Analysis
- max time kernel
117s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 02:52
Behavioral task
behavioral1
Sample
2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 856KB
- Sample260802-dcqltscj7v
- SHA256 c7e98b58461bc246b5b2e765768a731024661732ab3cefadc9bc50af21c43ba1
- MD5 908cf60b1110f57537476cd19b3c194e
- SHA1 0821f6a87514052056afa6cc072d10de22f52c76
- SHA512 914bb874686c98ac8b5f47fa8c3e4fb59a7cf80d85695a0318332859e70b46abe0c7bfdae88da40f705e997d4d3c5e02b330cdec003d5677535922fdd7bbafbe
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWN:A3kMm56rp
- TLSH T1C3158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/3332-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c54d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3332-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5092-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b32b-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-275.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-587.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-612.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-722.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-766.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-804.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-847.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-939.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-958.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-983.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1071.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1103.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1122.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8e9-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893e-1502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1545.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001894b-1576.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a5c-1595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018953-1836.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001895b-1935.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c54d-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000500000001b32b-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-275.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-426.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-476.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-502.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-587.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-612.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-631.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-722.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-741.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-766.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-797.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-804.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-847.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-873.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-887.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-900.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-907.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-920.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-939.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-958.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-983.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1014.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1057.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1071.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1103.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1122.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1147.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1185.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1192.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1229.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1308.dat aspack_v212_v242 behavioral2/files/0x000200000001b8e9-1377.dat aspack_v212_v242 behavioral2/files/0x000800000001893e-1502.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1545.dat aspack_v212_v242 behavioral2/files/0x000300000001894b-1576.dat aspack_v212_v242 behavioral2/files/0x0006000000018a5c-1595.dat aspack_v212_v242 behavioral2/files/0x0008000000018953-1836.dat aspack_v212_v242 behavioral2/files/0x000800000001895b-1935.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5092 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3332 2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 5092 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_908cf60b1110f57537476cd19b3c194e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3332
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 856KB
- SHA256 c7e98b58461bc246b5b2e765768a731024661732ab3cefadc9bc50af21c43ba1
- MD5 908cf60b1110f57537476cd19b3c194e
- SHA1 0821f6a87514052056afa6cc072d10de22f52c76
- SHA512 914bb874686c98ac8b5f47fa8c3e4fb59a7cf80d85695a0318332859e70b46abe0c7bfdae88da40f705e997d4d3c5e02b330cdec003d5677535922fdd7bbafbe
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWN:A3kMm56rp
- TLSH T1C3158C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 884KB
- SHA256 fc9c6227746bfe4bc1444722dfced1b036f989bf8f3d5c052e09e3b0c3151483
- MD5 df66720cbe8ca6cb373767fb05948802
- SHA1 987f71839fa4bf26f3a0b7ec5023ac430b0b3c5b
- SHA512 6da0efe3a0219a5a7c9a776856d13d84478a0ea22a9db8f796bec8faf66de0c9af61ceb1e93787f1ea6b098409b121aff4ce49b43dae3f71bc1ab116f05f2071
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWbP:A3kMm56rn
- TLSH T16A158C03A6940FE5E11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 902KB
- SHA256 181041a905a6efeb21cbbcdab22b0d8e2e6c7628fcee9e742025014f8a2e64cf
- MD5 f8a62245f1f712680880f21ef79697ac
- SHA1 26ca2727f9fb6bf393124f2872fa3ef0e93389bc
- SHA512 b0836cf4917ff93063b2f99ffb3fd345681e93eacbb6f7f2228e4b989f53702e9de060f399a147026835bf2023d3503994f6118e1914760716aaff18240254a7
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWA0:A3kMm56rc0
- TLSH T188159D03A6940FE5D11F817499A64A62E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 947KB
- SHA256 984aa2be8483d673a707630b3bb1e16a9f9e43cbc8555a2c3f4374cef0829129
- MD5 312c0f229d8277e67c90178ed1918261
- SHA1 a227a8f4d005cc13985c50ac327590a8ddcfcf01
- SHA512 bcc4d07b9f4fdd956867faf664420b0dbb6ace3828c39b46e0a97e88f407a89e9da36af4c238560a4d46387085993636217cabc839a18aeb94f5c9b24b1dba96
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW5:A3kMm56r9
- TLSH T1FC257B03A6940FE5D11F813499A54662E777BC225F2087DF2354AE293F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 940KB
- SHA256 3c31b981ec9d36942233b5236bf990608775ebed660a4bfb26176248a7a8e8be
- MD5 50af567eb75826e657e2c26733e970c2
- SHA1 8654e2138958cd751d6d4a001a8470c5bb58c6c4
- SHA512 21087ae0e804979a9b7a92b5a2f4e53396b6467412cddb436d99d63058bcc3b5d81b37cb7fe8766d6afa66da9fe1f83eccbf6b78a1e1cacd8695a721838c5e69
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW872:A3kMm56r472
- TLSH T157257C13A6940FE5D11F813499A54662EB777C225F6087CF2364AE253F327C0AE3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 908KB
- SHA256 568a21a36acc1af333bb6a034434da58e8fb59cc7f0e92b781a053086dc9f69e
- MD5 727a6c2e3b47b0267031ca1015a51883
- SHA1 33397c66cb24a26b95d83cc206b9613973cbac4c
- SHA512 5454d0d42122c8efbb38c3f951a2ace8e71fdc9002f1a9e5bf76dbb9f04d1635a6910fa48c3372c1c20450ddffb5041eb2f781e738385e0e828183644df9a68b
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWsfj:A3kMm56ruj
- TLSH T134158D03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F727C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 963KB
- SHA256 3e2a57fe8f44d23bb71ed4dd6610eeb6db5a0a8c4d197b77dac23442e7d06e01
- MD5 c2d360e631f97096a39ecb8b74a446e9
- SHA1 d08cdd840d7c072013deca40d563b8d9d99dc3fc
- SHA512 b1e71983c0ec71611a16c05f8813de27edd1dccce529adbf98edb8e6b21a3669852c1e1b95f9534d6d066808ab4a6dc8fed32f850f05f448315e88fce5820c0d
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWxhk:A3kMm56rNW
- TLSH T1B7258D07A6940FE9E11F813499A14662E7737C225F6087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 9d4a386076bf14e1c2eb9ea1bf4d64492b60be890a278c343b96b941350ef59d
- MD5 a3cf87eaa666fb0dfb3f86fc897b93c6
- SHA1 fea10066bb321b452183f6cd686ab1b2609c6c92
- SHA512 16371623f694ad34ec22f67b5c671c9e0ff30636bfac9985fe86c15ee45879bb44c8a4080e0836b136b60df15eda423c5c1ed463b8dec15c580e654e8cae6c08
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWZ0Le5ji0hmxNrM:A3kMm56rVPji0Aj
- TLSH T139655A16F6A44BB5D02BC078C5D2569AEA733C425F308BCB13549E283F277D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 903KB
- SHA256 1feaf908ea6e6f095f8c9a598b4e720cc9b54c3c25c72d1d74affb2835ed2c1d
- MD5 5b1830604582cecdae8baab81d8b5048
- SHA1 93fb42fd032fb972acc3a27362fa9f08b1005551
- SHA512 f4c538bd4c675e149a29e6e851c11ecb57b0e5a8637b9e4d8737763367fbdf12a76a1f137b6ec43333252544e5fc8292cb553bbfbdbdd2bd891911819b5ab5aa
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWIb:A3kMm56r0b
- TLSH T1C8158C03A6940FE5E11F813499A54662EB777C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 870KB
- SHA256 5bd30e969a1d273d98abdcc1d369093e87066054794404555a989a0316d265ea
- MD5 1c2a333ce5487597764dcf2d9cdd83c1
- SHA1 f8ac91e8842204bdb0a8c4a76570fbf4e4614823
- SHA512 09d7d6a542736946dfb9deabf105358aa9cc83a0b406a99afec4ad812799b7fc73020c1418aada04c8db8bb533061ea2a1d35ad0f87951bb81ddf93fc53f4318
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWLa:A3kMm56r
- TLSH T162158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 879KB
- SHA256 cafedf33d907c047452ab879e3044800e664addd47bb8ce54ae67310b5836733
- MD5 c5d6d3a0ecd8a967f4f06e78b50cd5a8
- SHA1 70d954c309ab7406c8a0353eab8ca116df32bc2f
- SHA512 675d77d273065b061468fd807272d9c7e5757fa906dd8e80bb32a2182d7392e811abe71aec42571a5811efd3e93778ca83bd1d411c04b17aef7d68e47d095f5a
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWa9:A3kMm56r+
- TLSH T18B158C03A6940FE5E11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 879KB
- SHA256 64dfb6a18feae3801c1b5541b0269918fe1d941b097c07abb6f8af54322bac0e
- MD5 2683a3d48b06fcacd9d0596136ba8ea3
- SHA1 d632ba68899378c532f12903fd2ead280915463f
- SHA512 1a29ddb1d5c86569b5f901ea054d6de5b036237df7afa18a19abd02aa75eeff2ed6ac35cf55b81d861c1b109cbcc7f16b037c979c42c78ae12f8f85233387282
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWac:A3kMm56rT
- TLSH T15E158C03A6940FE5E11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 879KB
- SHA256 c1d875ed12d6259553b1334634d7e16ae702c61c5bd4213a7932f7e20dda7809
- MD5 de04e12bea0ba670e57151cf099a91ba
- SHA1 6217da1e7107b3cda1b4bbca8906c9ae32feffbe
- SHA512 054913c5e90c97954da9b5c8cc4c9577b0ee048ec8d7d163b51b29c1aac8f33275d50e39708e6fb9bd9827473f6be37a4cdeffbc78001d3f84c2adf3304f2422
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWTp:A3kMm56rx
- TLSH T1CA158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 879KB
- SHA256 96feaee20f2ce1493721ed40d48b0b5257214fb9c3a967657fe3cc62d74d50bd
- MD5 2926410db23ad830f5054b385097b1bd
- SHA1 0b9c630c61365b383672fdd38a696ef23b645f64
- SHA512 20182c185554333ea7c52790f0021f366a308d357e50d126a3035c70ebdfffd18f1ae1c30205f232539c0506bd2b32e6951d3ad9f1e58c4fc50e719028c75003
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW0N:A3kMm56rq
- TLSH T17B158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 879KB
- SHA256 e159da4219c9645f15d1b23d6ae609cb1a2f17d5d458c0e00c1478b6f32b038b
- MD5 457f348357359bf4ab68789c923d888a
- SHA1 8263008ad3f298be35fd44b46980cf4034c3e475
- SHA512 db2d4ffb5e967a7667f8d37c14c2fbc2bf2902d49c6512aac5c7c6291d3dfef8dfc68ba3eaa486b83722a94bfe736a1401ee28dccc2e1fedfee0ffce9121b878
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWcF:A3kMm56rw
- TLSH T11F158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 879KB
- SHA256 a2abcfe2fc39e55e814083b4acf9c337ccbe0ef1fafb11eb2835e6cdcf135792
- MD5 637fefbe26b49ac30d2733806e569051
- SHA1 eaf65c958f1cb61ec43367b6cd23ec2981b30800
- SHA512 444eded10f1771e63f7e699853108f3074b863064ddc1d77f217b3e424fcbfd175050546e5b9c14d7e282a89f2e08ef50c31b051ea046667c1247114a92cce39
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWJC:A3kMm56rE
- TLSH T1D5158C03A6940FE5E11F817499A64662E7737C125F6087CF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 879KB
- SHA256 bef16c7627be6dac7977b5ef9ff4ff175da06135a4cfad03f03fc13089fc1c69
- MD5 939f23ee3798add65984883ffa9191d6
- SHA1 4b091f9205ae1d26cc978719eaa65186a89c15a6
- SHA512 d99046573d86a33217f83730b3ac83c46c9ece10b9f4094ad15b8a9619435e5817f65876dbe36966477a657838546b6685ecbc7bd9d438caa2c285e41c95ac5b
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWqw:A3kMm56rZ
- TLSH T1B9158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 879KB
- SHA256 88bc73b49686bdae830d1d5bbb70172f16d465cb7a708872712b351613d5ad0e
- MD5 80d926781ef1fb774e9090477cc0c34c
- SHA1 988204cfbbb0b31a6b6c0df56fe0b0aadb864a8b
- SHA512 9fa72f635233797e0d5cafae0dc1b823d1618d9fc977d17c5e792a432216f2386cb7e716dd7e489e0d38638edd96d9202ff094fc4964d6329d1ea01bc12d2157
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWxT:A3kMm56rN
- TLSH T187158C03A6940FE5E11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 879KB
- SHA256 5e1a4501b63b7b86b3a688faf73c61ed8314d009c59e5da73c4f9258882ebbcf
- MD5 c7d18b58b6cd1986a7bb847b6c6e61ab
- SHA1 9b96d48b57ec5e68a471128610d6adf061ed76d4
- SHA512 e640c95455a7d33c19eda5fa9e02abf40235b2ef36dc5528389b456fcf134f0332962d0e6aa92e70c5625ac6337d41583caf29d87493da8537a6249b58d0a8af
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWfu:A3kMm56rS
- TLSH T11C158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 879KB
- SHA256 f6fda612c1d4eb0967b6848528b1f526386d260d98dffe20ead863dd6c5ad7b8
- MD5 406369f1d89fd4815e3e065a3663e1b0
- SHA1 61e80c6c851292caed02da158ea7bc7572bcc87d
- SHA512 29411037d4a917839626b66de3f2c92b552068fc40d532e0f883f3ebcf7b9bc79f6710e9b46df7942c079c6aa24ce04d349b44e95db9d7c30648fb60aa1e6769
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWDb:A3kMm56rD
- TLSH T1B9158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 879KB
- SHA256 ddb67119a93226e7dfbe819b2b703ee8bff725214fa47761c4b623839324fb46
- MD5 46400fd8e46a4d145d56130cc2493557
- SHA1 78afa6498e0cc50866ad1b550277dcd7c4c6dc1e
- SHA512 89d3ed5f36e37bd11f2f4415ed923f4c7a3d4b16f5bfc34cf208e2b6c7306275cd041930aaf1b094bed1ad9d495f89aac0bee64fc2295242445bda2ad63a0b45
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWXf:A3kMm56r7
- TLSH T127158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 879KB
- SHA256 37da7c314d06077d7f6e394f86133bd26693a8a5e797756ee753e8cb127affd6
- MD5 f661282681276df1297b37524ccf617b
- SHA1 0a1f46773046a836e6b8fc9ed570085983427d19
- SHA512 e231d245ac29846ce1fa14ae440d1a4dd09765169c6d9d5d802d5580956376b50caef384d98fa98d6b2131552c5403cd70e8801852232d56c148d612fd6d78cb
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWgK:A3kMm56rr
- TLSH T135158C03A6940FE5E11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 879KB
- SHA256 a76596b6436d3dc7522b7a0d0989f827abd17a89883bb575b21a98b875b52780
- MD5 059de678bbe1ca929346eabda3de9adf
- SHA1 357f83c5d741e6d3c950552ab8740856f8cb41d7
- SHA512 f43949c441dbda82ecf9b3740083c3419723aef0c8b30a1580c65eea4b0f6070ce6a2f4e17543faf20f198f87760e579aca9e71b8c564c60a0dfb7cd61ae3a4e
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWdk:A3kMm56rm
- TLSH T167158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 879KB
- SHA256 d7dfb165ca4ce012832ac178d4b9f34d06b6aaabf7878d439f890ae29ce0c632
- MD5 cd081895f22968807e127f49094e989e
- SHA1 05398e7dbc31244c39f363dd74b3c6d9e6d82ddf
- SHA512 d55c832be79b428300d1cc12e9408d55d41ce4fe316be55220356a13c083a34ddb8c8cb11f437786e0d3d4d7941b53febbd5066a596ccbbafc377e24786f3662
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWC0:A3kMm56rb
- TLSH T148158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 879KB
- SHA256 7da3caa25c97e55f69ab369ab8869e62ecc02178db88fb44ca194081500e75c4
- MD5 26b50e9125908df867cdd0ddfaefc398
- SHA1 5acf51a1b088b1af95be31c69e4f62907d8dd46b
- SHA512 11fe45fe61e847b22bf7e6d72ae577d8dcb3a15e10706a550591380b03e8fdaea62725e82b471dcb18379e52694d4c18da1ebae749cdeba9e1c256bc5c489eef
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWRg:A3kMm56ru
- TLSH T143158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 879KB
- SHA256 cf5f70d54b306c68e2dd165507a9c7667356bba64f08fd1eec45cae57722e30d
- MD5 ea73c5ef7c47c3511fceb4000d3da1fd
- SHA1 c80e4f416b089bd9f93caab9c962b3e29914c3ac
- SHA512 01fea7dc0e5349010e53972ee57f8d3f94b427ea1297add50e54e3157878b9c484b3b45a9a274d3fb268b0bcf8b472b6669f738b66582d7e95588e2399e00a73
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW4r:A3kMm56rw
- TLSH T16A158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 879KB
- SHA256 432110cd0b4aeb1c16efb2384b0e27983923a6892549325705ab5300c057f801
- MD5 60f13ce25d116214b68c544e42459e0d
- SHA1 387985fbb704285f4aaaf4390c2930cca6bbfd71
- SHA512 b33837c4930900f239dffe48f668f1074597ae8d1178d5168a8aa36f9357407bc0e66f537bbc6023229a28edcbb41a475051dd4d96ab0a8b169f3f00ec2eed4e
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWWn:A3kMm56ri
- TLSH T17E158C03A6940FE5E11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 879KB
- SHA256 774024198a9b3ddd514028518278f693824f6dae53aecf78b4224ff60b2c3d29
- MD5 915aa30a63ae3bcaa7f24e5432d8d6b6
- SHA1 8235618529ca5ebd70ba4bd77c9593fea7a50517
- SHA512 f886be706e25d37433a94140d565c9cea13ffff5e1a7d592b4c9afbf36def46407d53a4753c3c5edeaee597043becfa751b71d87a10cdc651f2501460c7e29b7
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW8x:A3kMm56rQ
- TLSH T102158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 879KB
- SHA256 b08e9cd66fdd4667fcd5d39a1843a62ae4ac5ab9f030a988350fa8f2d76f91ff
- MD5 2f4d35a5c92d9f9ac61bfbb1a9733889
- SHA1 e7f9bca9a8d97b0b79232995094715ea0c259241
- SHA512 1f5058df0b020f8af65e0654879754bbea8e4b688af146fd043eb1ca56e36fa6a4b1aa76cbec57db04e1ffe3ed7a33e0d139d5a9eb48fbfa261a3e8bac2dbb16
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW2A:A3kMm56rz
- TLSH T1DF158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 879KB
- SHA256 f5ed0a1f79fa8de0b21e7ab2d82008a98815fcb32c14e526b6821c2022335cae
- MD5 1ad148e53b3faa9875ea65f3a38eef99
- SHA1 f381646a306e6314ca02106100c1a797b45322c7
- SHA512 0a8a0a60037244b676ad3921bce39c87491a6764b8410ca33d81a706299d1ca482071226c0b1e5b2e012937925489ea97c7cae6c1580a93b84acf08296ba5092
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWv9Q:A3kMm56re
- TLSH T1F5158C03A6940FE5D11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 879KB
- SHA256 b004c2d9d5e7cbac82702eaa9a8cfdf81aaf1cca0a5cf877a2960377e50ced22
- MD5 896b4c11729b05b8a43f76678306e9c9
- SHA1 4124e380fd1b3f5ef83cd64052d94ebdc8b5e288
- SHA512 4a27ab05c1823ad837d2d07577de5e6447109b189756206c83daa12f6cba5f034aca06b635a187ce466c2797a7a8ceefaef36cb7ef5547c07c297e97054c1b8e
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWG4:A3kMm56rd
- TLSH T1C7158C03A6940FE5E11F817499A64662E7737C125F6087CF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 879KB
- SHA256 f8e375a530128ec679b56ad7341180a2a2ce897ed327c3891e56fbcecf77de91
- MD5 0a6fe3ff64468b38a22afcc3b5731b7f
- SHA1 66ef1e094a131f9a2934e25afaf80cea854005ae
- SHA512 03970f2f884a90fb68fbc7e80e1d3f2805db64f4f9fed47842e26787d0f3c59b1d9ce1bf0663f1aed193737f207352b98f8b5cd7c611a405470bd03c6cfdde6f
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWVu:A3kMm56r4
- TLSH T18D158C03A6940FE5E11F817499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 879KB
- SHA256 7297561c1fc575049e6e04ea9094862cf5ff6eedfec9d7ebc574d9be5f60c6ba
- MD5 923efd7dc5ed79aed69e902de5a77024
- SHA1 164ca42c0e27507197c0391edb917e2ff0bf719d
- SHA512 8033d1c9a8dfb0a7d1e9d31a792eb25032abf94619a3809f9c331daf866d27c8a02227469d00ca3815f226dd741e767485794c9665270776d004c95b6b958b2f
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWIj:A3kMm56rS
- TLSH T16B158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 879KB
- SHA256 5256913a16438b28274d48fbd2520352b8b6d5947f629fa52a5c4aef47665d7f
- MD5 8a7894c1666675fc80a0110068329962
- SHA1 b9180e829e468effc1d47c39458fd04d9c694c03
- SHA512 a9bf342c7cf8adffef8a6d1fc132fcd8bbf345d5cf5e548094620562c8044ba527ad82773b320442113cbbf84d190c4e08b131c6922ca495606d5f32f4859beb
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW5g:A3kMm56rW
- TLSH T10E158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 879KB
- SHA256 26ec384925161afbe6dcf0ebfdc9c86d60fa1abed81dfda560a4033083788666
- MD5 5592a1f5aa364a3fc71af345ce69bda4
- SHA1 fbdf5d2d2161ea4f0b0e9a4a7b4a38269e02f159
- SHA512 dfd907569df62c4e5d815035cff7bd83b957cdbf07778d69f8242224374cc7cb77b65e53f69cd481f8f022ec94af83ad5ab123efb24604dc887dc0e75dac53f1
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWgI:A3kMm56r/
- TLSH T15E158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 879KB
- SHA256 88d9704333dd51bdb5e80e7422e9005bb52597f6650f108c4666664c304526b1
- MD5 910671449433462304d5618fc700ec99
- SHA1 898a908d449baae9d3c6b0be65b9d6013c27da6f
- SHA512 b73b8160cbb95f4cbf12c6287be9cff2507e6523c20d667199660adda55ca669dc4a2a0cc5ffd6ac71213e6605d12adbbcf4be036ca14a5ff980303a8680895f
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWio:A3kMm56rp
- TLSH T16E158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 879KB
- SHA256 b8297a1d57ac9f3f764e05ee38df762fcd9740258802bd965d1d4557ea13a737
- MD5 414a0e2dbab9fa819a5fecf89bc9d72f
- SHA1 824928f2021314bed008d189dac770946ee8172c
- SHA512 02a528b46718a4f57c32ceb01d2d284c1c3bf48ca1ad31c3b97cec850f8d05ac78fce353f28a74c418235ddd22105820e8892f0740d4adbde8b1dbf9b585f72f
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWZ+:A3kMm56rM
- TLSH T1E5158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 879KB
- SHA256 c5a1ad7a274519b937355d44d114b18f03e5de20730a8cb62d56e16c84be67f6
- MD5 f10e176a587d2f0a39ad8950edff7391
- SHA1 22324e1c6902a2e51a9cb262500b4207e54774a9
- SHA512 81705ed54ac09f7e9dc1cacb373fd9aa5e3c51a0cba8755c21e1051d2ab56d502bf42db43e88c7be6d012f85fd7e72b98a9d9b6fcad0be71d42e1dcf52971b29
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWHQ:A3kMm56rk
- TLSH T119158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 879KB
- SHA256 13657fb458c82a5d10eaa6004bf0af0f733f85b8d8a631374af14cf4c673bb8e
- MD5 08344045a2b780fb0365f76cac76dde7
- SHA1 6c57bec4e62411f43ef34a8b024d36c423b99648
- SHA512 5b1d09164451a55e9049ab766d2e3779635859eedfb0d35c78f9aa59bc87368661ceacda313b8bd8c5392c460624204984904ad45a136b8539b00240c6aaccea
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWcX:A3kMm56rE
- TLSH T1F2158C03A6940FE5E11F817499A64662E7737C125F6087CF1364AE253F327C0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 879KB
- SHA256 74f5cf2cae44b0c461fc738611aba3706152a7105e9e65ca38e248a823fdbbbd
- MD5 92b2afbc06e32de80e5aa19a80695de1
- SHA1 c066080264d44571c89bb2a820805fda8f7197bf
- SHA512 45d9632ba818a65527c0a9d08dce65035b1d983c5b4f458207715bf305b36255e81ffc6fbe2469cd805e1db6eb906312cb00c95378cd1df4c5a2b67c66280740
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWaL:A3kMm56re
- TLSH T1FD158C03A6940FE5E11F817499A64662E7737C125F6087CF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 879KB
- SHA256 58df8032ac4f60c5961c5cec66d0c757005bc1db60aec72ff39539db79f3b3f4
- MD5 3caeb3d0c74cd79b9c5fa1a43e9f49ce
- SHA1 b2d690b888a4e58ec93403ee3ffe342c9cad5a0a
- SHA512 05b6a763eb6517e7a73c5d4573bdf42dcddcca5a7357b18d30f19c4542be4b869a496be15d0d717d93b81c92129919b5b6676af27acd9a724b46d677169f505f
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaW+M:A3kMm56rr
- TLSH T109158C03A6940FE5E11F813499A64662E7737C125F6087CF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 879KB
- SHA256 884044e33d06c9c8fbd22768bc40379a878f2326726616964a59f217b71e8e0a
- MD5 408f24387017b1f7dafdbe66800cd7fa
- SHA1 c61af59f7ba8c9d7935b38704d41baeab1c2a47c
- SHA512 62142a61ff8e8cc0262124abf4918efe3fec4f3fc4ec9c50f7ebefdbeb96d6dc86c68551520935cc23d0b210d5ea8d512e9770cdf8920d964ec6d0309a042e96
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWnh:A3kMm56rl
- TLSH T10F158C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 920KB
- SHA256 9d1b04dd1a1b792589b711b195a1390db9c6066094f81af4bd5e1ab97aa1d432
- MD5 6a4536d6195feb137c25f7f5d9690d2f
- SHA1 ae18db7a9bab271114bdabf3e7d93e6196a993f8
- SHA512 f0fac24619e439c4b57c95942962e2d60f3c3c9dd2f3d85c782eeb95c0629e8bdb4f5ec164f7ad1afe9fea7826575383912b83424c57e6769676035689431f0a
- SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbobZqkaWYp:A3kMm56rUp
- TLSH T1A4155A03A6940FA5D11F913495955A62EB737C125F2087CF13A4AE293F327C1AF3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH