Analysis
- max time kernel
123s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 15:17
Behavioral task
behavioral1
Sample
2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
- Size 898KB
- Sample260715-spcm3afs8p
- SHA256 d085ead9ce522cd0d74ba5b3160af8e3ccba1846777b6be3306c6b2c71e52afb
- MD5 af3937c3c42df89d15978d64d5003046
- SHA1 81c4949799a89736b6943a5d8544f802748f71e7
- SHA512 536c3844492c72c8fcde4d78ee7b8b653550885c31b80e0df945dadebdc37cad954c2f7ebd9c1128e4f638df685925ecf46791645de05c3db1ac27427c5f90fb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1o:A3mnXoZjzyaEFo3+aWiauoOas06zA1o
- TLSH T113157C03AA9000B5E11645305AA5962EE7357C15DB538ECB23589EDEFFF1BC0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/3284-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c519-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3284-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4756-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189a9-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a83-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-283.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-522.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-675.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-850.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-927.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1407.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893e-1496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018953-1578.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c519-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x00040000000189a9-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a83-258.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-283.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-447.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-497.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-522.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-601.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-632.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-675.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-730.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-749.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-792.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-800.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-850.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-863.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-882.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-901.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-908.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-927.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-940.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-959.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-1009.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1053.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1060.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1097.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1110.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1141.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1192.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1229.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1334.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1341.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1354.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1379.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1386.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1387.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1407.dat aspack_v212_v242 behavioral2/files/0x000800000001893e-1496.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1540.dat aspack_v212_v242 behavioral2/files/0x0008000000018953-1578.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4756 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3284 2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe 4756 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_af3937c3c42df89d15978d64d5003046_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3284
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 898KB
- SHA256 d085ead9ce522cd0d74ba5b3160af8e3ccba1846777b6be3306c6b2c71e52afb
- MD5 af3937c3c42df89d15978d64d5003046
- SHA1 81c4949799a89736b6943a5d8544f802748f71e7
- SHA512 536c3844492c72c8fcde4d78ee7b8b653550885c31b80e0df945dadebdc37cad954c2f7ebd9c1128e4f638df685925ecf46791645de05c3db1ac27427c5f90fb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1o:A3mnXoZjzyaEFo3+aWiauoOas06zA1o
- TLSH T113157C03AA9000B5E11645305AA5962EE7357C15DB538ECB23589EDEFFF1BC0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 927KB
- SHA256 ff95ad8dbfe4fb65c865c6d09dd1405d7093e33706c1d530c59103952b6e0da0
- MD5 c1f3b63568550035d3a8f0cbf5d47710
- SHA1 212c300a2756057a422088f35a882ce755229646
- SHA512 127b8d5685e1f4035680180a7c66c5504b2ef86a2a6f901e582ca6366fd6c6b2e83833287023208473426a08e5d5ac64fa8765c4719406b10311902f3d5eba2b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1aP:A3mnXoZjzyaEFo3+aWiauoOas06zA1aP
- TLSH T1DE157C03AA9000B5E116453059A5962EE7357C15DB638ECB23589EDEFFF1BC0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 944KB
- SHA256 a6a318451516c4e5b0aaace9f4938a0ad93527fd164ccedd43badc47cd96296e
- MD5 068158e0c8940fb427a8f1b09d698a84
- SHA1 af9c5090976d8d7aa6e8207d49e556a07eabda79
- SHA512 ed92c4902b5b07ba2503c32fb7ca278980ee783fe42a2ffd020ff09ac3611d72742ebb90df490a5e098de2757b2843efe90009ef4cdedc069cc215d1f7d595fb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1V0:A3mnXoZjzyaEFo3+aWiauoOas06zA1V0
- TLSH T19E257C03AA9000B5E116453059A5961EE7357C15CB638ECB23589EDEFFF1BC0AF293B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 950KB
- SHA256 ea49ce5f896aa4f00b2ae0a854f87b9d5d3af674a699e66b2c20df0b8cb53f6c
- MD5 71321b1fb6652097059e67dca87d2cd9
- SHA1 c433e91378c7361d92f17f52a431e124d0fd2a71
- SHA512 35e4fd4b171de549eff34810a10d5c6272cc9115c10ab0c658294feb9c119a4573ab5ade7fcba20c4162f95e06f0d74eb593a9f593bf369e8f1d2971e4c6c3a2
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zA1jfj:A3kM+j
- TLSH T140256B03AA9000B5E016453059A5962EE775BC11DB538ECB23589EDEFFF17C0AF2A3B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 c373896fbfa928446ffd375051df92f1ac889ca048bf4225f4f06ecd2055a068
- MD5 74fb83aea3b1b45591bd94b3e240f0c5
- SHA1 833f3afc4ca3af31ac1bf8d1c7c6ed767e361555
- SHA512 1eeea30d523b4e86a7c0ee16b68a3b999060bc96d232abd53968e86011e6f1b3364c8175f730aea6d5a622f91280fe8337c58fd91e1f2433ed5b13a06b12784f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zA1w0Le5ji0hmxNrM:A3kMlPji0Aj
- TLSH T156653916FA644275D022C074C5D2A65EEA313842D7338ECB13949EEDFFE26D19A3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 912KB
- SHA256 640cf0adf1431832417ab3cf53cce9566c75aaf36156233e9261ea102d51169e
- MD5 9c7c6bcec950cb1f49d1d3267fa02b4c
- SHA1 9c5a9250199c1cacf3299dd66a11f72eea2c3302
- SHA512 32a8f904dd9193e441d62a2f5477d8beea420a40878fedbf6284af36150c65243bac82f00d889bcf4c3c3654690e62501e701374dd98b5e95442c25a7d72b365
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zA1Ka:A3kM
- TLSH T119157C03AA9000B5E11645305AA5961EE735BC15DB538ECB23589EDEFFF17C0AF2A3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 946KB
- SHA256 3cca0aaee4b3e0b7ba6298ba2b779addc037fdca466fa32d368bcdce4642a1f8
- MD5 d21c4f13111a5cc0b78004abf6316a48
- SHA1 932f68513d86e2c17710ee7cf87bec459009af1a
- SHA512 f27f6c4350bf4df8578a2037d4188e78ffd535b5714f82fbf370acde348ac82e3631645ce725c05a76bfc75b49bb9a3ba1602693df5480f24d6830a2d60f2bf7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1Zb:A3mnXoZjzyaEFo3+aWiauoOas06zA1Zb
- TLSH T19A257C03AA9000B5E116493059A5961EA734BC15DB638ECF23589EDEFFF27C0AF29375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 921KB
- SHA256 4f0f87d5e91793b9691ae55aff8331971dbddfd3a29172ce0aa6297e2cda96ec
- MD5 1f1f4cbc867d75b05add3794ba8e846c
- SHA1 86f2f48f45b651a926b5be7ba41ca0082c3c4a0e
- SHA512 edf4974d027249d0c4d64aa153d6751542be6569072ce96fcb982d9885c3c013058e6d3457e11e5ddc8ecc56bc48710107f9f55b027ca572e770a7ebb6610356
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1EZ:A3mnXoZjzyaEFo3+aWiauoOas06zA1EZ
- TLSH T1DE157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 921KB
- SHA256 bd51b278bfcb474aa00d7be6a4fc433c666f0278c675e5d38aa188eb1773c416
- MD5 17cdbb2b5bf568aadb6f97b06469c8a7
- SHA1 75d00808bf43de1b92b254fdbe1075c3bf654773
- SHA512 8707009e05890ddef3432b45e55cccdc85a7018b0f715a7e9b8f7991d0f9106cd6c6a8022fa6315e97d39a16c1b3b9204d56cfd8b4d7b2de67c42c9f2c510815
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1L1:A3mnXoZjzyaEFo3+aWiauoOas06zA1L1
- TLSH T15E157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 921KB
- SHA256 2b37606940a65893e6a36070f38f3df85bfb5b8999af89cfdaa3a665ad0a102f
- MD5 c5b8a27a4a9a693e9813822fb064396f
- SHA1 51f87d06a92f10a4c508dd078917ae7321290a6b
- SHA512 cea25c123cd5ebc3e551d44aed6253312e592d58bf5a85b6b607bdd9908415cbe48b824ba28e7e26477e539475d170116f86aa6600be5a4110dc6fb062b0b126
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA176:A3mnXoZjzyaEFo3+aWiauoOas06zA176
- TLSH T12C157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 921KB
- SHA256 d461162b22f3844c0d7d1f218364a2d6ab57bedec0f0cc7a3ae86862b1b293fe
- MD5 08fd89bff77e6edc7f11f7bf83ad82c3
- SHA1 e2aa0949006c499affc25b9ebef2aeae8eea0fa2
- SHA512 29b51743180014ad193a2e51313bb5f82e1ff6f4cef4457c51cbd4d14a70f33c169ea7f1e23d8c105d81314e8618dbb8df265a746a77e476e3def3ee31906101
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1lN:A3mnXoZjzyaEFo3+aWiauoOas06zA1lN
- TLSH T1AA157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 921KB
- SHA256 fb043dac8c59eeeb0bf0cbf2aad2b26c7fb8703061f8e9e8c4083f72de116525
- MD5 cb51443c87c2127db3492b4a0b3221da
- SHA1 5a7a645fd60c3ac38b36bf35e1d3c66acb59d66d
- SHA512 f2f92d021e8840d6cf0b78d4055dd6090138c540061a3e6510f83caa21069c540232878de04eacb6438f0f0a55c332957b513140a53c4b436a41becf78347e6d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1jf:A3mnXoZjzyaEFo3+aWiauoOas06zA1jf
- TLSH T17B157C03AA9000B5E11645305AA5961EEB35BC16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 921KB
- SHA256 3344d82011c49869205249ff68244c6fcf88aa10a91b9a5338d11264ebd067c3
- MD5 353638b23a4c3b380d476d43181baf8f
- SHA1 73d4363f15415fdd17756c657e197464148c8dc6
- SHA512 12281b20bf82c8092edaf13a2896fb4d528e3588883585cadce71621ca2259ef8c7114ef6052d482fbe74a4b7c1d68dc947978b693f42ea989bada8a81f559ab
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA11o:A3mnXoZjzyaEFo3+aWiauoOas06zA11o
- TLSH T1F4157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 921KB
- SHA256 dba1684c96b364355302e4c4590a5813c7c39cc81ba8092b16823edccc932d87
- MD5 6976748bd99376d251d0c0c3ef799cdb
- SHA1 1ca9c38f5365c9c701275494365cdcdbd7655f8a
- SHA512 80327014d2eaadb0ffb287de9889ddbadebf4d8888e9e4d06701c50daa50cf85e2fb82d2bcc609c602f3277b7a1ff7d83d68ef38138df2ae8f1e1a06a86c4474
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA11u:A3mnXoZjzyaEFo3+aWiauoOas06zA11u
- TLSH T14C157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 921KB
- SHA256 cc2ab2727cc48623f58bf39e145504914912ee05794dde5da8cab900696bc0de
- MD5 b3f521cdcd326fafbf479903e4f513fb
- SHA1 3230a1695ed9c8943bc56cae668cf3855d395cb7
- SHA512 c629fc7a12964e7c1a1e03a217f8da537731cc326af292ddbcdf6d4b359ff043e95ce918061148445e0bb619e2940b0df97df0c3137e6361231e1b8c08c5fd0e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1r9:A3mnXoZjzyaEFo3+aWiauoOas06zA1r9
- TLSH T165157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 921KB
- SHA256 4d4436ecf39f651e69009d2dba2521fe5a381401eb029d5fbf1595985f5bf0d6
- MD5 3cd20468f71ad364b36ff522413881d9
- SHA1 4021396c08d6892016ec3f4b57ab0e6f949ef02a
- SHA512 f47a02c8520cab911a918ecd7cbcca032abc3565beed6b19d180e2a2a315413b6b58923d32d5069c4c800bcea3f05cb552373aa96f87eed1d55fd00c279f6b17
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA13c:A3mnXoZjzyaEFo3+aWiauoOas06zA13c
- TLSH T1B0157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 921KB
- SHA256 9153819cd702834adbdaad7462842f68fbdbcd641fe61a537cbae5a34f8fb317
- MD5 ae6bf15b001bc7beb070429c0311dc22
- SHA1 945dc19acc8801a542ee4fdca762ba578419e74d
- SHA512 7bb24da81b483bb804a41ecf59b688d8a42bf81837175c764c3168519169331328f6910f2fa8c90904d849a55844de056991f9a71a323046b7f9544a82b27218
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1Ap:A3mnXoZjzyaEFo3+aWiauoOas06zA1Ap
- TLSH T142157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 921KB
- SHA256 a9bf4862c9651973b53cd76190548f974c2f513df35d585ddfb7de96e8189d79
- MD5 9005f4c12786cd0daff345805afcddeb
- SHA1 6b7d59991892f6efcbbaf5a5b8f7366d285f9dc8
- SHA512 59299ca56ac52df4ee6e84c020a924954dec3033aa916f29f3f13bafcdec64e68a8edbfab34d4e5b33210271b0e36af5548be14ae40dd1afcc9836e3487ddbae
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1H0a:A3mnXoZjzyaEFo3+aWiauoOas06zA1HN
- TLSH T1F6157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 921KB
- SHA256 f425484428285526216c7812c3363149e6284118d0fe6fef5d9ef84c1feabaca
- MD5 ab263d04d9f254738d2c5394f7ac86c3
- SHA1 3595cee18e71bafeadd218752b922d6eaf3200ff
- SHA512 ebd11d162652cc8d0974790810ff18e6a48558eb98db09d8c8fd586d6157d75c2e7cdac2cba3f44fac3ae502b75a9fbf0793b77859376ac535bd3c59a8ddcadd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1lF:A3mnXoZjzyaEFo3+aWiauoOas06zA1lF
- TLSH T1B6157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 921KB
- SHA256 eb10dd5a3db37ef72731d8541b8eba3213b3d1fc57f8e1c909c951aefd72168a
- MD5 5bd41b4e80c525697818a17575526ba0
- SHA1 a42104e3e077011f4b23e922892a31d3f9f824e9
- SHA512 d4136bbfb1d9e374652c276a582a7d0876d10eedcf16991a4621072364cd32dc5cddb1bd45c588ea3f1267627daedb1ee728c9b7357bea8e0bfe0cc738495225
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1GC:A3mnXoZjzyaEFo3+aWiauoOas06zA1GC
- TLSH T17D157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 921KB
- SHA256 bfd696e67d948b1e8e45363a87c7715d728dda6e7e2ad3d10eef431e318b8651
- MD5 e94bb6559dbe8945cc27d6f997855dd8
- SHA1 35adc016c39cd9b77340c5cbca80e8d964c3fb33
- SHA512 f891435863b89490978b8aa4c06a26072590651906c8c53b097a94aefe825ff4aa2150b962d9727a87f24ef8a0482a942795f3588cb8f5194c539f633c883049
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1Jw:A3mnXoZjzyaEFo3+aWiauoOas06zA1Jw
- TLSH T18B157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 921KB
- SHA256 af22fbc2fbeba2df7d15854319b9a8351cceab2d81bbbda63cc9dea334cb96bb
- MD5 8acfcedac0c069b24a5833235aafd2d4
- SHA1 3455cf7c0cb1fdb618cb70d40992395b7c66be3e
- SHA512 afe65acae0a77e87d211f0de3b9381b5c847102908f1e366d326c452b0154cf97d072617caf96e9b5b7b81d055c6f0880c919499b3d0d5e17e50ea79f8509079
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1QT:A3mnXoZjzyaEFo3+aWiauoOas06zA1QT
- TLSH T117157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 921KB
- SHA256 a0abd0d156dda89ddeef02e0433f12b52677ac04de4bf699344fa3d40714146e
- MD5 e8c7affa1828be8a34372c4bea9036fa
- SHA1 d6274ed918c9b8b27b44853e1a8cd4b5e42b6e65
- SHA512 3e780fc5804e47af9ed3cc4fbc7a22160af25b3066bcdc2ff7b614c8031255f06cc644f20268d55ed7daf06b3fe1cf9926a6011a7a5a64ed730ee92c534a32e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA18u:A3mnXoZjzyaEFo3+aWiauoOas06zA18u
- TLSH T1C3157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 921KB
- SHA256 6054448fa00ff7fe49b74365e406ac676a466029ee920b7062dcf2312e2228a0
- MD5 209af3b8f468b0c685f7f8bd89822dd6
- SHA1 e3d468fced7f6673d9599e37fd3437cb1360c291
- SHA512 f97291b22b6be65f2c722aa20a6e985f5340270f65fcdf374f2d9c4aa793264ec39a9324c67dddb4fbf8ff88def7c0d54158ac75b53b88dcd0fa25f9693b1090
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1ab:A3mnXoZjzyaEFo3+aWiauoOas06zA1ab
- TLSH T19A157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 921KB
- SHA256 4b328b05b15302fb540ce9d93258352cf156c0579930a35b9b93c842479d9ef6
- MD5 8b7a9c59dbaad075620fbd14065e44e9
- SHA1 b3ca82b64766aec298099cfb5b78d1fa92d0ef78
- SHA512 bc144b538957b65c09076c5c7bd9de88b574bf1c9c90e54aabbf25f671fc15f80864d45b796df97fddb3e7573fbf1b4c5825a78d7279815b9249d29fafe1a316
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1cf:A3mnXoZjzyaEFo3+aWiauoOas06zA1cf
- TLSH T1EC157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 921KB
- SHA256 00eca2ee81ad33e53dd0b0bc99ed22f74b72bfe8b68a493bff2ee42da7613133
- MD5 9af3cd66caef4bd938ad4f18d93d2eba
- SHA1 1cf2ce09db846dbfeb31cfe9764b74c91c3a8643
- SHA512 6f2ec9e69c84ee3b4364711516520aed15d011955c556ec670d80a0ac082e8ee18558025e9843d28a524f8f406cdbdfab2cab0dd8d56bfae56321a72f480abbd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA15K:A3mnXoZjzyaEFo3+aWiauoOas06zA15K
- TLSH T130157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 921KB
- SHA256 6f5ae478d27a4124fab6d89ff8b6d1d1b4b5c6cecfd13c36c485d2cf3d440b4c
- MD5 20fd28044af99be1902fcbf4518d53b6
- SHA1 379d66142c1e05b92d9b161d099134046193f9a2
- SHA512 bcd7c6ad0692ce3e09fd5b782c2060cc637fd35e63e4c3f885c85c87a9249f56f65dd8ecf78ee0888b0a6e8a068d4289cfee1321dc44cdd24c2bbf68832c116a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1ik:A3mnXoZjzyaEFo3+aWiauoOas06zA1ik
- TLSH T123157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 921KB
- SHA256 d26909df1c34f5a6438428a143c8313a97c7f2894cf71bf12742fb0702a53685
- MD5 1da39ca13b8766a995df24bd311cf50e
- SHA1 0990e72a935cfd49116f8ba03ca398da5669ff0d
- SHA512 0210e38dffcb472f08337d1500e7f160a46393526d69cd83cc89fc59c3fa89ae432f4588a5603b6f9382d1d72bb864d0e8ecae605b13344cc1d00721979e5fef
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA130:A3mnXoZjzyaEFo3+aWiauoOas06zA130
- TLSH T1F5157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 921KB
- SHA256 0b702364cf738bd34b0c9bbcd420c85053205da933266567ddaab4de1e415362
- MD5 a8b88b7fcbf5968333ce554e7dafb78c
- SHA1 ea048ad294a255855adcd927ca6f58b6649f8734
- SHA512 45b4c1020e421765b02455c3160f1c368e5efbcc255f43807be995d32b3df43c767ef54b9a45b269a500773c635fd4f6869d0f80fa130616a1cda7c1cd45f27d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1m70:A3mnXoZjzyaEFo3+aWiauoOas06zA1mg
- TLSH T12F157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 921KB
- SHA256 2784d340932cc040a0526c86b4f9053a8a1e645a63cef69a54aed84615de1d08
- MD5 74dfc7c94a9f9541a2540f9bfd1bc492
- SHA1 460ca4f1049ae665b12e8078fa5c7bccff9e8b63
- SHA512 286056ff011f05b755f30d9199f378ae54daee4b6f6e78bb2e7a25f2008227d910d86b92e8920c66bf52b43279b0c73115579d7f5d36b892fd9255a15ba1bebb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1vr:A3mnXoZjzyaEFo3+aWiauoOas06zA1vr
- TLSH T11E157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 921KB
- SHA256 bba5225a406bc8bf3320bb43bda917875ebdcb98a13d921164d1a83aefb437b1
- MD5 461197537a92020fff46bdb0f6e7de0e
- SHA1 e7e57ba98a04f13dafcef22441d9549af2fcd6f8
- SHA512 7d761f9e841ebc173b3308565b7addecaf115958ff6401df056b26a80ba4d3574c3379ab4c8d050df5e59f1b134d8fb8d11fd4f0244e497835e3446c1812c57e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA15n:A3mnXoZjzyaEFo3+aWiauoOas06zA15n
- TLSH T18E157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 921KB
- SHA256 05dfd86b97c91e17a6eb2b626abd04e45a804df45561b848419d22ad4f62bc5f
- MD5 ca2206f8fc377807f163c46aa574bf97
- SHA1 607edc847ea4798a7042577396815a03c72abe52
- SHA512 b97f635d3dbdf01063e5b2ebad32ed01d38f57f03d7115533867cf3d9989e78d284bc9302f7e38448b0502060be84e32cca0b14f94f13470389362d12a2c7474
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1Vx:A3mnXoZjzyaEFo3+aWiauoOas06zA1Vx
- TLSH T128157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 921KB
- SHA256 36c5f02915937cc178c295f5bfa7dbcb0577038ec77758922c2be0933ffd3262
- MD5 c2b54ebde48097f370e817a7814ce488
- SHA1 8caf2f34982271169b056fc93e2c6b68868b32c3
- SHA512 6882e5f1bbbf2d7cff14de7f09d9c5518a9d76cd56c9d19a75660760629a5a6d4f789177434676b989c18d3b1586b021b104bdc3ab9577f1a6cc899f09dbda6d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1LA:A3mnXoZjzyaEFo3+aWiauoOas06zA1LA
- TLSH T1E9157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 921KB
- SHA256 6c685d7d0ab82c45cc0bec9c6d0b56cf566b66973f2f95bb38758efe7363ed01
- MD5 1fe51223fb672848846148ed7d763191
- SHA1 bb027a0bb8dcfc0184093af1d81ea9725cb1f01e
- SHA512 1bb5e6ebc486df100105ced3871f9b2ea3636061d852160ccb9b6a3c85874f69442499dd4451ac4af6286186b2b8aab889db97656bed9fc1ff00e2b6e35a86a7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zA1c9Q:A3kMu
- TLSH T155157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 921KB
- SHA256 93a7a98ac5f0c97e6f2766da998f41ae3bed4ba86aca7c3003f2644d81702fa8
- MD5 8363169e1afe3cfbc580dfa2a1dabe6b
- SHA1 7371257fa98a2ec5673dba88da6482c7c44d55f5
- SHA512 b9184da5b013a341feafdf8b609ee59e9bf7e2edd9e03f8619ebdff96cc3e5c4906bfcc9271808fbc3f890d8a838341afa12317bdb52395b36f14870949eb4f1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1F4:A3mnXoZjzyaEFo3+aWiauoOas06zA1F4
- TLSH T10E157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 921KB
- SHA256 7a7233316cd5f36230594f0543291148d70b5812c1284afbd97c3dc9af21089d
- MD5 8cd42a051e4f80ffe6563e984ac6b16c
- SHA1 b2c57afb6b433d6fd9398675bbb719496d4970e8
- SHA512 5a0d81e39dfb8251d42fda6eddf868d5e7bec86c31a3f5a5856ececa9159560d699e6f3c9e1549f83a6ef6d81cb05bbc7bae4cda31ed20c7dacd9f4442257610
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1Qu:A3mnXoZjzyaEFo3+aWiauoOas06zA1Qu
- TLSH T1CF157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 921KB
- SHA256 ab8883bca589d4692f3e8f019be0c5be3f5d5b6a00ec40e59442a8582892d69f
- MD5 18b3e5bfa7140d1dc61654fff5238377
- SHA1 49f86ef4ff291d15a9915b2ebb9c01ba0358989b
- SHA512 454cecadf5b517030e3adaae35c36a2ed9c6a4a60da98cbe9d51640b12b26f5f3576e87bcc70d444a62da561f8bab3b3bce065cfac05647b36af260fe42b5ba6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1Rj:A3mnXoZjzyaEFo3+aWiauoOas06zA1Rj
- TLSH T1E4157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 921KB
- SHA256 030382761f94e9a4c109ba6eb5d5a58cb618b7b4550b28efe9ee9cbbc1fecc6c
- MD5 29cf2f33b7d43b2d8fa98c7efcb357dd
- SHA1 a16f1db8c7e303d085355008b5598c435437ba71
- SHA512 c51d5dddcb3ad8ffe8940a88db74135af997ff5d0fa870ccb1617561038434a17e27938ea1286b7307ca13bcc909ef7ebf2a8dd1fca65e0e2d4f7be91cd14cb6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA14g:A3mnXoZjzyaEFo3+aWiauoOas06zA14g
- TLSH T163157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 921KB
- SHA256 b9b1001b09c6884e737488a0bc33472078bf529cd5b0d14335624c2d7dad1e68
- MD5 cce8bb79a2ff90c9405b670ab4fffe49
- SHA1 17885cad970030871f384db88436b72092fbb297
- SHA512 42d6d3aa4d55f4f7bff967ab9b480d2bc424d71fb28f20b474b729237b767bc3e497a999536d26a2213e80ff41c111f6cd9e98d8de21b4106e2e13735ee94a8f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1XI:A3mnXoZjzyaEFo3+aWiauoOas06zA1XI
- TLSH T1F4157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 921KB
- SHA256 df94946bdc8a927bcd756e72f8b249159d74cd1d31da3ef3b4e1a07ff8b7326e
- MD5 73a08362a47f61367935068230f5b5b1
- SHA1 6b04b220e3c911a4034423ef4c88e0c6f8fe22a5
- SHA512 e1e4ad72b3049a790da91641e74659de98b5fd0d6e53a655f68129baf34e8ef1efe71457de04336b70254588266fbb35e1bf0b9f72b0ced13b93a9674fffc716
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1do:A3mnXoZjzyaEFo3+aWiauoOas06zA1do
- TLSH T151157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 921KB
- SHA256 624b7e13c34c30d2f8c5ed11dac71551ad16a0db50f3735d8a6ba584393fb8b5
- MD5 aeaadd93e4061e7dab3ce842cbeded9d
- SHA1 56efb670029fa5524bf28b4193186e8297fa1515
- SHA512 2b65858dec9884da7fa88e76f1f94616c73dc7815ddb59c9b5082d706f0bfafc50e6a1e58eb6ffde051642bf29681582171afb98e4393515abf522e7ba56611b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1O+:A3mnXoZjzyaEFo3+aWiauoOas06zA1O+
- TLSH T1AB157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 921KB
- SHA256 1d933473e2b8eff5b96af014c43d1706fa6b4853bb0ba7e352517e9a5a88d004
- MD5 91097108ee0096a901d4d4c50eeab7b7
- SHA1 f6c32f83e9d65372155398dea54355bdf0f92f99
- SHA512 1aa12cee391778bc59bec41c81b85fe18841bbee455cd22a607d553aa8f05576bd5ef3b0b0f7c27d1ed7622b1e315d75e0b4663796a742dd013b1048ababb129
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1OQ:A3mnXoZjzyaEFo3+aWiauoOas06zA1OQ
- TLSH T166157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 921KB
- SHA256 a3871a675a69faf522259c4a681e21e78159ec98792129997663ba81548def6f
- MD5 34accc43ad9c415b9f7446268f7eb00e
- SHA1 46c2bfc0b57ec7c17478775cb6aba2e1c5a0778e
- SHA512 c6cd2a3fc97c2fcdacb705d8073c884d1ac1fe8ba22d03ff25c218e9c098fd3d5e6560ab7f75eb717a6174b626957f528875152723692eaf0a6e1ec1fe671890
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1vX:A3mnXoZjzyaEFo3+aWiauoOas06zA1vX
- TLSH T105157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 921KB
- SHA256 0be934cc6edcef49ebf532d841a2b36b7f86d20d0bc71d6542a8e7debf4ba84f
- MD5 42fbda0d3dddeb6dbbd1fc64c7de2954
- SHA1 7852c792fe320d603f71e857cc524729f0dae0b4
- SHA512 3c85e910bde93b0501daf6ab3db4643364bbef399495601588582904d2e4c27c677183af2457462957b9aa4f6d0067e36f4bd438e79c2d3a2b86af109868416b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1lL:A3mnXoZjzyaEFo3+aWiauoOas06zA1lL
- TLSH T114157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 921KB
- SHA256 abf2b646950d040fbcc8d3141004322cdeb7487d9cfac62dbffafc44b777f2d5
- MD5 04f428901239e8d591b7d19150038e8e
- SHA1 844871e9c0aceec2a801f3da3d4253c0d8dba419
- SHA512 d4faae8e7274fd3dfdb8c0d58ebe7b74ec66e5dd629afed11d5b132e307414565965b839d1e7315563deeab86290d720694278dc27e37f0831f5da1f6050fcc6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1DFC:A3mnXoZjzyaEFo3+aWiauoOas06zA1DM
- TLSH T1B4157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 921KB
- SHA256 8a4944c2a6be1094f55a6492487dcbd9a4918b7712dd544d1aef05e16f2ffbb4
- MD5 977ca6c85a95ff17a32cda4e52745cc8
- SHA1 3da8502f9976a1c2ae6110116e9ed8faef7cc5f2
- SHA512 d44690a34c416a59385daef3dcbc30abbcf33e6dd8da6b292dc7d335c0a7e6028209200e71abc0d4271c7089dd4015abb9d217c30ff4c4daa354d0047bce37be
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA1Eh:A3mnXoZjzyaEFo3+aWiauoOas06zA1Eh
- TLSH T1B7157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
- MD5 SHA1 SHA512 SSDEEP TLSH