Analysis
- max time kernel
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 07:29
Behavioral task
behavioral1
Sample
2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 883KB
- Sample260718-jbc71acs7k
- SHA256 a2064be4d9b8b44e95c211a43f8b44a79c9781e1a82630af99a3ffec18ac0ebd
- MD5 7b7a786bceacbe4a97baee729df55967
- SHA1 bb3e79383d1f794992bb8127e69e34b45c663f3d
- SHA512 7197ff4fec5e1d43acd1de3f87c7b7c4055cca7c863967a80b42a5ee5b23f6de0aadef749e66b40bfaae2530f8399dea5139a7fcee6940dda7b4da692d8f494f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0a:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RN
- TLSH T17915AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 33 IoCs
resource yara_rule behavioral2/memory/3800-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5bb-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3800-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2776-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7b-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001896e-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-242.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198dd-481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-506.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-832.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001a056-1131.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abbf-1210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000900000001abbe-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001abba-1377.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5bb-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7b-59.dat aspack_v212_v242 behavioral2/files/0x000400000001896e-202.dat aspack_v212_v242 behavioral2/files/0x0004000000018a48-209.dat aspack_v212_v242 behavioral2/files/0x000400000001983a-228.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-242.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-249.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-372.dat aspack_v212_v242 behavioral2/files/0x00040000000198dd-481.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-506.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-609.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-634.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-750.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-832.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-863.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-940.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-959.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1014.dat aspack_v212_v242 behavioral2/files/0x000500000001a056-1131.dat aspack_v212_v242 behavioral2/files/0x000700000001abbf-1210.dat aspack_v212_v242 behavioral2/files/0x000900000001abbe-1338.dat aspack_v212_v242 behavioral2/files/0x000800000001abba-1377.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2776 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3800 2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 2776 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_7b7a786bceacbe4a97baee729df55967_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3800
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 883KB
- SHA256 a2064be4d9b8b44e95c211a43f8b44a79c9781e1a82630af99a3ffec18ac0ebd
- MD5 7b7a786bceacbe4a97baee729df55967
- SHA1 bb3e79383d1f794992bb8127e69e34b45c663f3d
- SHA512 7197ff4fec5e1d43acd1de3f87c7b7c4055cca7c863967a80b42a5ee5b23f6de0aadef749e66b40bfaae2530f8399dea5139a7fcee6940dda7b4da692d8f494f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0a:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RN
- TLSH T17915AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 332ea05d1cb7e42764b2250cecdd114549bf3d194babf454424942ca94dd15d1
- MD5 c048fddceb4340749025aa30b71ce2a7
- SHA1 db64d497c150d22053145658cf16ae6b0b6cc332
- SHA512 207be938063ab486ea09934218199354569ef99304d9d0d67e754895b77a214bcc0b7c7db348f5de1b6a03de3f9fbadacfda478fcad18816d24fe9d277a5722a
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RZ0Le5ji0hmxNrM:A3kMhT1LljCPji0Aj
- TLSH T14A658D16F6B406B5D033C179C9D29A5AEA7138461B30CACF1398D7292F337E19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 931KB
- SHA256 6d5ece6e7d6a88ba60bc61df55f47a708a500a2486420ffe940888e9879988f1
- MD5 d168d17bb10278ac91aaa71edeef1195
- SHA1 a0a88ea43d863e8ce7700eaf6e95bbea6ce5637c
- SHA512 ca9adfb46f091531cd078e7b0153e4c6f5eb0d5680b4a065466ccea4d4735ef9f26c33f761762721f32bff9a6e7c659930935b50260189f3e70dbfcd80818bd3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0vb:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RIb
- TLSH T1EE15AF13E79004F9E8678234D9A54A12EBB1BC661770C6DF136892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 907KB
- SHA256 bfe33adc308c4c10c1ed938c2ee47379c3b60950ca6bbe8c24edc634d7519628
- MD5 3ef0fe88eda3fdbfcfde811f89ea0f3d
- SHA1 3550a5acfa6f7dde496024f258c565261be0030d
- SHA512 14e0df6e9a52a5bedc596f731560f9629b86517fe356499c83fca68df5044772d7cfadef750c00add0d2e4c85e405c2bacb7acc07186c61e46ec0b102ed73ce3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0+Z:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RzZ
- TLSH T19415AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 907KB
- SHA256 c109729b0e068177d2b4f9c575e9fd0d774f1ac8f459e010a4ee0daffb0ecae5
- MD5 345344b976557afbddf85f7b90ef2eac
- SHA1 fb0f5bd0df6293da57b53e73a8a2d877f1c059e4
- SHA512 dfee35b09b59d94b06baf690eb948c3f7e3a6967cce450e4eb5fc7cf38a9205a7b9518da31906abbd861667d8d73a2e64d4429690437c3c33481338a0d6fd63f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0Z1:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Ro1
- TLSH T14515AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 907KB
- SHA256 3b320a8a669b68c2b60914f0fce5c030e6f79bd32887fee3b3185da1655eeeae
- MD5 8907d1c6d571de7eac564ccf9ce1b5a8
- SHA1 b87b7148c9c33b2d198f4b719fa108675143de1a
- SHA512 636bc80c1b0952e5dec987361b12ebd2858c24f4d6128184d1e6ee3042e0d90d3e93749969f5ace526c6c321cd4e668f2dd12f0e313cab9fb159eb7d5c33c32c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0zN:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RiN
- TLSH T1DC15AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 907KB
- SHA256 1c29896249c13f721d7c11c77cbf98fcf723e039abd5d4b732e8b60929ccbbb8
- MD5 05f73f3a87bad79e43925103387a6fc2
- SHA1 68e8280e5606286ec9405a8d9482a1926403a197
- SHA512 2a639ded614885e3d18ec3ed44e1162bb29799cf6a78ec147c4809ddc629f8d777ece5cd4008c52259529ac528b5b4aa1b3d45919448b72e2564fae30ef52ad8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0Bf:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RYf
- TLSH T11215AE17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 907KB
- SHA256 25581df5d84087a5910395d1cb51d11fb5f239337c175718caf07d420aa90c9c
- MD5 c83513e8f402d83087655b06c8ce237f
- SHA1 672c16d5906d5853ff734f6fdcc9b23293537d4a
- SHA512 f25cd710eadd9e42aeebd22b9a753020f5306717fcdc95a49cdc25daf4c9fcb746d1f4e6760b46470f46edd4e479ce29c9010393e769c94f02e7f0eace45b5c2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0jo:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Ryo
- TLSH T1F815AE17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 907KB
- SHA256 dcd1da75c9f69ff3513704cab04001a116d175f37bd420f0b043d1fcd9e5894b
- MD5 2882f6e38665c8a3bf8b15287167674a
- SHA1 6bc0b0c8688ebad0022a5d40dabcbec1d43f2373
- SHA512 9e4093856018ebc777edf02d40316224f93ede0fa61c041d46e7fa17b9909877e49820df84f029348a78bbd13b9066ba4335f5e3bda155f2fd477ee3b0a44a50
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0Xu:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Rmu
- TLSH T10415AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 907KB
- SHA256 8fc44b0def6516f6d347772190be7e93833cd6722064f58ac818524db13b975f
- MD5 6208d23f0439a2db90bf7948ca6b71f4
- SHA1 8cb8b25de7e449c4af0b37fbafe08c471d699e58
- SHA512 a282685bb594633e7ca12d085344a88b2fd445da1bc704899232d730c2b874c04c1b015b4f2cc8cf113f2bd6592e3206f3739dd99b9cdd20fc92af90c89f5cd6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0Br:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3R4r
- TLSH T14915AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 907KB
- SHA256 1653440007b5c0498a8694953746b24980498dd092fe5d090f673024cab5545b
- MD5 3ab954f6cf4f5940ff4866ee4ff2728c
- SHA1 2655b28c9c3b85ca966d74630421637cb6f2e577
- SHA512 5ca95a7e80d681e73dacc131d5a7970e5a35d6d593684f89c96d7c59347855632f35c63b39f652af0e465854cc349e0ed010eaa320957563c3609a308a0a620f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0Dn:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RWn
- TLSH T10F15AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 907KB
- SHA256 5e739e443ec17c873e1f09e1927c9c071c217044e9fa22c0241f0d05bd50f999
- MD5 96d2ecbed09a9551acc68ec48f1e132c
- SHA1 1efb16c5c6e4f06440f0b56000fcbb39094532a6
- SHA512 bf914c359dc8cc500a1aff9bd9c693ba614774d45f06cf0db34ffa3fa18bc9cd54f18d614b5def2f5eacc273820a28fbb42e394292269f696b332db8703eb435
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0fx:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3R8x
- TLSH T18615AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 907KB
- SHA256 f15294adb43aff06f2fe4966198414c57c48e365ce240e8792b187916f846c0e
- MD5 e9004278303c42acb14050f1c39d8938
- SHA1 392f1392ec3b91684b4f50188ee17985bcb52b95
- SHA512 10d639bd78747b2eb3780b6313a17298045ac3c8d44f3ee360c05dd80095cb6ce17c75190616fd6917218c16532d9253bbe7eacc97e3202a0afe65b7621e7d61
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0FA:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3R2A
- TLSH T18C15AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 907KB
- SHA256 6df20a0753561058597cf5f22d348414b734230efa7ff89246cfa8a84991ee87
- MD5 a486d7c13447399693b71f209117fade
- SHA1 cf74c8ce104fd795c581bb1d95cb323a7b2847b8
- SHA512 59135cb086bb078c89ae2b8f78b3cc0a5748b327521a3244c56dc799bc179b4ac77d5b0670d84cddf88851f8e00cd1233f6f1ad8581fdea9b311859a1a2c4c7f
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Rv9Q:A3kMhT1Lljz
- TLSH T12D15AE17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 907KB
- SHA256 ef7115a8a575ef8a5b2f1b89b66b5ab1a949076bd6642ef6cd016605c94c5505
- MD5 8973f8b051767ffe9869639ba8158991
- SHA1 7d05154f33b084f410de5424cd1bea005645313e
- SHA512 495a16758dd2bdfff0b9b838ad52ebf8a46a381996b7d86f025e83abbbb5dbc0c98ab12a0850196dd7156c54084aa6ad205bab9ae46281ad990400f36e3ab2f8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0r4:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RG4
- TLSH T1C315AF17E79014F9E8178138C9A54A12E7B1BC661770C6DF236892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 907KB
- SHA256 fc3c693c8dddd5251fe071c8fb3429f0f9700b1ec29a35aae5f7cc356f9c647c
- MD5 80284881697a635476e184000c102328
- SHA1 b1909c2245660ad30ca38164484c540557dd0e0a
- SHA512 b48ba7cbdfc699bd37552cdf6811e41aa222d34a092813aacc1f0be86338138003ffbe6def28b9cdea3d764575f84a0fff25f66ebb52c1714c3df8c0040a58f2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0iu:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RVu
- TLSH T1C015AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 907KB
- SHA256 633bfb31f0c9fe0f736b021a636280624a2efefc46607dff8ef0ac6375dbf720
- MD5 844612bc819166b94418bd7f9fca89cb
- SHA1 a0d273af17ede4030212e991e306d90686bd3e13
- SHA512 8dd5a952bcf67109896f36796411c1259aa30a88f3fee5d88554038fa8487cfc6fdac8d7f06a0675fee7785032050706016f0ec4fa16ff6ccd2fb12da24804ce
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0zj:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RIj
- TLSH T17C15AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 907KB
- SHA256 dce21143499a7728a7c1481d0674607bb4eea1edd51b9e114403938f76af4a0d
- MD5 1bd98459739e9e3c7c9f02f1b8e5f55e
- SHA1 c14c110e928e44d1171734a09e8a7fa6d4fddb1b
- SHA512 de15fb487f020376ddffd384a826493db4d80cedf8c9d3b6faf9d6cc26115b40c2d1e8e1613b4762c6a446fe827ebc91e0838676527f0607f59dfbddb23160df
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0+g:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3R5g
- TLSH T1D215AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 907KB
- SHA256 487bc6919b07ee56147043464785834b53c086e9c4a28bc61ed62cf8c677a71e
- MD5 17dc8d293764e3d46018afda4ea5cc1d
- SHA1 73259f9e03630e61bc7e7e7f2af03a9c70999a23
- SHA512 197203aacc2fe34f91844196866d0814a516de57377dc385a6db7cc1b089022e317410a703bd545675e474676ffeeee9b550add8d377776e60b7f451bdb80def
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0xI:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RgI
- TLSH T1B415AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 907KB
- SHA256 e28fd8e1f4e757e9d7b3e50d30e531941c4f3405f42255a38926a2275670d4f2
- MD5 bd097913f38eeed34e1b04d12a076ef9
- SHA1 9c9342d61cb48d4c98313de6da294f1dd202af8a
- SHA512 7f562c8e22c629c40b0861f5b732d7855baba680248de7971b94812b55a098630c967017e4e478b12b0fd99cdc9bd34ca95fcd72f96d54430d077ede0f6f9011
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0zo:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Rio
- TLSH T12D15AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 907KB
- SHA256 88df16564c64fe3b8eecc1a18670e906f8deee0391f29ff43fa58ee943fd1c7e
- MD5 a611759a4b8e4dbf54b0cc9df151acb7
- SHA1 626313f2221ae6128a410fac5d2d6e24e0b33245
- SHA512 a683b6a55b82e2e7a603912959bff70754605edd0424e051d2295461a0fd6eb5b7bfeaaea00acefb9502f65a41b35ddd5871d4ed2195f6e50ba300e94bb67f69
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R04+:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RZ+
- TLSH T1B515AF17E79014F9E8178138C9A54A12E7B1BC661770C6DF236892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 907KB
- SHA256 84fe105cc45bb2bef5889d9d99fea1678fd7cd8f3ab09d30dac077ead7763920
- MD5 d2d7452e40217e9e180d6f57ce736e4f
- SHA1 48216c80e33139ff47f57d06e7d471ec59629d4a
- SHA512 8982e5394e1593c101df8ce0255b471ad043c140e4dc013e572f54c07b4663cebe1d0e993d46736dcae59cc01db9a6cdb0b8cea88f902c104d18d703c42b9353
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0QQ:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RHQ
- TLSH T16315AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 907KB
- SHA256 54a54c6496083fb4d927070787c3ec3647218a0d3949726411c423b0acf4e9d5
- MD5 65c442ec7ca3587cab7dd0fdf2ba483d
- SHA1 c40d4350f3761168210642cd0344efcefefe4ae1
- SHA512 997b2491268af0a95bdcd6c16094966e4963207d0cb370f826f91f11cb4fa2832fa9d3fcf809564472be0e0e31e60d0da2a92881744473e5cd896fbde76e9ec5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R05X:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RcX
- TLSH T18815AE17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 907KB
- SHA256 c8f1891dfa4cdb46efce4b6b50510f7876ecab65ad4b7d116f932dc422f2f789
- MD5 6dabf4d0079b84115cf1d439f55aefbf
- SHA1 34eae9b98c2249cbf2cfecfbd03e6ba191300c08
- SHA512 2975d241d6faec32c60986dfd8ca4a1039de7dfd1ac3df1d6f61eff168d8a906a5982304aa2b067478d5d29825df953226bdede678d4acb58f0a039ad723255e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0TL:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RaL
- TLSH T1F115AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 907KB
- SHA256 c003877ca507899815f99e6252d0fbfceae944ad98224eb1e46ed8c2fc3cea05
- MD5 5c7f55c9d2b5a36f0cbde0092db3c96f
- SHA1 2bff1d30486d2096c22505ccf85e3fdb7be5b1e3
- SHA512 2122d211840b4b82773290dab6cc726ee07d24daeade9a05e7a51802d2cb0b106e80691a3a9f1a4afe987270819ebc3a8d8060b32933b3f9660b938dbd7b21d4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R05FC:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3R+M
- TLSH T17515AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF236892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 907KB
- SHA256 467bddcb39c39b512263c633955c0762e325037b83811e084631c609ffa4f162
- MD5 6c61d48158a317f251b2ac065dcc76a7
- SHA1 12805301a9737d5c0756c8d74a6ccb21fb73befa
- SHA512 c531d0aead659e9f3fd61ebeb8d48f880d581f8dc0dc13a8c6bb0be5af79e4e28aa96444c7b1f5699416617f76d719ad7ba0f33dfa5a88f1c2bf5a0cb4ba957c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0Ch:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Rnh
- TLSH T16815AF17E79014F9E8178138C9A54A12EBB1BC661770C6DF136892262F337D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
- Size 922KB
- SHA256 6e28ceddfc6f74a8a704ac1ae461d4f54325e04e14d0fdbbcdd1aa6e75c8c8b1
- MD5 f6f3c7847214e932a27c187bb54eb1a1
- SHA1 7f3bfe5a8d13d56a8ff7261c8423cbfc15db5e25
- SHA512 79e682b5b61c5cfd08eebbc416be5c1ef71024e99c0c05c55226c8f20479550c07ee2b805b24c30ca9fe4b9af9d1bd6bdfd8a9507de5f602f848dc99ca70271e
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RNWl0:A3kMhT1Llj8
- TLSH T19B15AE17E79004F9E8178134C9A55A22EB71BC661760C6DF136892262F337D06F3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 938KB
- SHA256 b4849e7cf38ce845c4a440464df62483b7b09f4d32c37fef3f54318ea11a3cc7
- MD5 c2ffa8eebbbfc1f8737e8611322e032b
- SHA1 1346a240e1d8c202687b53a9fb5f668109b19af7
- SHA512 4ceb894d3415e435c708a3ff44bb49792274ab35603fee2e4609f4668e00142812652914adb6d9b942c27faf37494eba64bcf6fc49fe962244f4ecbaf08bcf30
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Rb2+:A3kMhT1LljF+
- TLSH T16415AF17E79014F9D817813489958A22EB72BC661B70C7DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 944KB
- SHA256 729c6a763918d69e19ac8e77ee87885fa1676836b8ec2531657a68ba40e63b4c
- MD5 7a0aea4fa816c27bbe9b5f508ba5b866
- SHA1 32ecf54e1dc849fcb5dcfa6907495046a9d4c017
- SHA512 1b58280efb791cb307e40ee27af83f5376a64bd8667494ce12f0545bcdf8c5d49bdb5681ba18ede833a509c5a25a34a56285ecd353c22bf26d0cad5f87e23c90
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0G6:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3Ri
- TLSH T1CC256B63E69008E4D916913489994A12E771FC1E176086DF277C9F252F33BB07E3DBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 962KB
- SHA256 ef4c369ad776b07b58e9767bd40b5d20f6fc2ed16d226d9daeb0d2e2be9e1053
- MD5 ccbac4659f1fb9a2c697dd01523bc140
- SHA1 c4d9d068ba831a6aa49aedc2402301d330e363c1
- SHA512 afba57ebe7d463fba15a2e156c3e74131ae4b5d5f1cec7b813e1f08ca5a2b09c1f29def3aad21c9ba0c7c2e0bf728274eff781262855a0810202fc573b04b54d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpGd0kQ3R0YF:A3mnXoZjzyUTWaLl3z0zDMCpGdDQ3RZF
- TLSH T101259D53E7D104E5DA568134CD964A12E771BCA60B60CAEF136877262F333D07E3ABA4
- MD5 SHA1 SHA512 SSDEEP TLSH