Analysis
- max time kernel
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 00:43
Behavioral task
behavioral1
Sample
2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 810KB
- Sample260729-a2w85a1alg
- SHA256 cb7b2ab6e1679d6d9634699068e107b8560cff994c225322b24cd700d475a696
- MD5 99352d0e59fb6df91da09b8d8c19d2ee
- SHA1 e1e76421c61d9b3958bf784ddeedeb611c87c716
- SHA512 ceb81641952e54f7b818ae37e180dec4f53d6b7ec8797243e59c162aa8e7580ec414262f8c3b43fd16b663e033af0dd3978c9033f6b21f5e63eeb164a8a816d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81o:A3mnXoZjzyaEFo3+aWiausOzyl81o
- TLSH T1B605AF13E7A110F9E116823499E55A12FB75BC261760DBDF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 30 IoCs
resource yara_rule behavioral2/memory/1168-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4f9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1168-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4968-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6c-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-357.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-472.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-588.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-650.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-723.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-824.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-951.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-976.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ee4-1123.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d6d-1202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d66-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019d63-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b0-1842.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4f9-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e6-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6c-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-357.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-472.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-497.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-588.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-619.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-650.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-723.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-824.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-932.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-951.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-976.dat aspack_v212_v242 behavioral2/files/0x0003000000019ee4-1123.dat aspack_v212_v242 behavioral2/files/0x0003000000019d6d-1202.dat aspack_v212_v242 behavioral2/files/0x0003000000019d66-1330.dat aspack_v212_v242 behavioral2/files/0x0004000000019d63-1368.dat aspack_v212_v242 behavioral2/files/0x00020000000066b0-1842.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4968 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1168 2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4968 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_99352d0e59fb6df91da09b8d8c19d2ee_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1168
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 810KB
- SHA256 cb7b2ab6e1679d6d9634699068e107b8560cff994c225322b24cd700d475a696
- MD5 99352d0e59fb6df91da09b8d8c19d2ee
- SHA1 e1e76421c61d9b3958bf784ddeedeb611c87c716
- SHA512 ceb81641952e54f7b818ae37e180dec4f53d6b7ec8797243e59c162aa8e7580ec414262f8c3b43fd16b663e033af0dd3978c9033f6b21f5e63eeb164a8a816d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81o:A3mnXoZjzyaEFo3+aWiausOzyl81o
- TLSH T1B605AF13E7A110F9E116823499E55A12FB75BC261760DBDF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 909KB
- SHA256 07cb16df53b37a8ce5f76450a3eda00b510c38d05a67559f8c0eadde0891d25c
- MD5 dbc04709ab0a68aee672c2d4820d15b8
- SHA1 fa9725e8a040309447fab968fd8a590326752c08
- SHA512 223be6e2702c9239be179968a0c241ee9233e633107bc204571ea540d340c4f548d11455e051d5babcc5642c5c9be46eced48b9eb873d1e5f1cfce53dde45215
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiausOzyl81b2MqDBxc:A3kMvOMqlxc
- TLSH T16115AF13E7D010F5E166813499E55A22FB75BC221B60DADF236883252F327D0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 4a4d5b72c134196e8cea1688985fea60adffe81dc639889ffaff7bf9abe0b3cf
- MD5 6ab04070f2a016a15cd7d4dd180e8b54
- SHA1 1387744c7f55b25c3c40ebfb87381d0cbf0dbd12
- SHA512 26a61f460c7760b46c99fd92e6d5f38307f03b6f326b7ca60846df8b25cee80fce6f92746b66b2f61e2f3f80dc093a275210a7aa568724fb4cdcdd88ebf1f7c3
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiausOzyl81w0Le5ji0hmxNrM:A3kMvUPji0Aj
- TLSH T11B556B17F6A442B5D073C179C9E29A5AEB7138521B308ACF1398C7682F237D19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 825KB
- SHA256 277a1a08b79877a96015f2a4ed59849e4f722bc230960d7f15deb2dd7c536982
- MD5 142ace79f0bd312621de421bf87b4ad0
- SHA1 7333a66b11accc31effddb7273c0166409fbe5de
- SHA512 27e7f14ab16f355538ede18587475525b5312a92daeddc3b77015a20eaadced34ee24f0c90988fadab9c75de02100c304bc34b72c425cb6f3d57823cacad7136
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81Ka:A3mnXoZjzyaEFo3+aWiausOzyl81Ka
- TLSH T17F05AF13E7A010F5E116823499E65A12FB75BC221760DBDF236887252F327D0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 858KB
- SHA256 c026e9c49b62c7e2d2538836ee3bc0a9ed586f032f7849e645f97bebdc8d1a54
- MD5 1c7ca8de446c226b053aaec6234f2fa4
- SHA1 6b2f2ddf0f7fbda71a05a1178075e6412923432e
- SHA512 ef686093dfa577c69e2dde1f133e6a58c3c9d7a31de445fc23baa6047e714d7caddf3db43d7f174df53aaf1c327884c578b1f9fd504e16018da9781827ac0974
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81Zb:A3mnXoZjzyaEFo3+aWiausOzyl81Zb
- TLSH T1D7159F03E7A410F5E55A823499E54A12FB75BC661760C7DF236882252F337C0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 834KB
- SHA256 7cc6d986a749d6ef3e00bf739478df15f9cc79dcce64a831efdea3192fffb0c1
- MD5 171031b6a6a99af00628ceb0d488379b
- SHA1 67d0a84bfb01bc0abe031f1e84a7317d4bbd2b91
- SHA512 d6befc01430dc126cd049a375ba0002ba505136fa4e3a4151af6fd7e0e5ab04ff484cb219bf88a303b0b63bc36cd1e93749e49e03ef7196587a6b16c6af0d4b3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81m70:A3mnXoZjzyaEFo3+aWiausOzyl81mg
- TLSH T183059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 834KB
- SHA256 81f90e89e600b5e150cf806d1ae3f2bcc5dc94412cce3da5ec9110e0530cfb6f
- MD5 6195cddd954086ed29bfeb642cdd5da2
- SHA1 c6b9d0f7136f6838d9a0494d51f202d6f5c2217c
- SHA512 c6739f2b6bda9499cc71e3dc200686243d95afbb6b05d1b839b1e29e3dd2613e809089545dda950a264bd0571f42433093fa9a900240afef9cf69f0915cda884
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81vr:A3mnXoZjzyaEFo3+aWiausOzyl81vr
- TLSH T1AB059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 834KB
- SHA256 99dee1a707804a0f7525918cdde49701eea3a54e187fd1a85537c847040c98e6
- MD5 d5d6ca8b3903dd3d6610ed077cd7006d
- SHA1 5255b7d465784df8663ec8776e7bb82b8b36cd05
- SHA512 71395d308b9cfbff49f9427f5741f0aaeafb496838cd1ecef6d478920263f8250e6d2b3880e82af6a282c5096a15c6fee9292270ecb502211fb8adaf1b30487e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l815n:A3mnXoZjzyaEFo3+aWiausOzyl815n
- TLSH T167059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 834KB
- SHA256 b7a9643c5e2234ccd08e063e5f2d55c664377c4b71daa544d0fcb2c223f5d9cc
- MD5 27fb518db93363961b010d1c8a3240f7
- SHA1 09e0ad147e69d754eff3673d79ab3edf1eaea2d1
- SHA512 c95f46afe0585ca3fa3d2f3a0ee24e807dd5543696ad7f124f2a968d0f4fbe5f6fcee1281ee121d3ab3ab46ba762b0dd13f4403613c49032f551fab5294b6b50
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81Vx:A3mnXoZjzyaEFo3+aWiausOzyl81Vx
- TLSH T143059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 834KB
- SHA256 f45c34c90fabcb0540197ab808111554d77967fa49a3e515970c067fc26153a9
- MD5 6c5050d1ea354c496c1cab1bcc8325a7
- SHA1 727ba0611e498374bd585bff58cd8d689bcc9e76
- SHA512 485aed0f29741b6bbb719a04498d88c197fe37dc295e9f04388534ba142f6a5c96c9fc103ce016bb3244ca5fcfe80882db14f0ca40674cc9419bc1a7ca0ce28f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81LA:A3mnXoZjzyaEFo3+aWiausOzyl81LA
- TLSH T146059E13E7A114F9E116823499E65A12FB75BC261760D7DF236883252F327C0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 834KB
- SHA256 d91383df8b4e16309b2277c505c1d353cb9a83b0c9c73ce3461123dbad38acb0
- MD5 29d6064bc5ab3dfa017ddc13b733f3dd
- SHA1 b97f148b70bdd2855e5b51bfc208f411c1d0d2aa
- SHA512 0a10d95d78925090ed166ba208b8586292bddb85adefb5559c1688149116f058363df61c488bd176859a9ff905000bd82b86684a721b884bc536b874b8f67098
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81c9Q:A3mnXoZjzyaEFo3+aWiausOzyl81c9Q
- TLSH T156059E13E7A110F9E116823499E65A12FB75BC661760D7DF236883252F327C0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 834KB
- SHA256 14bb53780a17cbb125d6fbb5dd3367d8bba5e4c988d0bfd2aa0b82f55b045595
- MD5 ed310fedcd10bab3f83ca27ff038741e
- SHA1 05fcb58fdfb2350159d68577298e517d0310e510
- SHA512 0c66dff6a7e0baedb21eeea17a1ed3aa313bac2c4a6e222c52cd48a5e2bfb4f1ed37c3f5e853dede0633b0928e04c31288253ed758050e4b7c212c3a8aab15d2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81F4:A3mnXoZjzyaEFo3+aWiausOzyl81F4
- TLSH T1FE059E13E7A010F9E116823499E65A12FB75BC261760D7DF236882252F727D0AF3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 834KB
- SHA256 adbed510f14e55e90f8c2ce94a3254eac7d11a3f3455a7e87bf9c1648760a430
- MD5 8391dad26f587416acff57c3f738a785
- SHA1 30697da2e52d88b673f29eb7be9f33b0ca279614
- SHA512 5762f8187f1b96b2e457d8b6707368b408dd922311453611415d127c0a7c9704cb42cc308e13eeaa22bfeb7aefe95e4312d019041e624235a55ab40648c207f4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81Qu:A3mnXoZjzyaEFo3+aWiausOzyl81Qu
- TLSH T111059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 834KB
- SHA256 69bd0466a14b76b9ad753583c307d5c50ff0a07c5f960179a088cedd98ab59d5
- MD5 f6b7c4d575b093df7f6566ca8768782e
- SHA1 ad0eddda3ee5c8ab2c276b569ef1e96064f1fbd1
- SHA512 2c35cc4f3309291fc78210e73112e1ab2eac671703dc8deea3707013b734ddf8f06ce576794ff9d2b5466f348ea9661f81db39876e51227e0d85fbb929c13dad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81Rj:A3mnXoZjzyaEFo3+aWiausOzyl81Rj
- TLSH T1C7059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 834KB
- SHA256 1d417ec233de89c491bb07e5f87c1c4d96c950883b783a6d443a4df00d5914cb
- MD5 63acd0c58de9e8d4e428fe4e797a014f
- SHA1 8bca3d39c2062e106a9c456ae736031e8722d26f
- SHA512 407ee0ecdefd1b8e4c31d6584872c882833af028d98b1c4759e6a1266d24565810ab02dc240acfbf45e2aee99f3a3452f3122d557db6bee8f6d2912e56529279
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l814g:A3mnXoZjzyaEFo3+aWiausOzyl814g
- TLSH T1FC059E13E7A010F9E116823499E65A12FB75BC261760D7DF236882252F727D0AF3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 834KB
- SHA256 9422008174128b59dc3577077d74d1a4c273494e73f969496f73becc0c740fe4
- MD5 a8130546b7139253811b712ce82e197d
- SHA1 2d7f3906cda9c2bdccf4b202a93d106ca01860f4
- SHA512 a1a40dfe26852ed3ec350ad0467d436570cd128cbc883cab28b7920e97844f2cc45e18882a09353a888b07fccbe93466e8004d124dbb0a39281ba8175fee0e77
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81XI:A3mnXoZjzyaEFo3+aWiausOzyl81XI
- TLSH T189059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 834KB
- SHA256 ae849a5fa3f7d7bbb71216bb042a6fdd16bee11c4a7422d1c93c0a4cab8a2eae
- MD5 155aae1428b935014b526c181e005e1e
- SHA1 7aaf5c440530e8ea6fa0a2675172333ae04ad0fb
- SHA512 e5bb639baabaaf667f40bc6dd91a6fb8f76bc7c3760afba8af4ca973989c90783f4f3bfc040564ec8eacaf57310c13f20ffed064e8f885bc9d846386762c1331
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81do:A3mnXoZjzyaEFo3+aWiausOzyl81do
- TLSH T1C3059E13E7A110F9E116823499E65A12FB75BC261760D7DF236882252F327D0AF3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 834KB
- SHA256 f66bdb3d37d97da69ef6e1ea1c059f0df1aedc24ec743491a152a5647676fd4d
- MD5 b896cf1e51aa08e78c8784168c9dbc35
- SHA1 d65372b610e2135a44d6b617c3a4ee20fb7ce613
- SHA512 c09a21447f11d6e95cb2a59378a4b8477bd44d845496cab3bd3c8a583ecc933c62fd196d47d7d80eb064cd30143143b766206eba6f343a417728762e02465376
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81O+:A3mnXoZjzyaEFo3+aWiausOzyl81O+
- TLSH T184059E13E7A010F9E116823499E65A12FB75BC261760D7DF236883252F727D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 834KB
- SHA256 8496edf66f997a01992cbed5b286a72bcb1a6e09aa3bf566134b2fab0ad62f52
- MD5 6ad3cd4c19f74f132a334158d8f2fb43
- SHA1 6b374442e66e3836b0ea92f18580670ac67adfaa
- SHA512 3a9e7868c2b87ec328508247d5aa4fd07ca6635a01165e751bcbaca51dbe0155ab39721835e7afae16c8eb8db183ddc92b0cd565c823355452b1827c0b1ccf8f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81OQ:A3mnXoZjzyaEFo3+aWiausOzyl81OQ
- TLSH T18E059E13E7A114F9E116823499E65A12FB75BC261760D7DF236883252F327C0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 834KB
- SHA256 9c8602338aa6390a743c77dddd1676e12d52a24bb8d8efaaefbdabefb3cc342a
- MD5 22f3e77b1c8917c92b6c5f0107303e79
- SHA1 5f59ce64a3b1a56b16e6ded56ff2fb5cf92a6479
- SHA512 76e897ad69c72371885e71b57d63aed2804d953e49d42af3613579a9fdb1c02057e996b88551404034f4cd162ceb42135456297c0d2bbca329dd94b722466622
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81vX:A3mnXoZjzyaEFo3+aWiausOzyl81vX
- TLSH T172059E13E7A114F9E116823499E65A12FB75BC261760D7DF236882252F327C0AF3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 834KB
- SHA256 b108b61a3e8a8c9cc5741305f1c5ae559a3d7a150b0d40c78409669bf1bbe606
- MD5 a28eef21ced9703fe43a4ab8e14e8e41
- SHA1 4fb140cf77013746caca75adc437c8586faa03a1
- SHA512 bc0c9de6d8459bf18c572f843dcd8718e32aeca553e64aed0117e6cd0a5d52b95b44237d40d84e27be727de4b5a90b00771de28f47645dd381dacce2acaafaba
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81lL:A3mnXoZjzyaEFo3+aWiausOzyl81lL
- TLSH T1D4059E13E7A110F9E116823499E65A12FB75BC261760D7DF236882252F327D0AF3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 834KB
- SHA256 e6fbd182a11582de3fbfda52b935492a7dbc40f5907fd879899f7abb0a351cf7
- MD5 b87f1035d80b46227821c3b39f43880e
- SHA1 a7d22c1b8cecaf954185f57ca8c262e0a579942c
- SHA512 cf34189363d1d72bead81c85a76146bf817c04318984a5add8f7b3a885ced17788a5e5a465f673796f029aec9572f50ee3de6b4ab073874c66c973e81029134e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81DFC:A3mnXoZjzyaEFo3+aWiausOzyl81DM
- TLSH T111059E13E7A014F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 834KB
- SHA256 cbed8451b5fbeee6fcd391d4a96cfc01ad46201446eb9c414870fbe61ec87e1c
- MD5 0cb23e68c62feacb3343492c117f1191
- SHA1 497da8dd905444367d139cdaad8391b019fa3af4
- SHA512 b3678ce88321f88b12ff4da0e3ea3bb5bdca868624577461315dbe9d7166755e74ad9afae4a9d83d49b508e91408837161ae8066e2bef901e7b808d2e679ea72
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81Eh:A3mnXoZjzyaEFo3+aWiausOzyl81Eh
- TLSH T13D059E13E7A110F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
- Size 849KB
- SHA256 fa9e60faee6899d2f4d18a7a5db52ba232e007ccd306810d98f7c2a8f304446d
- MD5 10823c42923e6882dffc0d39aba9f674
- SHA1 a1799105dbb2132aad310d714518c7e038a32ca1
- SHA512 f5fc6eef9e2ba833aed50e13539fed4c6eca03a358cc25b477bd7e49c584cc2c71525e89c31cdc8d820f79461df9b09e08e84cec1bd6aeaf7c1bf32e3819950d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81pi7Wl0:A3mnXoZjzyaEFo3+aWiausOzyl81gWl0
- TLSH T13005AE17E7A010F9E516823499E55A23FB75BC621760D7DF236882252F327C0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 865KB
- SHA256 da48bd106a50b6ae02ff677c14a6268b130190f63a359687d8505c0a4e3e8e1b
- MD5 73a1078ab38e3bf088b8985e8dc829dd
- SHA1 192a32c89de4415db18348613b0989524823d007
- SHA512 77a4fb8992bc99a694887259605a40a75b24f7b03ba2def407ea9275acf0bc7fe0c4ea2354bcccca4e589f8e958851c04dc651a990b6eb35a856b1f75707ceb4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81m2+:A3mnXoZjzyaEFo3+aWiausOzyl81m2+
- TLSH T11615AF03E7A010F5E516823499E55A22FB75BC661B60D7DF636882252F337C0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 871KB
- SHA256 fd8c74a2e1a7f038d83c2be856d4fa8720cc43303608e854a3ffaf90758b27ac
- MD5 bde8002332cfbd07607c5f094df6d01e
- SHA1 3c687c30fd420f1fb19577106ba7c87aa1795eb2
- SHA512 9da631dd3b279256685fe2a9a13ad7694f8b5670d345559a87136fe4ff96019315521dd7fe6155a8e636ed17cdadee0dae081a0876b2ffb83538b3226232e6a1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l8186:A3mnXoZjzyaEFo3+aWiausOzyl81B
- TLSH T1A4157C13E69014E5D516913099994A12EB71FC2A176086DF277C8F252F22BF07F3EBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 889KB
- SHA256 c17b2ef6854150f5511668f327a4a81a87cacf7e851c720f972e6f01ed7cbbd7
- MD5 3d45eaee4ff044dac2095b793937c99b
- SHA1 2ac79a87ae9962c2262b466ba99ef736660384da
- SHA512 273a103226c7f6c31123ae3b850cd78b202b3b048f0d10dbaba2bfc2f7d1f27c027c9ab0c78c8f28bd4fcca0282dac152baf5ee853803f9dff88b582de8bdc53
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8l81iF:A3mnXoZjzyaEFo3+aWiausOzyl81iF
- TLSH T129158D03E6E110E5D6564130DD964A12FB75BDA21B608AFF2368B7252F327C0BF3A764
- MD5 SHA1 SHA512 SSDEEP TLSH