Analysis
- max time kernel
121s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 22:15
Behavioral task
behavioral1
Sample
2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 906KB
- Sample260719-16bfbsdy4j
- SHA256 e04e119badcd8fc2d69204c7bcb4e8384d1963d1279dbf9df2ac7ac0e741044a
- MD5 72f8aaa87dd42e755f17bdc8a54d579d
- SHA1 ff0d55879836115d567fb04d5ccc9f4e7dc6d0f2
- SHA512 de41abf304992cf4a0f2cdc5a6628610af34148d4c25a14e8f7245b1b784cc5de9d2ebdb3977b91ff29a33c4daa0317526051ed8c938a513c5fa710ba0b68443
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jw:A3mnXoZjzyaEFyKUluzyAZJy+a6Jw
- TLSH T17615AF03E7A410F9E55A863499E54A12FB75BC621B70C7DF236882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 47 IoCs
resource yara_rule behavioral2/memory/4448-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4c3-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4448-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4056-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8a-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188cd-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a59-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-319.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-357.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-415.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-434.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-460.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-613.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-705.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-767.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-804.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-817.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-861.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-971.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1002.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a95a-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000019f15-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac7b-1235.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019e4d-1357.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018862-1501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018868-1544.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018877-1582.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001300000000079a-2025.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4c3-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8a-60.dat aspack_v212_v242 behavioral2/files/0x00040000000188cd-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a59-210.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-231.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-244.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-252.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-319.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-338.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-357.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-376.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-389.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-415.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-434.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-460.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-540.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-613.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-644.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-705.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-748.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-767.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-804.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-817.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-861.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-913.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-933.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-952.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-971.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1002.dat aspack_v212_v242 behavioral2/files/0x000300000001a95a-1136.dat aspack_v212_v242 behavioral2/files/0x0006000000019f15-1186.dat aspack_v212_v242 behavioral2/files/0x000300000001ac7b-1235.dat aspack_v212_v242 behavioral2/files/0x0004000000019e4d-1357.dat aspack_v212_v242 behavioral2/files/0x0008000000018862-1501.dat aspack_v212_v242 behavioral2/files/0x0008000000018868-1544.dat aspack_v212_v242 behavioral2/files/0x0008000000018877-1582.dat aspack_v212_v242 behavioral2/files/0x001300000000079a-2025.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4056 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4448 2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4056 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_72f8aaa87dd42e755f17bdc8a54d579d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4448
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 906KB
- SHA256 e04e119badcd8fc2d69204c7bcb4e8384d1963d1279dbf9df2ac7ac0e741044a
- MD5 72f8aaa87dd42e755f17bdc8a54d579d
- SHA1 ff0d55879836115d567fb04d5ccc9f4e7dc6d0f2
- SHA512 de41abf304992cf4a0f2cdc5a6628610af34148d4c25a14e8f7245b1b784cc5de9d2ebdb3977b91ff29a33c4daa0317526051ed8c938a513c5fa710ba0b68443
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jw:A3mnXoZjzyaEFyKUluzyAZJy+a6Jw
- TLSH T17615AF03E7A410F9E55A863499E54A12FB75BC621B70C7DF236882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 935KB
- SHA256 8b574e93083d35701e565459e7dedcbfe31fa3ce8745b3c58a03299985db7a1f
- MD5 8b116178edd238965f4601913cb415be
- SHA1 f3e3a0055247bddccf2e6753eda880cb629b998a
- SHA512 718ae1bb9ab49766e20e2a013a5938e0928af17db32e6633f23f12842eda74c8f2bbc36067c2473151cb5fb8ca7dfdaec1762f8c9dbd31a1ece3223b5fbca7e9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JhP:A3mnXoZjzyaEFyKUluzyAZJy+a6JhP
- TLSH T16915AF03E7A410F9E51B863499E54612FB75BD621B70C6DF236882262F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 952KB
- SHA256 b82a8dcb27c151d1bf391a6dbe5283d37abe5e5c17b8d7f727828f71d73403b6
- MD5 370c332db2709f5ed22845f2b7960568
- SHA1 dc0c4256217207600b25d0193f32c3fc8874b68b
- SHA512 d07131915f05de6309649f3dc13bf2441c583684c4dcec63d97933031be3bd43514d17528f27e5e208a685180426bc08f496370b65a7d587a13c9bd302175b6a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JK0:A3mnXoZjzyaEFyKUluzyAZJy+a6JK0
- TLSH T1CA25AF03E7A410F9E55B863099E54A12FB75BD621B70C7DF236882252F237C0AF3A765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 958KB
- SHA256 87245d7b94315b9b77d55e566cb071705a5d8be7524038f2489f6ae76de8e860
- MD5 7c283001b6787c670940cac75030936d
- SHA1 2344e0ff242304c98af8499d77baa63cf7fa0f89
- SHA512 f45c1c6a6bdbff1e4fbd79108bd391ac7a9fedbc34bc1087c02e9b9943cfad5c17aeec0b36e82bd2fd21de5614c93adae4eac4e47082ec0e0db4c0820a603175
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JEFfj:A3mnXoZjzyaEFyKUluzyAZJy+a6Jqfj
- TLSH T19A25AF03E7A414F5E51A863099E54A12FB75BC621B60C7DF236882262F737C06F3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 40315312b9d7c77c902d5f3946e41058c38080ab45ada6a97b7171c4064af03b
- MD5 911ff989c5c3e90789632d6860a2bf7d
- SHA1 5f82461e1592228a7253ad80eb68411a80e824ba
- SHA512 b20055d2ea7b2eaed73614e4e4a4ffbe039f2273e177a3856923c668b5b40be49ad4923421eb381c9c5ccdcf8483c31ca9ed240587ca11f053d038899111d6f2
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZJy+a6Jf0Le5ji0hmxNrM:A3kMjKJ7Pji0Aj
- TLSH T1E4656B17F6A402B5D077C178C9E2965AEB7138521B308ACF1399C7292F23BD19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 920KB
- SHA256 11c8e4d2c01919e1208cdb294e54af0ce4435dd53873d3bf296801fad08d6545
- MD5 982cca722aa605fafa7ee7cd1ee9e132
- SHA1 3c56ebf40a3e613b34b5e384d98413cbc81e5a24
- SHA512 301cf3ae8751b1f266bfeab3d4eeff9b7619b70858db91a251c9de53dea0778729d731e4ba2c163e9a37fe36585e74d1be6103edbc082654f14e14f78c9c8d08
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JBa:A3mnXoZjzyaEFyKUluzyAZJy+a6JBa
- TLSH T10D15AF03E7A410F9E55B863499E54A12FB75BC621B60C7DF236882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 953KB
- SHA256 65d78e4573320f1ebee74c094a98d5a4a9f12fcd098be883f8a93648dd23c106
- MD5 e74b0b94daa9e196126559264380bc11
- SHA1 7b90f1c6dcf29f2ca1c29547c7ef3870f6fef5cf
- SHA512 ab741d703835a24c596bc991af6b5756d79b7f68213e129557e6e27db661f56aa264bd6777eeeb1d7900d785af5174687a37f032c7f3c4bbb03ada3c1965207c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JCb:A3mnXoZjzyaEFyKUluzyAZJy+a6JCb
- TLSH T1B625AF03E7A410F9E56B863099E54612FB75BD622B70C6DF235882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 929KB
- SHA256 9389014b857e697d27b5d773a6f3cdb43d7c74a2e9f619fce0c6abda47d80061
- MD5 4a35f8f30e72c0339c9ae282fbca18db
- SHA1 8d8d0603d12fc79e30a01b2c1fb5f075ed793636
- SHA512 5baa5f1488cbcc34cdb47ee389b4d4f37a1212119713c76dbd2a5f6e5e1e7ef561043c719c96b4658392212b36f7aaee3bd7d2f0f3f032ac2ebad42dcaab86a6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J5Z:A3mnXoZjzyaEFyKUluzyAZJy+a6J5Z
- TLSH T17915AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 929KB
- SHA256 2b7301151299831e1aa1da94e676ca4bbd12def5b8d7852843de87e680662351
- MD5 d1a697d001af5f57929aa55bd9561665
- SHA1 d2ebe7437f2e12bd17e272a29517f3eb35896482
- SHA512 cd8bf9aa30f15eff9eed6f9eb4a07f858eec5900f00b2ddce81fd810037b9de92f43ca18f9a942d153b578d16003b6140706079425dae68975cbb69085276359
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JS1:A3mnXoZjzyaEFyKUluzyAZJy+a6JS1
- TLSH T16815AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 929KB
- SHA256 f2d30efdc82bf4f78c5cac67c782fc032deef880f805aa5f850b48262895f901
- MD5 2d8666e749852ac2663ad98ba5a43981
- SHA1 d17fffdf9f868b7aa7a9e64972ccc853c129619a
- SHA512 ec7dac3c12710ffe0a0ba090fac07b430a699f971685549a6a28d5e85f6e1049677e1a7f922f47a95e555d43b0df405d7ef3a0d96f17fb9ea274913ba9b11246
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JcN:A3mnXoZjzyaEFyKUluzyAZJy+a6JcN
- TLSH T1F615AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 929KB
- SHA256 a259a9f1cd517acb6063e7b801f80e4c088b580943531d8151184dda90e827f5
- MD5 4031bc04420947e8b3ae4704bca15663
- SHA1 a5a2e7b3d1211b24b9f4567c572833d97af80a4f
- SHA512 65415ee9533dc25353a1a47e8034e1cb8aadced5c0fdd0e3c2389d300c76a3a8a668c0464ccfe767832d58d9f17da0a6a620bf0bd279ae3bc7ae6b8d9f85ea00
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JSf:A3mnXoZjzyaEFyKUluzyAZJy+a6JSf
- TLSH T15615AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 929KB
- SHA256 5c699593c0421d2ef2d9ad3faf3c1cde2fed59bfca5710d4b0af5dc401b92684
- MD5 65439a7ab4995fb7e93d70d7ff6b4856
- SHA1 111a00fe6a1b68402b6ff15192321584d9d4865e
- SHA512 9c258077a989ca46f0312e989a63067fba879a6ae80731924136806afdd8d785d5d871f4d1decde4dd4af4230cc730d1c6cbd0994784827d6bc81dca0eba6f22
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jso:A3mnXoZjzyaEFyKUluzyAZJy+a6Jso
- TLSH T1C115AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 929KB
- SHA256 c8e3d443079ec2c38391502e05d83419ec9396f13c3edc14ccfb8c600ac9e5bb
- MD5 5c22f63c3f5f400c1840ded440d6aa3f
- SHA1 1dad0815f811801533435ccb0dc9f3cec93c2233
- SHA512 340f18fedb8f5a24be766fb6b96863e3cb8cdef4d666ee5316d8530259598c2a39bedf6fa7c006c77f6108c57fadf567abf9405e8ff6a3b5bef9e7f444af1cbf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JMu:A3mnXoZjzyaEFyKUluzyAZJy+a6JMu
- TLSH T19315AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 929KB
- SHA256 f9aad16b9b8e72eebec5ad1150c45785aefb6b92b37a28974b05439aace66b46
- MD5 2c24c87a70c2bbeb10674dd5e1de4594
- SHA1 2671c17c7e39829c860036da7303fe2f4a320e41
- SHA512 f65ae07b0d5353d3b302cfad67f271bf981ab7deb12970284f3e78a669d8658f865b84d13e474c34ed4075e67993c7552fd160f144cf6fd69551f00a922f4b3a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jgw:A3mnXoZjzyaEFyKUluzyAZJy+a6Jgw
- TLSH T15A15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 929KB
- SHA256 88403bd0b9272735c58b25a3d5f59121f0b0784c8051e92c0ba03799d28b7c56
- MD5 1c58e03b13a8caa6c15aa71f55ce83de
- SHA1 a3812fd454c1e81cbb4664272203ccec545e3604
- SHA512 2779e442b57b63b4cac756c3b2716948907b2a8818ab14722cd35138fe9044bf0a56288c19fc41d569fdffd1d2bd6360d5619ed766e61cfae6fcc577776e4c7f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J/T:A3mnXoZjzyaEFyKUluzyAZJy+a6J/T
- TLSH T1E415AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 929KB
- SHA256 59a7caa86844107632e1928cda1199331e7f3dd49104b6f6b8ff05878da8f5ab
- MD5 1f8cec8b94c780bdea0613d09f6282d1
- SHA1 b86d179a1fe5c77bf2f7981adca41b6d9a6ef550
- SHA512 746d34e8baaff51765704af1f4438346369bf637c9b42f5db6fb0edead99caf6a12e67046d8f25107fd5c18966946687d43b71af8a828e694e588cd47940c449
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J5u:A3mnXoZjzyaEFyKUluzyAZJy+a6J5u
- TLSH T16915AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 929KB
- SHA256 9981762a4f978477e2af69e35a11ced2935987d132345bd0fa032318c15a2125
- MD5 dbf4a0dd064364f6b3042494058e58b7
- SHA1 28c976c31d581c7124e9a8d14be0cdf9bd959103
- SHA512 5529a83b0abee0c544add543136b3304a050bfe2450c3409e6817b99ac5fd67fb250c96e76bb4cbfc5243faacab5090057b458978d26c4bf293122d0952cdfb4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jxb:A3mnXoZjzyaEFyKUluzyAZJy+a6Jxb
- TLSH T16415AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 929KB
- SHA256 9744ea5791323e883f3da329c8732e9013ab812aec37651b6d56d23fedb4cb08
- MD5 1b59e0011903f2ed9019ae19054be9c1
- SHA1 f100a19503784fa8aaaf69b9b74c5e448fe72374
- SHA512 25a416c759821c050cffcbb4d013b10e4ed2547f83b865dcd611139aafaf77b76ebd4d164ae61496bf3159d0ca72cdc7c630baa29dc92f33e516986c975f89cf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J5f:A3mnXoZjzyaEFyKUluzyAZJy+a6J5f
- TLSH T1DD15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 929KB
- SHA256 9513859866b24713a0b4ef3ee251fa6ef11f37b061c953eec97925eb74558519
- MD5 4c60338eceb63fa8957c2b5c82ee8d6e
- SHA1 3785f31ffaba4f7788247f030706b260d83d8dac
- SHA512 0863dd3ac3d71f7baf953c9cb11e9b32ac4fecc4d71e200ab3b2cecb25b84cf3a3589a969edb9b70a7858a51b6cd02b8f3a708cc7caedb0bc47535efba74ee2c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JCK:A3mnXoZjzyaEFyKUluzyAZJy+a6JCK
- TLSH T14715AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 929KB
- SHA256 b82aad303108a7bd696cce095218a194ea342858e62a02bc2efb7ea3454d7919
- MD5 b7bde30e9fd07195549fb00192de6b23
- SHA1 356bd28ef37ff62f09e57d70b6b0258ce13ec20c
- SHA512 72eead6c5e27c550ffde4f9c71f61a060a352a523c744ece253ef60526bf63ff20bcb4f9730170ad9ad709fbcbcffe9ac2006a58ce484b343667f2e513fffd50
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jnk:A3mnXoZjzyaEFyKUluzyAZJy+a6Jnk
- TLSH T1E815AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 929KB
- SHA256 ed2937b59cca48eeb17909c89804f0f992f7e3846a4451af102c65d05f94d9a3
- MD5 019ae2f915563cc2cb9376d63bc098b5
- SHA1 8e6659858b74c66c408176605cfc9bc6db900cdb
- SHA512 cbf468a9958e29faed04eee89e6f2a78024927c8391048d3a2c201c2867a317f2fd2307609b36bf1f467fa8c30d8fa6b600d61b7652d78c29fb6485b456a556a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JQ0:A3mnXoZjzyaEFyKUluzyAZJy+a6JQ0
- TLSH T17D15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 929KB
- SHA256 653f8b46b6dbed57a40c2472901cdab6d4868d2ab8610c005552eab4c856fb00
- MD5 466a4ef1d902c5b7597f7a4bfd8f69da
- SHA1 620e3ede888606d271a3568283951d09035bbf28
- SHA512 cfeafcd7f57132ae61afcb60cc20ec18239396c937e1e406fb3fe1b17c3ae43d92d0d99d4b61e0d1a1e0d591aa9cf7180b671c9437587a9a188c057f56dd3a70
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jr70:A3mnXoZjzyaEFyKUluzyAZJy+a6Jrg
- TLSH T13915AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 929KB
- SHA256 a8c1c191b5ef6dae71f3cd8cffcb2c0e125a0d3b662d892803bc2fed1e6c6c9a
- MD5 05cc4b847c7c9d9e6f450b5d1031e209
- SHA1 3790f259be09d00e671e35d98dcaba8769917638
- SHA512 bb9ebfb688d8d35c5d62125bef264749f425ed46feaa4d6e1e5e61799c947c2bddf0f777198a639af39abdd02207efc5c0468cf4871b1e3333017ec5ee52deca
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jmr:A3mnXoZjzyaEFyKUluzyAZJy+a6Jmr
- TLSH T1C715AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 929KB
- SHA256 142c02d672a4e1cb4de7dfbc2a4665d68be59add270b9e98bda1e30222f4298f
- MD5 b397939e7cbf4d88acca47007d6c53d3
- SHA1 71833882b5bec0479f818f43339723edd6897830
- SHA512 3b190346f72c46b4dd2d4626a639071489e010743fc28af0cf1efd4094f6c11ea3512a2afe02f16ff37262bdac19198c1c0b6bb92adf59865b72bc6c28d3969d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JMn:A3mnXoZjzyaEFyKUluzyAZJy+a6JMn
- TLSH T1E015AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 929KB
- SHA256 08b8c07da0d8cbec82ef10e0210683186d0f99e4e8b662112372800af3d2c308
- MD5 961a05b86f4790e0b105b07738ad2ed8
- SHA1 296e05c9e4f1c8a825290ada9a6f94f3626ee1a7
- SHA512 492872abc3cb19d6c3f1412573639fa3dccdc125af24d9347805a8749a0d77349e5518c090e18179d17e8f3e41f1b725760a890f242f3c5b4671aee2d127fef0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jqx:A3mnXoZjzyaEFyKUluzyAZJy+a6Jqx
- TLSH T15F15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 929KB
- SHA256 a246e29ea8536c738fbfd27d67f20cf103fd35278121479158ae7e92c9be039c
- MD5 e85d7a88e820197215b9c3e067e22081
- SHA1 f5562615ac2ea5fc9dcbe98e0a478095b94eda6b
- SHA512 d38529550a87d7eb9225187b691a796fa4c9f03534b73735d57725f91933a3b80715c35d8edd7eb9444b6069b6ccd39d3217908de7b2b7f55dfb68277417775b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JsA:A3mnXoZjzyaEFyKUluzyAZJy+a6JsA
- TLSH T11415AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 929KB
- SHA256 11aab816cecfdc16dc6ad1be5b9e42a4039d9b9d0ac516a97edfc18f50439d9f
- MD5 3d3cadbf08b85b09ff35d4d1df2f8280
- SHA1 3e112b4cefdd9fdc86bbf92092a1c4cacd4b080a
- SHA512 396373755ca3d8f2a48e768c348e50263d8c4cb79529f1ead528998dca7c4b478001babf067f57eab5a0e844251e395f548738c5eaa4c5758d8f386bdf6c417c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J19Q:A3mnXoZjzyaEFyKUluzyAZJy+a6J19Q
- TLSH T14415AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 929KB
- SHA256 6ac0c7fed1716f6d3605b1e3f3e4ab698f49dfbe5f598cc102a4a7fd8de907b8
- MD5 d79e867cb922249d32797aeff3e1ffdf
- SHA1 dd4585a13104bd3cfa243f936c39f1eed35bc735
- SHA512 ef23fc6e1d02dc756c2c47619a0b034d83db9eb9862b098db589a0998863fb772e4e9aa3022ba49a6ea3cabd67e84c9805c13e98554173fab77d672c3b4c5524
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JA4:A3mnXoZjzyaEFyKUluzyAZJy+a6JA4
- TLSH T15915AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 929KB
- SHA256 7ef1233878b346dadf4d89886f298cdaecbb643af281209040e5381db92828a5
- MD5 9682ca4135e9ce506d3df40f4afa099d
- SHA1 973fde3da00323ea43c13d9e2fec807c3c3ce068
- SHA512 cd5997f5c72e67b519d311cd5dab09c5d5d73ee7b45b4456f597b93ccc704a79bf2883b3e69cda632e67d389b19958bc7deb2044df51c9bec5b6553bd76cdd19
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jju:A3mnXoZjzyaEFyKUluzyAZJy+a6Jju
- TLSH T10615AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 929KB
- SHA256 19a825e796d4c97f6c3f955c9af23ec19ead96f66d47dc3b53d6135df86f9f01
- MD5 485866578fcab9b49784208bf8caf678
- SHA1 60c66122357abcae4321b1009f5087400da1becf
- SHA512 4c650540b0a429ee4ac566c6db8a7dfd5e943302dc8f5f4aa9c97d547169cfd2cf67fb5cd7c8abd64452e8f21d1c5401ba27d9f077b132e7b4548e49bbda0944
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J+j:A3mnXoZjzyaEFyKUluzyAZJy+a6J+j
- TLSH T17F15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 929KB
- SHA256 afca78811f14b465323a75a4c09362f41595acf27e587c26d29a1558652c5338
- MD5 25934536a06cb8cd6de6d329e98184bc
- SHA1 3d9d9f4392be9b5e55a77899cf33b796dc94ae05
- SHA512 ef5ae98ae5d92a105af386454ffb5384b2a21dc23fc8bd59fece12ac0008b7286cff861093e1f1ee8294fa96dfbdf8027fcc578911d7b276f706e3321f09a3b9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JLg:A3mnXoZjzyaEFyKUluzyAZJy+a6JLg
- TLSH T1E215AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 929KB
- SHA256 7d0d9b5b4ced5285a7861933611a4c83c1d339f8cab8068268bd88fb0de91a91
- MD5 9d80b879c7d8f6e41b579fd838bea332
- SHA1 47e89f8dce212ce327587e7cf7e18489b76f6f06
- SHA512 f90941ef8b289496731d3c9984add40a7af6db2053172a22d0071823509f599b44cb00cde16a1ea8a24618ab6e064a67c4b019dd8af6515c8a657c186257f665
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JWI:A3mnXoZjzyaEFyKUluzyAZJy+a6JWI
- TLSH T17815AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 929KB
- SHA256 6835298a2a666a6d3536be1a779f43fa93886d16729b05099452c551ca209186
- MD5 ffb2f6c7923c6dd7df5db1651458d4cc
- SHA1 6f10907990d52fb4896727f60bdd39cddbfc23c4
- SHA512 53de86e8e9e1b4f75f93d012d00e93bd835ae00a60b0f445dd279a3abad253e8f2e6b6e4e542474d87f25a1189af68162b39cbe0caa02ba200ff4e3edfc23e1a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JEo:A3mnXoZjzyaEFyKUluzyAZJy+a6JEo
- TLSH T13815AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 929KB
- SHA256 1e29b78770860a400cb79f46497776d3f403d318ca6337bdbd14ebd98afc9985
- MD5 1bb0ca1d79972a464c34ef2f15565598
- SHA1 b40efd8e18d87e30e870029cb288bb922c87fcad
- SHA512 ad9a2bd5caa8a2f9e3ebe44d0916553b2c5bd7bf510233f12a9be3e78cf7f8757d7ad14cd29cfa3392ef8aa634f94fa32671fb6da15fb5f0e716a2a83f6ba19f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6Jn+:A3mnXoZjzyaEFyKUluzyAZJy+a6Jn+
- TLSH T15615AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 929KB
- SHA256 64621fd4fbd5487bc676d24108c42df5faa27a3b4bb30e294afdcdb02fb63260
- MD5 ad9e752a24fd3fee053da5653966b6e1
- SHA1 96290be8f0f247e59ef8fb860be41008f4dcbf38
- SHA512 dbf84ee18d8bd5dcde383a3558a20c085393ef59c8dcb673afe0024f1eec44749ce91bd8fd6f81cb4cc0924bc0e489cdcc8eec0bfec002cd241a1c0584fcc0f9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J9Q:A3mnXoZjzyaEFyKUluzyAZJy+a6J9Q
- TLSH T1FB15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 929KB
- SHA256 4c697d6aab8da4d32e52fb4e313860aaaec4e4f751f78959e18648f46525f82e
- MD5 cea4bccfbaf9e3a459bffdaa0da652a2
- SHA1 931e6470079efe2df78c2d812497e79c1cd308c8
- SHA512 138bdb6d6ac12935bf80cae8ff25a867c8687fd8df43d53003e9691a30096fea1099a863520c31252a7aa3cacff2eae29159b76344b37503976728026e45b9b2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JyX:A3mnXoZjzyaEFyKUluzyAZJy+a6JyX
- TLSH T1BC15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 929KB
- SHA256 37271c1161cd345914044b6de019d9e2f646bb8cc84207da51bd299c0c329af5
- MD5 f41ef0b36c2f35846f63ac224fafc5e1
- SHA1 5457e0b7ccade8fee390ca6e8b1c5ddf9af53c67
- SHA512 c6dde00eb22aec3103a25a899e003d28bd2b3128a2048b6537f4a69d75d585a9601e79fff867ca8cd94f7830df2706fde619a45773f3134ed7986587fb301655
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6J0L:A3mnXoZjzyaEFyKUluzyAZJy+a6J0L
- TLSH T18215AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 929KB
- SHA256 df433b08a6f0f1175dd18c9343f630a208a9c1699e2484cf1c6a58c29fbbdf1f
- MD5 a21f3aa937e8e780ae3bb94b81ebb5ac
- SHA1 6911e7992f0bebabc27f808efe39e2d5008a1bce
- SHA512 82daf74087fcf55c10ce84516d2644a2c0289ae12e6c430ee4d66a34dd4b2ce2e16313c64ee90eda9a9be923528439d1022af1eef152202b930daa8057ef9c27
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JQFC:A3mnXoZjzyaEFyKUluzyAZJy+a6JQM
- TLSH T1DD15AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 929KB
- SHA256 65ac41c6c5ad8ceee88796d0482e5f72a144ee66871868faba297d7603da68eb
- MD5 e661e1f590bd2577aa1ea4f22f261765
- SHA1 577615d84605a7e773cb3230d4b32e260c4500a7
- SHA512 81e46db945d5bb46f88b1a35bc07d20ca200d6536221938d7a7578019261b224394f44ca579846616554d1833af6e5cbfd079288349d5722d2e55fbd8bfd699c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JRh:A3mnXoZjzyaEFyKUluzyAZJy+a6JRh
- TLSH T11315AF03E7A410F9E51B863499E54A12FB75BD621B60C7DF236882252F237C06F3A7B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe
- Size 952KB
- SHA256 c2585bfa9a933ce86f53bc2e4fe79faf07a93dfe30809fd7da46a43563879284
- MD5 ed6ff35f239f6029ba83e93ed5277032
- SHA1 1d32c02740ae215a7990093baac832ba9f9e2e57
- SHA512 6399aef5774c7ef1f1fff4c256d2469f690dae83f13f51234006bfb888c871ee2d1e12cffd6d67052d940fe50d34991f7fc0e6290313eeb40f40ecd3e83b0395
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JHb2:A3mnXoZjzyaEFyKUluzyAZJy+a6J72
- TLSH T1C825AF03E7A410F9E56B863099E54A12FB75BD631B60C6DF235882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
- Size 944KB
- SHA256 b306106356744424fcd90cd7e9b300d14e63708bb47f94593861f3f4d873431f
- MD5 1520ef2132771d84bdc1d118379b788e
- SHA1 43e0c831bca36d0dd5f29f189111500896f958f0
- SHA512 166906b71b708930935322cca25f92b82e9d13b8b01d6dccd72b162adf249bdaabf5cbc67134ce995a9aba9c3030f8a7dc1d4b728e347ac4b0ecb3e6efc8d2f5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JEi7Wl0:A3mnXoZjzyaEFyKUluzyAZJy+a6JbWl0
- TLSH T13125AE03E7A410F9E51A863099E55A13FB75BD621B60C7DF236882252F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 961KB
- SHA256 3cd6526fd3278f9f368b42bc3abdcffa7203583e250d079c0d4ba6162a5ceeed
- MD5 d698a39e3a6ec4599989bd7ec4f90f60
- SHA1 5202927ec20faacf6ed73010605b0c30cad5cf7a
- SHA512 9ca577c5b4e7e23a3675bc21e4d98806adece82e6ce3107166c83ef93f0d94824caead5df5ac9fd1a48fbe61fd64634c674250f20c4e58e50b277ab0ecc4fece
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JR2+:A3mnXoZjzyaEFyKUluzyAZJy+a6JR2+
- TLSH T10E25A003E7A410F9E516863499E54A12FB75BD631B60C7DF236882262F237C0AF3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 967KB
- SHA256 cc96b1f6fdafa27e83030eaa64b1593ffe4a5a27b557d9d8f0a8f892d3f64cd1
- MD5 4e953a2ae3ec19a296d4f709969d9226
- SHA1 c814e0333c4e218604722e631b95fba9e6a7dfc0
- SHA512 3eb851b07fa0fb088858b3d7256ddd6493d71a361b44385fd8c1b48dc27dd5f4578a8236010475b7fcb001cee0177823275a44e8022633af1cf5f6ccac56e851
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZJy+a6JF6:A3mnXoZjzyaEFyKUluzyAZJy+a6JU
- TLSH T179259D13E69404E5D516923095A94A12EB35FC2A1B6086DF277C8F212F22BF07F3E779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.3MB
- SHA256 e92392cb9374d792f7bca5593b2b2331f8f614035bd7cf4ef9614cb7b0688907
- MD5 512d0e100ce17bf042b72cd144c9847e
- SHA1 e3069ed708138f27cfc4fdb87d8fd55ffed31cf4
- SHA512 780e88deedce5dd22ff96079249d89ceb9b78d7ea7148fbbdbace769e43c66ea2881162b40fa673feb7dd941699f772b1ef6f3f059ee64f47114722fa4de964c
- SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZJy+a6J63npi63iC:A3kMjKJmXpiMh
- TLSH T18B556C03B7E850B5F5B34730AAB54612AB7ABC625F30C68F2394561D1E71780EE39B72
- MD5 SHA1 SHA512 SSDEEP TLSH