Analysis
- max time kernel
122s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:04
Behavioral task
behavioral1
Sample
2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 823KB
- Sample260803-dk3alaxdpe
- SHA256 ba8579c1cd5431d4a2b12476e7a8f316f2f7862ecf6ca703c8baa94508297be6
- MD5 f86091f9312a14e849bbb90c7940c088
- SHA1 c1c048f42cca00d14672433cc330ead4b3eb6690
- SHA512 061d375a5413da480363e3d5d7a4fefc6de72659abe75ebf056f2510dbfe93261d750c559f3c7b8d6786ffce7b199a11e535c069a4655fb51fa264e99fcca41e
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbc:A3kM/56ru
- TLSH T15F058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral2/memory/6112-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c47c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6112-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e6-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4136-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001895f-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018961-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bb-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bc-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3b-268.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c1-467.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c2-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-520.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-649.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-734.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-753.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-784.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-939.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-965.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1103.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1116.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1166.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1199.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1236.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8b8-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8c4-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8c6-1409.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c490-1744.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c47c-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e6-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6b-60.dat aspack_v212_v242 behavioral2/files/0x000400000001895f-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018961-211.dat aspack_v212_v242 behavioral2/files/0x00030000000198bb-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198bc-249.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3b-268.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-372.dat aspack_v212_v242 behavioral2/files/0x00030000000198c1-467.dat aspack_v212_v242 behavioral2/files/0x00030000000198c2-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-520.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-599.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-630.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-649.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-734.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-753.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-784.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-811.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-939.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-946.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-965.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-1020.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1057.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1103.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1116.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1147.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1166.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1192.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1199.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1236.dat aspack_v212_v242 behavioral2/files/0x000200000001b8b8-1382.dat aspack_v212_v242 behavioral2/files/0x000200000001b8c4-1390.dat aspack_v212_v242 behavioral2/files/0x000200000001b8c6-1409.dat aspack_v212_v242 behavioral2/files/0x000d00000001c490-1744.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4136 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6112 2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4136 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f86091f9312a14e849bbb90c7940c088_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6112
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 823KB
- SHA256 ba8579c1cd5431d4a2b12476e7a8f316f2f7862ecf6ca703c8baa94508297be6
- MD5 f86091f9312a14e849bbb90c7940c088
- SHA1 c1c048f42cca00d14672433cc330ead4b3eb6690
- SHA512 061d375a5413da480363e3d5d7a4fefc6de72659abe75ebf056f2510dbfe93261d750c559f3c7b8d6786ffce7b199a11e535c069a4655fb51fa264e99fcca41e
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbc:A3kM/56ru
- TLSH T15F058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe
- Size 940KB
- SHA256 b23b0801d3bd73fd4b95988ccb07b6ff7815bc7cd97ae14dd33a5b0c8c3c2395
- MD5 3e655be2f5bc5f126bf457ed453fbcd4
- SHA1 7585e74999dcfd84ea788ef0cb1d4e99d56d9302
- SHA512 11a5888d87cf25f0056f9d0c144a6bb6df30fcd5d5b3262eb210b8acbd174c4c7f9559d55c9484ee8cdae5849ccc7b52f1d4e856de8e4e6b1343a7c4a99f7dba
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbEv7MFi:A3kM/56r+7gi
- TLSH T116257D17A6940FE5D12F813499A14A62E7737C225F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 b8d7a81936eb44a2feb7cab617ff0360a443aa5b357e629719809fcd24943957
- MD5 0a33d793415be48fde5e0ed234327a51
- SHA1 6b70761c545e6490a42cc204898b034ad80e765d
- SHA512 5c96ab51abf21fcad4cb6c20ac67e42756ce4ffac2ffcf7834631620b3706281321fc01084770bd767d4c27c3f238cfec2d8ded6d0c0d8918e74cb4b242b2a98
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbk0Le5ji0hmxNrM:A3kM/56rePji0Aj
- TLSH T169554A16F6A44BA5D02BC078C5D2569AEA733C425F308BCB13549E283F377D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 837KB
- SHA256 063ab85d83ff4f9f73088bdf87dc74cd846c44df333f2a3a18b24f0b4abbabe8
- MD5 aa3771a22ca46f30af536b5ddc1d53a8
- SHA1 999080454692deb20d1cfe4f873221a8f04b69fe
- SHA512 6c50181a6e8c22d122741b6c4ff1c152348381424756b711271da72856043f674697d54767da48f09d82bcca6c8a740a4fc7b0d1ece924de42d59b96c6bbd3bb
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbOa:A3kM/56r
- TLSH T1B7058D03A6940FE5E11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 871KB
- SHA256 d5acd9a390209c589a942aefc26803bbd4f398bcf43cfdd21599d13362384397
- MD5 041e3b4019eae57c4608f43f0961454b
- SHA1 7c03829ce5d0d3710a7c5c459b312349a4f0347b
- SHA512 9c88c4855fed829b881351e4072c0f9928a5b1ae97260815d149b8707d53e2a24705589d1ddac8ae1aa2990e45cc5b90c0566280d2c28086c1ad030f8bca40d5
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbNb:A3kM/56rTb
- TLSH T11B158C03A6940FE5E12F817499A64662E7737C125F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 846KB
- SHA256 8f9ba5cbe89373ef105da8b0d756e42da7b9e03f173774980d90cc8705f2dc21
- MD5 cd396ce7e5430f906e98a44c461e6a41
- SHA1 95c22ce15127d5026d6e474d9dd662dffdf78421
- SHA512 54526859ef010e119e623bb273ebe3f022bdbcd7a5576b71566c7dafdae2a033647db36668477e0136ef529fa194e021c4328a767c70116a4482cb8c24e748e9
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbQZ:A3kM/56rs
- TLSH T1A0058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 846KB
- SHA256 3771a992b12aab94c87b203a92b8bb2a7c280032d17029993b1d3de8583fe73a
- MD5 25e52cc20600f2adc84c52813a66f83d
- SHA1 17f8805a3505f0584202d12c77c245f07862f2a6
- SHA512 db7162f877d01ee43e7869d41465721c1ca4b6d82f2c83cbf77afc648a4917277cdffdf4d36399beba91252fd2c62943b3324295dbb57b99739a5bede7f609d6
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb31:A3kM/56rj
- TLSH T1DA058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 846KB
- SHA256 139ef386ee7b8fbab612c74e1da0938af75e2d15074d62992b6527e9b7c4c350
- MD5 972da3d596597c6618e9d395fbc0ce5f
- SHA1 cff7c227f8b5e8e8bdd04f4f6adac0fe6cc3290d
- SHA512 faad846f79025c2021493b693433e7f33781c72029694e3c3e164d50bca1f7595476d508e64c9973378e6e723f44ae10bf2c935e045d88940b6bae7319f5852c
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbv6:A3kM/56rI
- TLSH T10D058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 846KB
- SHA256 c613196ed75a55ad382ba33951526a866c8390229babee2d9fef3541e219edc7
- MD5 8526035b2f524007f12c98f64f1ca047
- SHA1 59ecba7f61e52b51b904b9c3a0823d7d3eb77a9a
- SHA512 81c6a830b58de3f578f31c73dedc6f6c8ee72f78829b2d9fe0a6968b61bc8810fd952bde484d680573a5da89e77f370ff090e72e4007cc42780147a3de6ba249
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbpo:A3kM/56rY
- TLSH T1DE058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 846KB
- SHA256 ae1265db09d3ef15f1b8a2a510a7b748bc2196a85eb965ce70c2034758f89a81
- MD5 8cc891c36e6f322fc30d52767ea825dc
- SHA1 6cde0bdbc2deaef59e10c2292d6d7e539f20abcb
- SHA512 d1d23e9e4e867a4af2c7baa62f2af28ed487a5e7805284318f72fa9076a603cbbe8670ee9adf8efcc5194afc24788f3706b45cb889228ccdbee705ed38090f0b
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbZu:A3kM/56rq
- TLSH T154058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 846KB
- SHA256 80c6ee5b462d3d474b69bed72c2770564ce6c6176a7478114e99a79b26cf24ac
- MD5 bc47fc0edda7f4bbec0654847b14caef
- SHA1 7c174a4087813e88227b8b57cc3e32f68d971f2b
- SHA512 c7356d7f377e0cea9608ae4d5445960c483ff3dcdd5e3afa2a1265e7875465d7685a868df94e8a30b167d6ce39e1b4e1f49558afe99a3647984a602a29749685
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb/9:A3kM/56rL
- TLSH T174058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 846KB
- SHA256 65f6e23752dd96795aae67f10840eac7f95d4207313addc7b864144b0724dd8b
- MD5 e4451e6c25402612bbbbde61271a5c9e
- SHA1 feaa7dddff4b68bca61367be92db6a2f2180e707
- SHA512 04fdf17547a8d63c3d228260f51c2914812016d3dbe5d818ad2a3d07b23da9f1fb15b7f788d1289f5f99c0a87161be1537e444aac6b623332520280a1ada8da2
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbbc:A3kM/56rC
- TLSH T1BF058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 846KB
- SHA256 71dd80fc59c4a6fdd76558c6f978a7060f6db282819b04d0c2b4f86da08efe02
- MD5 9b8f4abcb9b43e7d16a88ebad58b62dc
- SHA1 01ab4a510cf7c1e8184b78218fdd19b822fb69d4
- SHA512 b5d16bdd799bb0419ccdfed71416360111ba1ab103ccbbc8a3f020b62dcddf5ab5e2114392844197eb12c28f85940fc59c78036b75e8b22f682bc756e79a7a31
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbEp:A3kM/56ro
- TLSH T17F058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 846KB
- SHA256 202dfdb55faef21874e071ab9ea976f6de5fda47b5bf530bd767e489034a30b5
- MD5 c654131a36a7ce303b0c5417768392e8
- SHA1 1766b29920059e363432eb1f753e067468142dd4
- SHA512 fc520ecb096a95dc820f74f34f04fb54b1cb2826738f46a8de2f84d7211b09f6ee00080b63fb90297fb07894af9493725726ed9f8a0f9030667742257995da30
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbLN:A3kM/56r3
- TLSH T17F058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 846KB
- SHA256 332fd7ac163d986fc08e61f93f39436f16df50036b5adb0e2990f9fcb4245e53
- MD5 53e32e60775657fdcf2bc7d2a56b53e8
- SHA1 54677e95738972c9379a0bb26da3fd8f140b23f3
- SHA512 fa84b2462b42aaab7567ebea0ce8e5bb4db26fc0c1fb4527b0aa8b8e8d4dab566922477d4a57c08c9d8c0e5b9684e51c6e075c24bdc42cc94c582e6c94c123c4
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbZF:A3kM/56rx
- TLSH T1DE058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 846KB
- SHA256 9483599f8d95f8757809a3a20b1beb4e40513222c9b4f2be657aa24742e69d8d
- MD5 afc9c7adc898c011f0a42d0b3222e6d9
- SHA1 dfbada5cbf7449288cc245f3c33141b01dc26896
- SHA512 602136e475b4da8ece625cd81e7d21c3fff663a4d61a0ce81c08d8ec8738b454de1df21a1795c5fe9251d680cb1fb59f7d8e2e07e0ab0695423439111d5ad06d
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbyC:A3kM/56rd
- TLSH T19A058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 846KB
- SHA256 649636bd7c45fe8d172956118e4529800e135f6a164a5c4418db5c2645b8edae
- MD5 42836d4cd601c760c036ec9033a77be3
- SHA1 7a545ef2fae565a61ec588d48fa943dd8ae84617
- SHA512 dabcf82a28c0f4623c37122ddff788199751c5ed5b8d21f459061e0e00fde8d800ffc53f201e4c26fb763c7923b377658b0de8963b9627dec6cfee8a9aa8cc43
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbtw:A3kM/56rg
- TLSH T1CD058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 846KB
- SHA256 a8bbb88e4c191d40ee3e6462faa744b3b7a0f30363b6eeb0cf3d8f18d2616943
- MD5 3206fb350ccb0492bb46763d521994fc
- SHA1 a23629af2118902eb1aa4fcee94ead7c96eb8e77
- SHA512 bea262b9d0cce81185474e6dd7da846c1f139aee273f8bb035e876d542a1a827d05006137f33214b7d31572e064e0ba7827fbe04447fe2a25592018224b637ec
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbcT:A3kM/56r4
- TLSH T181058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 846KB
- SHA256 424715f4bb1c0c584fba7b54ae539dd5ad97caf5399165314feb612f7d7185ad
- MD5 918d1eef265dd2abda8e5048667b9e88
- SHA1 859fb24900a47a1aa9d5040b6ddbe1a86d703323
- SHA512 40183f3bb9e0e0cc913c169e7937671f3343c4d0b21dfe3320b5ed327c166795ab5fdebb96a74c65d778cd275f932be946c18779e82f9762df89cdc681eb9dcf
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbwu:A3kM/56rH
- TLSH T134058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 846KB
- SHA256 2b2961827d06a720b35e775a329d88f5051245274f2cbcee0cc5000b52d1ae56
- MD5 4a4cf7036b97158e13505ee2c3afb8b0
- SHA1 6f593f2e943d15357eedc09ba8eb056d14add4d6
- SHA512 f51d95c82391cc05b20c473ea59c9cbbb75d92ebcefaed62183351c47eba2a262e89eb8d8130a51d999d808d7e637ab5c0fa91ea2db8f491cb196733dbb59a41
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbOb:A3kM/56r+
- TLSH T108058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 846KB
- SHA256 f92c10710ba53189262bf9ef0ca6e0ae0a605d5989db4dea0bd13c44a4916e80
- MD5 3eef9f7fe929e85caeea49d7cd8e1e00
- SHA1 181bf8ecde979e9173193457c4fcfba8fd844568
- SHA512 37d2a23cb54133c38b3019e7c7239d5750d6989e8bb0020ad08e6f2cac4955218e0e7c575ae00dee7ca49adc593ce4ae4d43a5f8a26406be842f871c5e82cbd8
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb4f:A3kM/56re
- TLSH T177058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 846KB
- SHA256 357afa025c3345c6564bd3a5e7341ff75a2647a72e3fb5d6ce7d082ab781f262
- MD5 c4226b15e697b7f45ebf7963f591025c
- SHA1 f3bdaba0e7f7a9103d5a00100d700f57581cbec7
- SHA512 c73c109d422c0048eb2142dae7db471ba61b00a3fdbc589d63df90c272869119808a76cf64f2e8307faceb43e47e1e1714ed3de98f3ba2a2b50c65630a6718d3
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb1K:A3kM/56r+
- TLSH T1D2058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 846KB
- SHA256 c1b4d9a29f9dcf19093bc76e495d08854a9ae0bfd645edb459f71d03b2a60f9a
- MD5 8e1152f1e82d6f41c5f0f9004984536f
- SHA1 b7d48a03f2f68c840a0d5dec97399bd9c6ce1b42
- SHA512 dd328e1f75e5d37fa4fe5f2179a478759bf3d69531138ad59ccb53730d126beaafde15132ac24079ed7f6fa64434ff13c40e7f8c0d5de8c5a4057f4b12571ef8
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb2k:A3kM/56rj
- TLSH T144058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 846KB
- SHA256 a91c9cba97e16dedf180b81e8ab29676e4f836a58c44ab6eb0fc44253560c29c
- MD5 afd30da21ea543750dc2d826be522279
- SHA1 14e3ad19bed21f73ed5224a06103b76f220b4117
- SHA512 71dc734df5ce41ff380fffe5c4f6d5b64b967de5df2d54f9eca10ced94afa7a51ae9c4d235dfced45d0eafcf9c25f33e21ed80b5f0bcee56251afb6860ee9c8a
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbT0:A3kM/56ri
- TLSH T199058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 846KB
- SHA256 b9b7d8d1244527a62b7c362bceec01a4af232097eb801c56e6fb7c0c585e5bff
- MD5 dcd030cf210c4394a531b177a440311e
- SHA1 05eef604f72252f3a547068657a09b1f44002188
- SHA512 4e5fe6ef3c68245739c6bfb06c3675a87daf654eb4e70198b245db4257381ee1ad2f583f5ee934238b46373aa354ca24d5532e2303fb81b9acc50dfde20320db
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbig:A3kM/56rb
- TLSH T1E9057C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 846KB
- SHA256 d63635264cc9c37f942a633698b1c0e3ad5040a4c53571bdfd58825049539c0e
- MD5 88cd878bd7d2b1b78312c62fd4d1325d
- SHA1 07fd27cad064db8d4d5c661fc469968a3929ed46
- SHA512 15e837e1c12ec7f968b297fcdaeacd698cd0572f0cda06578b1ebc4792d7fee3e3b285a9b6e115696e0679dc4f7610db5c987ec7fce8c726c3bc82565266e56c
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbDr:A3kM/56rN
- TLSH T1E9058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 846KB
- SHA256 79209b65132c9da5d4e334bd7bf1c36de869cd5e00f915be6972d72acbc4347f
- MD5 fbabe85b8c9ba7fac9a0f245929171b6
- SHA1 7eeb3f3de793540b77072df2a059aad15b1441e4
- SHA512 0c91fb673bef768329d57174105b34ed405e989f9438946d381577012795582d996497fc78003038da07f7761c2bb8c1d7415830ff528a87265399c178fa0015
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbln:A3kM/56rP
- TLSH T198058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 846KB
- SHA256 d6076043a365923956d32e9101ebaa460cfa936e1969551c352fb29b41adc753
- MD5 98b7a076adb3ac0d6cafe099d4b528e1
- SHA1 9b21a82b9b54b1dfb18eb1803e4dd8d68f856efa
- SHA512 56d1561d06b8c5de7a59cdffc52701992595f494fe25d62b9b0e62a290017ec762cbc30d653747f094620df2549efa361486d87ab53611a53bcd9cbb8855e604
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbRx:A3kM/56r1
- TLSH T193058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 846KB
- SHA256 d0760f169fc2d4d70599e960bbf02b8661a9e445afbdf0e3afb007210024c18e
- MD5 2d39ef635861fe91546d765573d244f5
- SHA1 9404626e974dd00198a2e38c43cdcd78a8f8d496
- SHA512 cfd0f30763df342af3d12b65e3fe179c6f1ff802eb36224e84fd000e771ce334fd585603687a659802af86711b262a47288e12d1e504f22ea5254738a7aef352
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb/A:A3kM/56r6
- TLSH T177057C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 846KB
- SHA256 b68cbe528ef839e90ae8eb3ef10c11403cb01fa5c8735b934c142e529848f6b8
- MD5 4ab6388f105963f81ca9cc412fb692f7
- SHA1 8c69d9237cfb9528ae8a513b134f816f56705154
- SHA512 5f6b25802249a72ce2f1635e59adcbe947660c65678a6d5a32cf2854ed6f0eaac83a24eb3e6fdc53e7321ada9db363f46f2e8a4d8cf934aeeebf07bc6401ee5c
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbQ9Q:A3kM/56rH
- TLSH T113058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 846KB
- SHA256 29c23db6f514ca15d7b3d00a248d7f31ca9b03d6c5243e528323d76acc622c46
- MD5 118d0d836a5a5daaf8a019de7f8dbaf9
- SHA1 9d9f7a743f43faf57a1ab024b003cbb8e33996e3
- SHA512 d881649821dc4e4a472551b6d7ff6bb23c6dbc6b0f61810b9f07642a856ff004124b9dc2a8d6f3bc018e9472a2fa7f6a4330b666b3b501a6f616d4925bcd8114
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbx4:A3kM/56rY
- TLSH T183058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 846KB
- SHA256 e8ac0500bbffac3d9b3d424bd38c8a4385eb7ba488af6044de0e256f7068a6de
- MD5 caa2891561ac835c94b8438cb23dfb0b
- SHA1 2fa0dc26ff31ac9218ea74b8af90edc39bb76eb2
- SHA512 4e78b555a333e363abd3ec68d140d0ef307a3fa1823576a32f5569132486f7d4e634448d248bb1fa11f55bd37f10692566bb9796d50b6f525996ccfa55d214c5
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb0u:A3kM/56rp
- TLSH T17B058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 846KB
- SHA256 1ca23f26d4336eb34749dae134b68b83e82896dc4fca13bcec3d39fb5114995f
- MD5 8c1381d8e27891f138a5cd044a353cc6
- SHA1 fbc83c16677103f96d8632fe930e456b2bdbbd53
- SHA512 682ceb9e0c20f80c41249ef66595c2e2a9f203964651a095b1a16e134043993ab1b661824bbb66cd2a7bb5142db681c44e1db0daa61c56e6b281a0e8f9303968
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbFj:A3kM/56rz
- TLSH T128058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 846KB
- SHA256 03e83106ff9aa9ae937622defcb90e3880dd3fa636011060df97a0f12e456562
- MD5 64183794c8dd456f521365ec2d7a296e
- SHA1 a1cd7d7ecd75180b32079d61ea8f31a4bc5f97ae
- SHA512 253a53722b5a25de23fe8fcfacf54a632ba48655e11d20529d8ef9fc74f17b8dfad0963de20977c98f358950e9f6c4db1489a96c848a0b232b8d73decda98eb2
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbMg:A3kM/56rb
- TLSH T16E058C03A6940FE5D11F817499A64662E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 846KB
- SHA256 ce486ca472e639ade1e8f21806d1e133eaa5b58056444121c7c315f108bb1c2f
- MD5 925a3ac6f2c41d86721565541d82b783
- SHA1 0ffdb0f49a8a76b436e2616262399217bb454e9e
- SHA512 812c6818150ee7632dcebb76c2c5c23249e4dc9b13a1a416d29b4a24b104fef836eff2bfb2cc735a4f69d18bba03a960b8d71227d8e3ea67ff676c8815fc4780
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbTI:A3kM/56rS
- TLSH T1E3058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 846KB
- SHA256 c79e45d0686883952c8ae2e169ce1b2dd4b58f3197f1b4c46d8128ee757e3605
- MD5 970fbd69370125725d1b09234ae859ba
- SHA1 1188b02a3b0828df3bee0ff9a4ae4cc137555a99
- SHA512 11747c725e58b707c1a44e85322674341a831c06d26b79161368ffc175e6836de5e8634d164ba5376042f302d02af04aefb5b1b2ea9a269c6d3a6223263f712d
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbpo:A3kM/56rw
- TLSH T113058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 846KB
- SHA256 0df268c22042aac45397fc96da19ddff2226503dad9ea4edea7abf558a412b5c
- MD5 88532d05722ba1fac3d5e30d4cba9073
- SHA1 2e49d76d93a55fae4a70a3a4e5cfcf532e34183c
- SHA512 3f664d2de8cfeae9e56d8efadeedec3b208d7e2dacdd364908bf331dadf9666ec4a67cff2122982c56a47d30b14b9f43d28e31382ab84616825a79f3d19b08f3
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGba+:A3kM/56r9
- TLSH T1B0058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 846KB
- SHA256 6c9102b7fd13c79f5288110f50d10815b11aeac58f73e203465353b0873242b2
- MD5 cda0d8532bc9aead9944b892b47f8f96
- SHA1 d5a5a86c4672251888b94bb0770b2f70e07e4484
- SHA512 0f2d86201120af0ef1eaa7a567f95c359b575037dc57ada8329409e1069ed323398567aebadcca8bb27203de2229864593683899cd7faabaf89bff1fab0a7074
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbaQ:A3kM/56r1
- TLSH T138058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 846KB
- SHA256 bd12181389f18b10e9e2b99157d629ad205cc8e42b93c1e9d1b13d258903ba67
- MD5 3bb2d09e714afa011040b4d27bc995ef
- SHA1 ab22b8993639b68f5894fa095825d03f1956e461
- SHA512 48d571d5b26050a21a0763433b1a8e3e9712d212a9f6afc620ade7f6e1feeee86801fea86c7d7bad8cd13433e6b059a9534860d5aff335558e90ff1634aad333
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbrX:A3kM/56rh
- TLSH T1F7058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 846KB
- SHA256 974b8620e4987714c14e18ecbf2561ae2545e399e44992215be3aadccb0856e3
- MD5 48508d12d217ba1dbb82462f6675c4bb
- SHA1 6e887ea88407d8c715409d2b0a5b7f758b0b08ca
- SHA512 66163e9c5e3a23654812b00fb0f27de76be09665e60447f64465b540d61970cf6dabc59c4d229c1e9357b7b16fdc21f46929283566cc7293224f0de5461acf31
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGb5L:A3kM/56rr
- TLSH T1DD058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 846KB
- SHA256 59b5b737830ec3c40a01049938c9d4446b8b4843c18c4ddd56f00ee1e3b1b0ef
- MD5 5964acf4030957cf0d24b66b6b11f483
- SHA1 dce56a9bb72508c5f286123327f929378dc74ff0
- SHA512 f757acf2a775021e2b79f5eaf034240367737c526c335589ffb4380a6c93f7a482a0447ba89cfea5ca6c354fce9b4666ae8680c47094ce9c148348d7a49ac670
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbnM:A3kM/56rm
- TLSH T1E5058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 846KB
- SHA256 181827200cfa5bd92f3dad6128c44250d6d750b6859650cc41dca4d162bcb807
- MD5 e08d6756d3f6261e75f675c40a790d5f
- SHA1 d57fb46ef92f614602cc02c67f3edf3fe190a921
- SHA512 0b1c630148282cad0f1b072c842754153a86dc0a6a3c233fa46b83a87a5e5e9cf6dd7b370c210b069202c48a7b9efce9020f24c5b13eb1ff1392acc94672c20a
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbQh:A3kM/56r4
- TLSH T15D058C03A6940FE5D11F817499A64A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 906KB
- SHA256 51f222efa8726fbc2d3d9f0b30dfe93fd12d954e6ef6a312adc4ed4a79ffe210
- MD5 d2b4184c8e6a9dd0b1b7f101042a3299
- SHA1 749edf82377e1824373bd3138cd0dda69976d288
- SHA512 d70a1b72453afc39b102949256f32c1912b2d457e5058ed5a4deb7b257afcb089786c1250d0156a25fcc92219426db8df663705d626119ef8bf4f948dd33e050
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbf1:A3kM/56rf
- TLSH T1E7156B07A6940FE5D11F817499A64A62E7737C125F2087CF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\plugin-container.exe
- Size 963KB
- SHA256 5eb66341f5fb925c283996b67b482d466caf6b9cb71b4fca4435c3bd2fe5ba07
- MD5 b4f1411f030e9767a9eb8e7fe42cf1d7
- SHA1 62bbedd1b6e3b6b6d9efaa8c55ba1f2fbd25ac0c
- SHA512 ca8084ddbf471f74032fff51d8ec85166cdccd996b5dcbcc194ee1a2bc8f22a37eca5124284df851dafd48a520e9f5b6e73c0303beaa661ebd3baf1f8b874b15
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbm6Iam:A3kM/56rM6IR
- TLSH T181257B13A6940FE5D15F81749A924622E7737C121F2097DF1364AE253F32BD0AE3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 887KB
- SHA256 4820ca91e2dc954b99f00cee148d1a37cfb8ffe54bc835cc4cf3e03ad1d4f874
- MD5 028b9ceb507787553fd82b1a119fc753
- SHA1 6908e519515970f5010adee615c8c8ee42c7d8e2
- SHA512 596d7603da402e2dd17a66fccd4849e2c595032aecfa2cbdaa0b4713bade89323815421c578c7d38c928dccfb0ce3457c3538f1f9527a2a3084ee157b699443a
- SSDEEP 24576:A3mnXoZjzyaEFo3vbaMD5TvinrmbRaitGbjp:A3kM/56rlp
- TLSH T13B155A03A6940FA5D11F913499A65962E7737C125F2087CF13A4BE293F326C1AF3A367
- MD5 SHA1 SHA512 SSDEEP TLSH