behavioral2/files/0x00030000000199a0-787.dat aspack_v212_v242 behavioral2/files/0x00030000000199a1-800.dat aspack_v212_v242 behavioral2/files/0x00030000000199ab-844.dat aspack_v212_v242 behavioral2/files/0x00030000000199ac-858.dat aspack_v212_v242 behavioral2/files/0x00030000000199b2-877.dat aspack_v212_v242 behavioral2/files/0x00030000000199b7-890.dat aspack_v212_v242 behavioral2/files/0x00030000000199b8-897.dat aspack_v212_v242 behavioral2/files/0x00030000000199bd-910.dat aspack_v212_v242 behavioral2/files/0x00030000000199c1-923.dat aspack_v212_v242 behavioral2/files/0x00030000000199c5-936.dat aspack_v212_v242 behavioral2/files/0x000300000001a50f-1009.dat aspack_v212_v242 behavioral2/files/0x000400000001a59d-1077.dat aspack_v212_v242 behavioral2/files/0x000300000001a725-1126.dat aspack_v212_v242 behavioral2/files/0x000700000001ac39-1221.dat aspack_v212_v242 behavioral2/files/0x000800000001ac38-1343.dat aspack_v212_v242 behavioral2/files/0x000800000001ac34-1375.dat aspack_v212_v242 behavioral2/files/0x0008000000018953-1515.dat aspack_v212_v242 behavioral2/files/0x000800000001895b-1540.dat aspack_v212_v242 behavioral2/files/0x000200000001b6a1-1897.dat aspack_v212_v242 behavioral2/files/0x000200000001b69f-2000.dat aspack_v212_v242 behavioral2/files/0x00030000000187f0-2106.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4796 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2360 2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4796 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_8ada8b39f4d5105255314aef5912c784_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2360
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 672KB
- SHA256 2ef37917cea9d1bf2b4be6bc1d39f84d2c53272c1b6b8071bf919eba440aa42f
- MD5 8ada8b39f4d5105255314aef5912c784
- SHA1 30b3f0b7c3b584023f9ae1a8e8714d5e000440f7
- SHA512 6e3ff02cc3030708b36dca622bbcbf2e984f429baad10863356033199a56784e1bdb7f623e13154c51ea51f6e467bb7eb4bb393732b0bf7c65dff37ca2e689c5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQw:A3mnXoZjzyaEFo3+aWiauoEkoQw
- TLSH T157E4AF13DB9014F5E51A8130A9E64A23FB75BC621760D6DF236882252F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 725KB
- SHA256 07043f46589a8214e139c5c4ed0186a116bac548e584330a327f960a9d67d3f8
- MD5 d03233878069a337789f26c299e4a528
- SHA1 37fc7e088fb964ea64deff88e393310fcb9dd697
- SHA512 ae6db6274e2caf09537c6d0dde9c8f24aaaab63df1c499c0e2f456b5bca16a59258fc986560c8383d7cf709b84164b0509b0ae033ddc2fe2a526913d0cbe3a54
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQtFfj:A3mnXoZjzyaEFo3+aWiauoEkoQLfj
- TLSH T191F4AF03EB9104F5E5168130A9E55A22FB75BC225B60D7DF236882152F727C0BF3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 780KB
- SHA256 72e4bd1587b441304199c31a9e03ab217b7d96994582f4017080361b9ee27ed2
- MD5 6f822d639d93cbe8e1b0b8720a3e460a
- SHA1 436227f53890e2c66b84d7cd44c9e9b3da08411a
- SHA512 f2824405f55a055c8c938a60c29da1dc412fc2cb52f6203436953e2277af158df1f6b646c9c0a0b266b895c1f64d31862ea1637eba9648c6acae2c4ef336e973
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQHzQl8Hok:A3mnXoZjzyaEFo3+aWiauoEkoQMhk
- TLSH T12005AF13EBA014F9E516823099E54A12EB75BC261B60D7DF236882152F737C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe
- Size 935KB
- SHA256 939a44e7b20885832fe48eeac6057a7336b45b43164694bc882cb28586a0b961
- MD5 580e70df1fc15ba5bc449a686856d98c
- SHA1 9561208c6adef4cc5b6e9fafffef76353c074d4a
- SHA512 7caf465df350ed442d50ef2179cc511466eee553faa2beda59fdc38fa7a9ea51925eb73986b1cafc15c4bb95b9b2f3785f91780fd6435587bfdf70bb49f6de49
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoQiMGN/v4mWLqYPhOp:A3kMbMu/v4eY5Op
- TLSH T187159E13AAE400B2D16681749BE59A23F774BC7217508EEF536487191F327C0AB3BB79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 771KB
- SHA256 4ef68111bd22a3a9563d807407d0775bdd3377f5ee62ea35ac5a370cfbfe6e92
- MD5 4ef3d7d4c180edf0c86434a67b05fe4d
- SHA1 b66385d354da820f38c7a982fe79b4191c8ef03e
- SHA512 be2f4d29f440dcf518f99d9f781de2bb78bcb9ce2e505493049c5e28b2536414bf8cbaf2c624b7b1fefadf2ae976456dd8c2af0117460d99e9e4c36852a90778
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoQibBPzBAU:A3kM1BPVAU
- TLSH T1B3F4AF13E7D004F5E516853099E55A22EB75BC621B60DADF236883252F327C0BF3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.2MB
- SHA256 c905cf1c59e1ba30a02aed476ca3b440f48e7351c011bef607469ee4f97cf70a
- MD5 a1d1aea96f0f9063c7d0d32164f14503
- SHA1 7f6a6cc4574bbceebc17883003214f85903948ed
- SHA512 2e96bfd047798807b5eb94e0d0a565be3cb6d31563e12e95341e3de3c0fddb9f955d490c0c36575cbe06d85075572a655cc4e5d43b3dcf1e9378ef5dfb019e4c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoQI0Le5ji0hmxNrM:A3kM7Pji0Aj
- TLSH T14D457C17F6B442B5E033C179C9E2965AEA7138421B30CACB1359C7283F67BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 687KB
- SHA256 aa5d8eca8d62520ea8df33531320bc071f369c12ff2875535e12b8506bad657c
- MD5 a3bb4ad6c5f74bf6fb4997e33c600bb8
- SHA1 23a6aef1994b001e3aa5a7552e9207dc4efaf27f
- SHA512 5481367672b7ea485a41f4e7de23e4903988b86d421f5434cf78abc046551f307ece7751a0b4ee8a2c2c7e80d7fe76b57683f99a7e624a8c1eaa3d2d669052a0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQya:A3mnXoZjzyaEFo3+aWiauoEkoQya
- TLSH T199E4AF13DB9014F5E61A8130A9E65A23FB75BC221760D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
- Size 732KB
- SHA256 37c10fb1558d49c33a49abc648f99eb4004c2ef67c425c228dd274ab317452de
- MD5 2923d0061a4018a1974fa7d90c318305
- SHA1 825e72581c400d12b98d7b93dc52dbc9677872bc
- SHA512 5470ea15278f78f36705032d2982e6bd2d17d4dfb7778799e6e3d3bfe4a13428a6b36b2d85572c1868ca8b4749f830f32bd3616bad910810485a7e3ee3839c13
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQ5pIyvJd:A3mnXoZjzyaEFo3+aWiauoEkoQ5jv
- TLSH T161F4AF03DBA004F9E51A817099E65A23FB75BC621760D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 696KB
- SHA256 ac84264a2979c023798ff11c9c3e3d781f6158251660c7d2567acf664d98042e
- MD5 483a51459a28c4dd9ee2e21b1ebf689b
- SHA1 6682ce3dab9c8911362399237e79ded302fe2268
- SHA512 7ae40ac2b1232558e3fc8bb3bd5a95141407f78289274a5d5d22598e1e981d200b488b8464bb9729f58857085956313c90a7a6760003bd2549215ccb968c2844
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQPF:A3mnXoZjzyaEFo3+aWiauoEkoQPF
- TLSH T15AE4AE13DBA004F5E51A8130A9E54A23EB75BC661B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
- Size 957KB
- SHA256 cf1e867c7a104795346ac59869db73ce8fbb111ca5d53173b7c0b384b5725490
- MD5 b27c7a487993cc4363ac1b63a965aeee
- SHA1 ac3119dac98a61e1dfc9dc8535fe8167bba4e72f
- SHA512 f51039cc791f4b30ed62f1b748f31fc3103e9a5fcaea6caaca608f542a321153b4141d2c5842e6a478e0b4f7253a7347e2d94c8eacecf0c718fefebfbc776e79
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoQDTWaLl3z0zDz:A3kMqT1Llji
- TLSH T16425BF13E79014F9E917813499E54A12EBB1BC261B60C7DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 696KB
- SHA256 e8c07c8c86576329ff781a35db49c55d308d2f7146fc48e6e8ffc743e8f85346
- MD5 2eaf73ee2380d9655a3bb1f6161a7f55
- SHA1 6ffbe66b231446f70209836eb6b90366b510e8ef
- SHA512 2ed2cb27fc5d63dff1819a34ebb50adaeef9e55a72aeadaa6935c1ee052fd4eb08efa14428cd7eb372054cb5f3ea2727d0aa36bf124de0b347ce8f47e32da1e9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQcj:A3mnXoZjzyaEFo3+aWiauoEkoQcj
- TLSH T143E4AF13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
- Size 821KB
- SHA256 5d43e612961a5e4e871633a148903c86d3f17f2e3bd639fa849616c453b9c09b
- MD5 e558b8af9bf9ce241c97b6f03caf4d0a
- SHA1 d4f296389ccdfafe0dfa6a853f9aa8d0599b59d6
- SHA512 2bf143df4f3717d1bf078f08b66544af5c839b0ab61bf1396162bbce2b319cefa4a390a739251c6c657cb348be0018363b68a98bae7f169f33e44827433a991a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQJnc3/BHdBdi:A3mnXoZjzyaEFo3+aWiauoEkoQkHdfi
- TLSH T128059E03E7E400E5E526C63499E54A12EB75BC221B60DBDF236892151F327D0BF3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 696KB
- SHA256 86a1bf50462283ec41215542ada98e979e6d754d5701fa1af375190d661257df
- MD5 6d1bb506e5a11d0a86c3bb8078264df9
- SHA1 eb70081e7290d0f30c734f4abc1fe25b348f00bc
- SHA512 d8f599b31f2f011dbf609a081230c2348b9542a5810f9badeaca209209194a7284e2f3bfedd33177e033f77b2c019a8c71d6ae276a958f8285c82e7c76aac866
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQW7H:A3mnXoZjzyaEFo3+aWiauoEkoQWD
- TLSH T1F0E4AE13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 696KB
- SHA256 4c19bd2bb411b81bddc9b91656b83d79da489d1d40288af8f11811880faa6e5c
- MD5 349e347f47e87041e5e1ee2ec6e87e65
- SHA1 a72cb4106024a24e0a07ca1e62367ffc64d5c7e4
- SHA512 b6392a1ac9f29f397077abc94a5702c21db81be8f5a9da4e954895060cd57b4d95837ca39356ce71abf105ae48b250f444f7a641fd8377e3a6fbe81d3009bca5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQWd:A3mnXoZjzyaEFo3+aWiauoEkoQWd
- TLSH T102E4AF13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 696KB
- SHA256 5696eeae1ca5067ea5ccfe55e0bf7a133bcfeb3dd301b29d2e7797c2cbbc36b7
- MD5 265b7433397910db1dc92f1da1ab99e1
- SHA1 40c4995db0e70d8ae8c7c885a91cb76d4da378c9
- SHA512 c523ff626c06b0d814b36687d6819f81787ffd9d25b55fc8b8a2ec97c006eb7b503128d72b78274e97c2a102247afe1437a2e7f2e0f6487412a2c747cab91a76
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQeM:A3mnXoZjzyaEFo3+aWiauoEkoQeM
- TLSH T14AE4AE13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 696KB
- SHA256 4616212d01a50264361fd86f2cdc9d87207a91c6364e2a1077729602648ca10f
- MD5 1898c28de490d2692c59e6751cda197a
- SHA1 0619e286d5b52101fb50716dea4841c424e56cb4
- SHA512 3bbb44fc180ebe1fd505e8867090fb4fbacd56945c36d7d7d4ffa9db43a58280788a226abcd49b810e402ade6f550febf1f221616940d63d6007f210b0a4d586
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQbW:A3mnXoZjzyaEFo3+aWiauoEkoQbW
- TLSH T114E4AE13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 696KB
- SHA256 94adda2612526b55814c1bbdaa8e6b4ee877f897a9613cb51c7be6da61b80d7c
- MD5 a67097fa0621820bfb6c834d44d8725e
- SHA1 2b184ae5bcf87aacf1a8c912e19adda7e23d3fec
- SHA512 6523532b8c5fdaceef9a28d15e94c218048e38d08c9e7b80816d6269b0781c470546ed4ef518b6d77adbf4342b8e1f06afc40bcc14aa1898069537edbcc564b7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQe93:A3mnXoZjzyaEFo3+aWiauoEkoQe93
- TLSH T10CE4AE13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 696KB
- SHA256 3248ae716c71951e9b3e55993e16622ade40e06055d7b4d48ab3ab5bff5d3999
- MD5 010fda6524b683ededc4bc55d75acc28
- SHA1 67a6721af6be3cd9948b4d640833c35a9cc33031
- SHA512 5898375dbec9222c2a669646c14282801d8b68672e51862c981b1683e3e3acf6ed8535e3ffa8bace433ece29b75a0eb4beb47ac7d542f660f70aeaf2e706844a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQI/:A3mnXoZjzyaEFo3+aWiauoEkoQI/
- TLSH T1A5E4AE13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 696KB
- SHA256 dc789169d1b8ef3ec8886d5aa014239d55e6b28ca414c176fa32b21f9a48fbc8
- MD5 2046d83d1f3258fbc9cd54ff34abbed7
- SHA1 103786703713159d5dfb489ea6fa3183e444cf6f
- SHA512 3c12ebdfbc41fdf79189c94643a0c6e6e4444401749ab8eb24f59ba415d180888f0930d0d36fa3834e360ab40f5d77a8d607aaee0b5e3507daa293d5326fa7d2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQQa:A3mnXoZjzyaEFo3+aWiauoEkoQQa
- TLSH T197E4AE13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 696KB
- SHA256 c04b891d2de2fd97d4d073d08b21852c10288edd45bcad83010dc53b491739d6
- MD5 d3307e57a9bcf36ab6d6cb2c03104977
- SHA1 0fc3204197d346b01f003f6fa68c9af5854c9772
- SHA512 ad83aa2bf10f707c4bf4d0f1e7b2825c95b4f41d3ea23beb08c9b7e2cb042ca6082134393677a8639182a23e3e5c4270806225272e86fc359506c72bd7c9b3b6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQIj:A3mnXoZjzyaEFo3+aWiauoEkoQIj
- TLSH T11CE4AF13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 696KB
- SHA256 1831057b308166b215e29a59926e3a0db4953ef9810c957a3e8ef59720650351
- MD5 87d9d006e1f2921414b856252c7e1297
- SHA1 8feb31cefe1c6f23d0b5893cafb9b854d5aba9a0
- SHA512 e9b7ef66c030e3e9f1cb527345d67aa32d43a36d2e34acbe2c99433c43744160c344931fbfe15c39709e460ba6c9d379bf48983b43e990b242347dce1b6a241f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQ1Q:A3mnXoZjzyaEFo3+aWiauoEkoQ1Q
- TLSH T10BE4AF13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 696KB
- SHA256 499500eb2cc2c5b4b266e7cd3664a295d93a294c5838e7b48ad483239d5c80bb
- MD5 c26ea2368243a23447d86da935e731e5
- SHA1 5712bc6096c44f9d5c853ac62cfa19d890a01bec
- SHA512 d7a4d4001a2a9b0d803f19c72099c1c707cb5bb5b3cae75afd1902f84b6be60ab416c4dc16c6d3304f3b705686bfa5d6f26a3970743201e0f0ca712591cf8e3f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQ0i:A3mnXoZjzyaEFo3+aWiauoEkoQ0i
- TLSH T1BBE4AF13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
- Size 770KB
- SHA256 5af135ad689625cc3584e39d23290fae7ce011c7bd0a7ace7e9fd903b8159ac8
- MD5 55bc9734ad235fc65c0789b4b298636b
- SHA1 5141845493209d87d75f820972d0bc5de8aa6c89
- SHA512 d958eafee6cf7b393caa3c3870f5085a958c2e50f3ab6460ede1425eab31f3d70b5abe6e153d41b1bbc0664fdfd9a97f248d8859ff64c68839162bd548ee6064
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQUQYfgHa9:A3mnXoZjzyaEFo3+aWiauoEkoQSf2a9
- TLSH T147F49F03E7E404E5E127863499E54612EB75BC621B60DBDF236882151F72BC0AF3EBB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 696KB
- SHA256 ffa27f8f7fb291423537f2f8f6d67887c1f58c1b0f2fecb68875b3bd7c2e0eeb
- MD5 58bb5408be2ecb4e62752a8841852890
- SHA1 6cebc511755c5b844c3216064db30da79e9af996
- SHA512 2acc768822902a563c0792a89a387bccc325b4fb3d38881b4ee7d385bb482148e9d45cdf7ea4af0c48573b9b22dbb5c7a2afff4100558aed48a71dfa44b7c53e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQu9:A3mnXoZjzyaEFo3+aWiauoEkoQu9
- TLSH T1DDE4AE13DBA004F5E51A8130A9E54A23FB75BC661B60D6DF236882152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
- Size 892KB
- SHA256 3463612d9b7ab9acc3f74105e20c1a7ce6327e4f956598f0fd80af985cd58bf8
- MD5 5d92b1af471cba51d5dfe254d049030a
- SHA1 57d4388b6f4079106d85efa4cc0bf8286acce8de
- SHA512 216d031e16591a75ad281f02735b3f8d8ee48d16403b289656b7d14d9e0254801cbd0a1c6dd2855ab742a15ff7e3d61294d43da83cb0b664ed7f9bd821b21122
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoQrjCXF7IwZ:A3kMWC17IwZ
- TLSH T1C515AE13DBA004F5D56A813499E64A27EB757C22176087CF53A882252F237C0BF7E7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 705KB
- SHA256 0dbd51a3b1526ce2e94b77be3b5da8817bb2294aa02155e2df559900e48c3a3b
- MD5 bbbbdbebb723339f3ef5eb5e5d18c476
- SHA1 e79c23cdeceea215c2afcaddcfe3eaf7cb8a0ffc
- SHA512 82b34086bff1704933cb63b3f491a97f6a52167986d71517b2661b65d918789a5904735adca1bf3304b426a14e68ab4d68bc429ac17ab4e0141bb58383375aad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQ51:A3mnXoZjzyaEFo3+aWiauoEkoQ51
- TLSH T19DF4AE13DBA004E5E51A8130A9E55A23FB75BC621B60D6DF2368C2152F727C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 748KB
- SHA256 c96c68e5fb96af9d3f89463f50a8eb422b84e4751970649927d4ac066f633e16
- MD5 2b1c1ba222b49ac12cd841e21b1a571a
- SHA1 e6d8e92594ef07fc8587ed3c5ccf61644ef6d193
- SHA512 77c4ca617abb2a86538c4f6642aadfd0f9dda59c206395436e42eeb23d478b8110bad024bd1ad31d5ce2754e2c12faa7e986cfeeef4442bf78709bb7387c62ca
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQiKHkUl:A3mnXoZjzyaEFo3+aWiauoEkoQhkUl
- TLSH T142F49E03E79004E9E556813099E55A33FB75BC621B60D6DF2368F2152F32BC0AF3A7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 716KB
- SHA256 787583bb5e973b53aba5d9e992fb7c6adb88f81d13ea437ea3483054520d2adf
- MD5 d5c2b1463d183ce92db7a29103995c80
- SHA1 b4d97d6130be70ebff24e107d2793e769dbcd862
- SHA512 84b8a24d5dd171fb54e277fed12a6b1c17bc37501ee98ca8854debd8fd668c68bbb30cfed69648335e5703f606d18956ad79a37579e781c694eec15e77d0dbe3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQ5wZi:A3mnXoZjzyaEFo3+aWiauoEkoQ5wE
- TLSH T1C1F4AE03DBA004F5E51A813099E55A23FB75BD621B60D6DF2368C2252F627C0BF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 727KB
- SHA256 db8ff426b9dd1718d297dfe760d3967ad240a31c034e1be0313bda61e2072efb
- MD5 10cc9296b44777ce535471a62345aa6c
- SHA1 d6015fd10294e8bbde710e6fb25e91db96976833
- SHA512 9cebdc5d60fd94c16f2a936382a8af09d293d2e4fbbc53389e15cbe1a7393d95aa06d7d5163fade85d18f74831acc44e915760073b1743975e18d35516b67b43
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQO2+:A3mnXoZjzyaEFo3+aWiauoEkoQO2+
- TLSH T176F4BF03DBA014E5E516823099E54A23FB75BC661B60D6DF6368C2252F727C0BF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 733KB
- SHA256 474b8b2a432b9fd0ed0408979f5d444e1bd6a4b4e12e3fb7dd96fff6c37660e3
- MD5 575bf175ea693f924e1dbcaeb641a8d5
- SHA1 4d31b556f17287a822a26d0b2534fe15e0bd4b17
- SHA512 304ab723774112a785b5f61bcdc32f23b3def78a149bdc7549da0705981403b2af458f2454e573918c8433f7f27d88cc7e7d4442e38ba400142871a9b63b20a5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQ06:A3mnXoZjzyaEFo3+aWiauoEkoQJ
- TLSH T13BF47B23EA9408E5D5069130559D4A12EB75FC1E1B6086DF277C8F212F26BB07B3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 751KB
- SHA256 3e868c5c26a7c8c1c20083c29cf3e9d3043cc0646f85e9a5514a6d86a1419d90
- MD5 24ba603cb9fc78b414fa0abbafc9ab23
- SHA1 4ff1aa7dd2ce073557aa69cd7beb6372df3aee80
- SHA512 9ec3530d632faa7f7ba1a88d7ad53686d173cd9788b6a3bec6a912a8e9355a008ec121ef08d7c5a486c21acd34ade1c7e1094e821dda3d26d9c56f5bb222694b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoEkoQqF:A3mnXoZjzyaEFo3+aWiauoEkoQqF
- TLSH T142F48E03D6D104E5E6564130DD9A4A12FB75BD921B608AFF2368B7252F327C0BF3A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
- Size 925KB
- SHA256 2574b414a22cb18efc4e24523d0b082ebadc0de17eca6b871bb75c62dbdfcf1c
- MD5 008d13f072a8240c02c10dcb712fc8d9
- SHA1 ab3377746e056f02f0919be9a7afa80844b329c9
- SHA512 660b0ff030d17bfa5563b50b01fd9a5a5c7a5f170172c2110f8f6a86479ac70176fe308d7c398c991aeb720243b778c10d5c037932ef40cb6cccab9e370c3a6f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoQSV+PAk2hMH3:A3kMXi2WH3
- TLSH T13A15AF23ABE404F6D117413059E9563AEB75BC121B21C2CF6368931E2F717D0AF3A7A6
- MD5 SHA1 SHA512 SSDEEP TLSH