Analysis
- max time kernel
94s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 02:39
Behavioral task
behavioral1
Sample
2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 880KB
- Sample261024-c5evcsfs9w
- SHA256 89c102e3ee231679064a738e8ae5596bddf1777333bd02c79631f2b9dfd864f4
- MD5 9fb96357e4a794255735c962357b883c
- SHA1 f61faf4ff910437f729d115f6e9f4e6b0562990a
- SHA512 79576e72035fda105bc1f65e6bbfdd40add02595b91486fa9213e196077af9ee8d470a3d8e28331dd38850f54433a95785ee8a590e7ae2fe081589d585fba84a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxe:A3mnXoZjzyaEFyKUluzyAZYaQPZxe
- TLSH T10615AF03E7A410F9E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/2252-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b85a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000900000001b894-10.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f8-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2252-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4012-221-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a61-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-470.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-690.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-782.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-985.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1040.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1059.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1135.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1166.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000000013f-2124.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000400000001b85a-5.dat aspack_v212_v242 behavioral2/files/0x000900000001b894-10.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f8-39.dat aspack_v212_v242 behavioral2/files/0x0004000000018a61-252.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-325.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-470.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-495.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-586.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-617.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-690.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-782.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-820.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-871.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-884.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-929.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-948.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-985.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1040.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1059.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1098.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1135.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1166.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1180.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1289.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1326.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1339.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1370.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1378.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1392.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1393.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1394.dat aspack_v212_v242 behavioral2/files/0x000700000000013f-2124.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4012 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2252 2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4012 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9fb96357e4a794255735c962357b883c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2252
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 880KB
- SHA256 89c102e3ee231679064a738e8ae5596bddf1777333bd02c79631f2b9dfd864f4
- MD5 9fb96357e4a794255735c962357b883c
- SHA1 f61faf4ff910437f729d115f6e9f4e6b0562990a
- SHA512 79576e72035fda105bc1f65e6bbfdd40add02595b91486fa9213e196077af9ee8d470a3d8e28331dd38850f54433a95785ee8a590e7ae2fe081589d585fba84a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxe:A3mnXoZjzyaEFyKUluzyAZYaQPZxe
- TLSH T10615AF03E7A410F9E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.4MB
- SHA256 450bb0306ffe752e01fe23c95fb6e60d036c3db36c3e2672636f9db7e9a59d57
- MD5 a0f494cab2383a2b1d7d6dfc2a1952f6
- SHA1 9c281413b551b2a6f1f0924f904a40f424aea529
- SHA512 0dbc2806d4e78a8f465da4d6b699080cb4a94ce742b69c9d4cc23344605583c2be20d233b94bcfb75718e1b685dbf3842ad573277166aecf38f7188a64495c88
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQPZxt0Le5ji0hmxNrM:A3kMjKJEPji0Aj
- TLSH T11B657C17F6A442B5E077C178C9E2965AEB7134921B308ACF1399C7292F237D19E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 894KB
- SHA256 c55412f7f118ca8914ec332c5671c8507668a1faed33adfa3373d69e5a4603a0
- MD5 e192d3f9a4f7697e6ee25941aca06abb
- SHA1 ad11afa0249591b4fc84496cb94e6e0f4ec17144
- SHA512 4666d2a50a44ec83d0a79cb06936441693f559d74db16dd8cd76952bf8135265749afc7f8be0f2d8b7c3b3144fe3c6ca5b508277de7914834ca4f1d20b968a91
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZx/a:A3mnXoZjzyaEFyKUluzyAZYaQPZx/a
- TLSH T17F15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 903KB
- SHA256 8a6d5e4a9911988e7ea027c3dec31902b3b7eac43c8015c8e13398e559e27fba
- MD5 78807c19a580a6e90f02077f5bd0256e
- SHA1 49fee878204a349ebec6ab03c845b61624ce63e3
- SHA512 bb547cb7510410fbff354e5989f8b703359d6a53714207b84cb3f5aa85c2a0798ee051990a4a2064b17579865c5bbbec6d901433819e5d65f8f88906ec38dea6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxe6:A3mnXoZjzyaEFyKUluzyAZYaQPZxe6
- TLSH T15C15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 903KB
- SHA256 df3a0c017711c2b30faa02656f1dc15a6b220b04b56d5b81d9f527f1fbcfb22a
- MD5 3817c7ec483c57b5ac8125244625c740
- SHA1 170c527a9cdb23696a288f771324d8cf4ac3b7fe
- SHA512 9973b286dc000eabafac2566b1712731b32370130562592202e34ab4d53689926d50b61512b561c9a393114a0f6d16f3387027fcd0dd0d4279fa74977b69aa30
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxu9:A3mnXoZjzyaEFyKUluzyAZYaQPZxu9
- TLSH T1FD15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 903KB
- SHA256 8899028c7209ddd19818638ec01354e87323345758e2f559bec0ac96000a16c9
- MD5 41e7e2d962fe092b627f7be622cd6c9e
- SHA1 5aadb63ef22ec14e1765c30377898b366a5611f9
- SHA512 1673f17fa1455fe995e85fea76aa1bebd80b1888571c98f09d0679096bf86884cd646eb74f4d347ec60f1aaf37b7f3aa46d728f31fb5ba87348158b08c3fc13d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxuc:A3mnXoZjzyaEFyKUluzyAZYaQPZxuc
- TLSH T1AD15AF03E7A410F9E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 903KB
- SHA256 0afba849693cae12818208e3cbae2571302a2663f50192d716424807ae66452a
- MD5 fc7c735087d95f60e770f089251d3790
- SHA1 29fc92d11997ac11e337612a56aaac6faff049a0
- SHA512 515e472aa6d4b25e59ac7a9cfa5f99eec19421104567daab7d7078acc4339a682a30d5868e737232ebee2cf6d0533f9fd734fbbe10f95e69fbd709fbd8ff02f1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZx3p:A3mnXoZjzyaEFyKUluzyAZYaQPZx3p
- TLSH T1BA15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 903KB
- SHA256 ff37634c13c54bfb140cf130e3b13ad8d3c64e1ea52563087a10bbe250e167ad
- MD5 7c440334e5695bcb0e9b7848fc1e225e
- SHA1 2a64de0603496bb2366ea956d7ee213c08116267
- SHA512 1f1818db3e1aea94169fa2a007278f62783c465a41af01bfd266e816395e37d420a81af6e6cc52c73c042efd1f014b378f6ae251e661694892ccb578e05ca16c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxo0a:A3mnXoZjzyaEFyKUluzyAZYaQPZxoN
- TLSH T16A15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 903KB
- SHA256 b58f5554e08dc9b954ca2b83ebe7be841a74db139ab128cac39a90ebe461f314
- MD5 cf58352f17349ca83bca4debf4e80b92
- SHA1 499217c4f782c9a6b6425363e1ecef163b90ffde
- SHA512 13b150c351791363e56ff21c986abb36e093230ce6804775622cf11fd2c927dd7d164697a3a40555c8970922b471b2b79f59a4a9c77553fa943a348143ada892
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxwF:A3mnXoZjzyaEFyKUluzyAZYaQPZxwF
- TLSH T17915BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 903KB
- SHA256 c0bd480d3f44742abf3e8276c99f5ef53e300b49134fbf81e0c7a64b74388832
- MD5 01f89b7753a815ec2f943d0ba1e7e8f5
- SHA1 73695828ba2c3d4691cf35419d08ed4ac340097a
- SHA512 477bf8a535939989fde8358612ef2b5208105fc6b34c66f7b11f52726b08ae922b9c938c543680f2b6268606b2011f309f08c7cae1c69d3d03d650174fbba1cc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxVC:A3mnXoZjzyaEFyKUluzyAZYaQPZxVC
- TLSH T19415AF03E7A410F9E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 903KB
- SHA256 9410c9762723f58c51ea811d68d25d23543d572ea3d1faca1f078eeeba292893
- MD5 3ebcd4f6a30e5a00e7404e7d7e46066c
- SHA1 218ed585707d231b1257968f2086f6101f12c98b
- SHA512 d02846a730b2a1be981523f28d7d93c6d0a5bd87ee84107d5dca5cef41303b78863e03ea8eefd327941759060ef2cd8b77938bc16adcb5e99161e3cdf40844b6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxew:A3mnXoZjzyaEFyKUluzyAZYaQPZxew
- TLSH T16C15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 903KB
- SHA256 8f74d2e5f6c6c5d92e88bdbe895737e5a98754d63996eb881a7a7613f43209d5
- MD5 b608ccd56f6f86b74855a6eb862b5407
- SHA1 f64804c5a49ab5c90ad427379633e51b141de242
- SHA512 7e6acfdebb25cf836837da7444a1a7636661001d814c122d7e58b970e0f4090ca3a25d4dd069d0447825e023af9620d6adf17ad17b2bc18818aa748112430b4e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxNT:A3mnXoZjzyaEFyKUluzyAZYaQPZxNT
- TLSH T14C15AF03E7A410F9E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 903KB
- SHA256 e5e4b5d77738835a51f7f6299483a7149ed2ac1afe7f0fc7ec91513ef398695e
- MD5 0364e80440487c20968f380b80990ef5
- SHA1 f38f121302411a360cb032841d5e2f8e3b9d802a
- SHA512 64dee60a997bb4c721af812e9f368822facb917effcb86c5048654bc4cb8ac37e671ec5f0affbbb07ee85f6abd15327d3d6d9d8038d452c67a29a55132cb45da
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxTu:A3mnXoZjzyaEFyKUluzyAZYaQPZxTu
- TLSH T14215BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 903KB
- SHA256 b0d1d4ea5d8af8eeb6e2b09416aeb5bf3598547dfeb6bd358bb6a8f75963ea5c
- MD5 2a3fe49de3126482b194b5060a3a6df1
- SHA1 d8de4520694e26922fbbaccdd097146200718c5e
- SHA512 9e1d1725f091b255eb0b0059f84d90ca51c3671a7df39bac9dabf40b2d3e0c632626fac1f84d773b221c7fe6c2ee04413ca207fd1586f9d4ffd7210921c793c8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxHb:A3mnXoZjzyaEFyKUluzyAZYaQPZxHb
- TLSH T1FE15AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 903KB
- SHA256 9bac82704a364bf2a384739922bf00e2428381359ac057cf7dcd3f2536f4e5c7
- MD5 c804c3ea9152cc1d4ec3b909a48aa03f
- SHA1 712be58da4583e4a411ca41f240c5a137b0472dc
- SHA512 aec64bf9c98f300a959c1e34ac54b7ebe7ef9d7e627e7d929de2827f8c6450ef274f65d54381eac8d30a275820589ddc077032dab8858e0fa9247c88670750a5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxDf:A3mnXoZjzyaEFyKUluzyAZYaQPZxDf
- TLSH T12A15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 903KB
- SHA256 4ae07f1a7c85ff3448c773135d005d606b600adc57981f95089732d36cc6f2ff
- MD5 790de0d279b844348f693fbb845a5e15
- SHA1 c5a22c59e0eb62d05788d5867e33106ea9d8df9f
- SHA512 c4407caa7f9384855a0641bf0d7673d189c350e5f41dfd74c85c431e52ec9883537d97254b07870e63353d29531d21bf66e8a58701b353a3abfc780933638594
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZx8K:A3mnXoZjzyaEFyKUluzyAZYaQPZx8K
- TLSH T1A215AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 903KB
- SHA256 c834d42fb13e5bdd9d4e5e1cc1c573cc42d8f587cccbede5cfd017ef78ca1bc6
- MD5 68738e474141a56c347c553b7fdde7df
- SHA1 568a2742a96172286c197afe806f530ff53d3803
- SHA512 9ed36e6bf03105876078c3f247af60114da05bb1a4638648f74fc0866a061c1b1067280e989ddeefba0097eb9a7a82c87b8eaad6966c0db5840afb7ae655ea37
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxBk:A3mnXoZjzyaEFyKUluzyAZYaQPZxBk
- TLSH T17715AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 903KB
- SHA256 6b9002deb614c81ade9055342c0569f1cacabcba7b79521ccb441b27597c5385
- MD5 34091523d5d0c2cdc1a76ff8d2dfb1ac
- SHA1 a0bb22e048062e53db5000f752541a81e8ec6cfe
- SHA512 b2db2689f917d743bf17b9ed674cafe05ddd12276e384481f9dd24d04afecfc81d24ed65c8dbaac808def425cb4bda955de2324ea03638ea084076b62a718051
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxO0:A3mnXoZjzyaEFyKUluzyAZYaQPZxO0
- TLSH T12D15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 903KB
- SHA256 241d9e56695356f1b6fe2bf86936b244e724d67421b4b06df84dfe18e86ab1a6
- MD5 80f151fd3299033eb2c250c353fb9421
- SHA1 b09da978247c54355dace1e7958020a43aa0335c
- SHA512 103f6b749f9053e851f1f8eef5fffc6579bdd60548d3268ae8c921308b153b78c6a8a11b098809c100209ccf52723352a7477d83d14c61aeb25690c1a8d1c780
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxd70:A3mnXoZjzyaEFyKUluzyAZYaQPZxdg
- TLSH T18315AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 903KB
- SHA256 72c9ca507f8e2c7a0562cf8104d3c4df67dcecdc8e984cdab894c4a4ed3e8d5f
- MD5 99685e88c85e1de1a0f692e8b15c6888
- SHA1 6521d67733d694ee25a9044ed0efa8a481da9044
- SHA512 6063d97cfb122f42758ec2cfafcc07e72a92bcd49bdfa2a17e569a57c67727850d7f347fb29d1e4253d48aafd938f55085af9e0d8beaddc99036512f02d0f696
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxMr:A3mnXoZjzyaEFyKUluzyAZYaQPZxMr
- TLSH T1AB15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 903KB
- SHA256 726535c4e65abfaac7bd0186cd068a02f4884fb2bbbe4cfb02a6eb59c9e8bca1
- MD5 747437e21c8fe1ac23dd32a0662fab66
- SHA1 74e823dbca225a0cae419c21f1945341034360ab
- SHA512 62e5037e4fa3e664262054390df42a3b0a022713184af7f74c8984367ff152f7ae3e5bfef7e1a8159e72387976c1d1f10792ee6fef5b15c484b980725a268c84
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxCn:A3mnXoZjzyaEFyKUluzyAZYaQPZxCn
- TLSH T16715BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 903KB
- SHA256 470ea3fb93243962c565caafd3962ed884cc52125da06e4c37e75b5f68c86f23
- MD5 603afcef4f1e9eb22aa301ea9c823f77
- SHA1 ffda310765743d8fda7353623b6ec592f79bb79f
- SHA512 0293aeec2ba46124585ca371a603b654dd76139e164b922d1b409015da06fe5ba0da6eb86730f72ee8c9795223aedd0852867e55c8442b3597a79bc741b1865b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxox:A3mnXoZjzyaEFyKUluzyAZYaQPZxox
- TLSH T14315BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 903KB
- SHA256 17a8963aa9d9a813dc894d9b1f7e67641cc6f6f3444c1e51a91a511ce594771c
- MD5 6a60e9dc0aba3ea14209742b571b4909
- SHA1 1a1c540f21158e0762d697a7e38707d2b75a4e6b
- SHA512 5743d7d15376bb59b2c8baa4a8bf28117c8810246a8890adb0aade6e81e2430e395ff08e0fd664e269af93f3830edf029db4acb610f260a11ccbff8e81d21956
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxaA:A3mnXoZjzyaEFyKUluzyAZYaQPZxaA
- TLSH T14615AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 903KB
- SHA256 cb1c32891337895f1ac86403863abc9401bb15c1ccfe145765b2f64cdfa0081e
- MD5 59889ffcbb8f8d3f7d059dfad959b130
- SHA1 1dc86a5184d20bdb1063cd6867ae8645e566b528
- SHA512 13a0702ccf21e3eebedef173891f85e994b32a553008a339cc75c22eb0239f4e4a62632f56acf79db26ab16430ab0899fdbb34d5319f3518552bdbd3fa4bd9b3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxT9Q:A3mnXoZjzyaEFyKUluzyAZYaQPZxT9Q
- TLSH T15615AF03E7A410F9E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 903KB
- SHA256 9058e106be53b49faf30b5acc755b3ceaac6c9709163c868e7531d01b9fee981
- MD5 b26892a97ec47eed136b2e9c985d745e
- SHA1 2167185efe4fcbd7612ee03967b51b2b24ef8d02
- SHA512 c10aec0402ccf5bdabc9e6a3c8883c47aad8c1822f5da9335ec32bbbf574c9cfb402bf676e33d17bc2bb9447739515caca283b1eee91b0d8fded1a7e94aba934
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxS4:A3mnXoZjzyaEFyKUluzyAZYaQPZxS4
- TLSH T1FE15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 903KB
- SHA256 44ab672aa5727039c8dfd43a98b249575ea9e5c7463bff28a09769e1dd68d111
- MD5 82f92053206583bc323f629183c765a8
- SHA1 2da372546ea96c97b447319eed6711850054d443
- SHA512 11beadc84bc41d41b8766ef5adf6578fef251ea7545c384e6e666891035bc9a27b5201c005851485e7c3300b35df1eb329c22bc153dd4138e178bf06420e6caa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxJu:A3mnXoZjzyaEFyKUluzyAZYaQPZxJu
- TLSH T11115AF03E7A410F5E52B823499E54612FB75BD621B60C6DF236882252F637C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 903KB
- SHA256 cbf4294baadd6daa1ac1c34380dd4cebe651f21d9b053ff5e10fb4b98588cdb1
- MD5 551321e77df4fd2d6ad03f5149d3444d
- SHA1 7ea9b83bf6063c85a68877b1305eff7029e45111
- SHA512 3072f0429b686b5c1d5e61b1cad5c03f697380ebdd71cccf36e25dedebb15c0e2d4632d9eed9b79c66e482ee5b8df68f6bf3c86b84f58036ca86b85d38fa1680
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZx8j:A3mnXoZjzyaEFyKUluzyAZYaQPZx8j
- TLSH T1C715BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 903KB
- SHA256 32216bb2817ca6e9db81f4cb205729b8b548023fcf716ac4304c58e3e44bd81f
- MD5 40866e5079ed7d3fd8ab771dfef0477e
- SHA1 dfa32c139ec8cc73abf8282021eb3d049480fe17
- SHA512 e2f86b59bb47d069ad60740196504e765d406b0a4a6182748451a7b0c93bca81990b18c0ac419252b3f83a0a297d30807efa247f2b281b2a21cce066e00600ad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxdg:A3mnXoZjzyaEFyKUluzyAZYaQPZxdg
- TLSH T1FC15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 903KB
- SHA256 0309d56a621abe260c1788cc9d955866672912cc93dcf38102cf588968fd93e8
- MD5 47fb755a1295c3a2ec409d7134f6dfab
- SHA1 bf5ddc131d7790d0664a6705c06221f067855aea
- SHA512 ef0232a5b8d214aeb6f458c0fa147ff4972271d03a2142cd3e69d7586f0a0ad8476b53d6ec599dd5ecfc0d77ce49ef69b579f418e0580a766ce73a236a39be1f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxsI:A3mnXoZjzyaEFyKUluzyAZYaQPZxsI
- TLSH T18915AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 903KB
- SHA256 49ddba79a4896d1f38ac67934b2218708b00897b4b93a2c6cc281da976a036c2
- MD5 d2f36d74283f79dbc3bac4e7b498b4de
- SHA1 d6631740d4f2265080144cd193d863d255523821
- SHA512 3c765c6f0d62d0766384d649d55195005325dd42c29868cc7c99d64dca8bb01f15a90508873dd61326408be884fd081583e5bd9da6973d439800041ddbe47ca3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxeo:A3mnXoZjzyaEFyKUluzyAZYaQPZxeo
- TLSH T1C315AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 903KB
- SHA256 f1fee3b33e8b8206aadccd429db942e52318afed0860354c5d8a6e093974f0fc
- MD5 4b7af17b3582daa2c2d6e4a1c63dfd48
- SHA1 bb95dc17bedafcfd1196954709ab9acbf1e55760
- SHA512 e97bea11726baacbe8a58367875690d2e89a2c236fa30ccf854aa6e9800418f2b513a23f8eb238bccdc00f8b5a38e82d52f4ea92de94c6113bb69d125721b19d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxl+:A3mnXoZjzyaEFyKUluzyAZYaQPZxl+
- TLSH T18415AF03E7A410F5E52B823499E54612FB75BD621B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 903KB
- SHA256 d2dde281dac6f5230c39308033870504eb03bb85c6e54c656723af5f0b9639c9
- MD5 c4941a67f5a13c6d302b37cd1e4a9d38
- SHA1 18727a52636b961e122ad00eb7872796018fe645
- SHA512 caec6283ae2c262e7b0c8ea3e8fd3db9f2eb40e7476cc811d075c108ca31c3a25e00e021a03203a29d19992e9ea81a4ed6289a65982ccb021e3d074c778d3def
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxzQ:A3mnXoZjzyaEFyKUluzyAZYaQPZxzQ
- TLSH T18E15AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 903KB
- SHA256 1cdf7afa04ea619e79e8ce99155c32579cf815c6fc4c1f8c6b65cf274b8dcae2
- MD5 2b86a622d1269a066a7ac54c50ae306c
- SHA1 37789c9bff79382d04d40aaddc35527a8191f4bc
- SHA512 99219944e292d16e0fa641d244e43a6d23c670e44dae682ad8a6ce53f1c15d3cd86d70f3a05f469659187953c2941b2371fa1568d7d8900b00fcc62133881de3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxYX:A3mnXoZjzyaEFyKUluzyAZYaQPZxYX
- TLSH T17215AF03E7A410F9E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 903KB
- SHA256 5e4474e663449607c8d36f676fdaa2059b3880738987146cd315cae5a9ec64c8
- MD5 4a803b1a7567ec2cdc6d105baabeee00
- SHA1 61b0e81f47989d8faf4f2ccefcb5b27fd77a7e07
- SHA512 56e0f9edcc2697100cee6aa7bc724e16b7efcafc3134f6f98b218d2074b132a7cf02c12a8790e5015bbff2c943415302e03b158abe1631830ba45a4b307da139
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxOL:A3mnXoZjzyaEFyKUluzyAZYaQPZxOL
- TLSH T1D415BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 903KB
- SHA256 1fd3e079eedc96f6c364e0d6eda3e3926a875d0c3486eade5db8b995964ca228
- MD5 8dbb36292652af3a474454e90a7c992f
- SHA1 399a35c3d5566f0b86c46e0b97cb0feed55e769f
- SHA512 faafa9146cd989365e56eac211371e70fe71f00b93c4678d3a8cc2fcbeecb21f1a697e119b112c0e76fc433e583538a032f532fb8f88340279bb356bcfd03ffe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxCFC:A3mnXoZjzyaEFyKUluzyAZYaQPZxCM
- TLSH T11115AF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 903KB
- SHA256 fd47921fdbca675db41c308e4dd152b45d96f860d709f9d0ec71a8a52a1b01c5
- MD5 c15b791d5244ceeec4f3fcffb9e57c0b
- SHA1 c755cbfe4e7453a5dad3b08e44bc0fbd8863ec6e
- SHA512 b0e5fa733690906c29ccb01bca969838180965866b8bf97e95e8e7e58f86bb48e8144b1d19047b61f8c1663f313b5c634ede9ec7a6a2b2a7c73d6e3096d34551
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYaQPZxzh:A3mnXoZjzyaEFyKUluzyAZYaQPZxzh
- TLSH T13D15BF03E7A410F5E52B823499E54612FB75BD661B60C6DF236882252F237C0AF3E7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\InitializeApprove.exe$
- Size 1.4MB
- SHA256 05343292b0da73496454382aea919a8c748b9574a158cf79ea76f8d7a9504f15
- MD5 3f5cf01b5bd84fb179eeaf0a12ca55ad
- SHA1 4af8d31c6dfaebfff46758a30283b54ce67ed70c
- SHA512 6036b3eb1d87e556754df16c9baebe016ad71fe78f4c8ccb4e508378e377a5c33d359e8228dc1f3327cb5677494aa1b5057118866ad9dd0ec3f0c1e2db9aca45
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQPZxsRuF+NA50yfJ6C/+mGAvDE:A3kMjKJx+5XInmGAQ
- TLSH T14B65E103E7A410F9E51B863099E54612FB75BD661B60C6DF236882262F337C0AF3E765
- MD5 SHA1 SHA512 SSDEEP TLSH