Analysis
- max time kernel
127s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:26
Behavioral task
behavioral1
Sample
2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
- Size 810KB
- Sample260730-vz3ncadp2x
- SHA256 d2e04bb4e8776c1800326a583d98eda2e545e2e9ebedc9292021202ac2f8f019
- MD5 7c537035223867895b501b2663416c94
- SHA1 5a1eb5f81c30cb35ac0f75d207afd9445acb426c
- SHA512 9c2f62c1fd29066e5a0b7d4ec2399c656f3c043ec5a38f5e3e30af61b0fac8c79adf086ea4b31577c6b66ebdc6444f936afc58600ecb006d04db95e28913a2bf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg:A3mnXoZjzyaEFo3+aWiauoOas0NI1g
- TLSH T12605AE139BD010F5E25741309AE55663EB757C321BA0DACF636882252F327C0EF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 52 IoCs
resource yara_rule behavioral2/memory/5604-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4c3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000000432-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5604-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2608-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8a-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188cd-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a59-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-286.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-300.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-484.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-534.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-613.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-638.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-657.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-761.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-806.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-819.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-973.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1028.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1118.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac7b-1236.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019e4d-1359.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019e4f-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b1-1876.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4c3-5.dat aspack_v212_v242 behavioral2/files/0x0003000000000432-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8a-60.dat aspack_v212_v242 behavioral2/files/0x00040000000188cd-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a59-210.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-231.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-244.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-251.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-264.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-266.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-267.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-286.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-300.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-325.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-375.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-484.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-534.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-613.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-638.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-657.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-736.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-761.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-806.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-819.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-863.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-928.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-941.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-973.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1028.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1060.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1074.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1105.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1118.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1149.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1162.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1181.dat aspack_v212_v242 behavioral2/files/0x000300000001ac7b-1236.dat aspack_v212_v242 behavioral2/files/0x0004000000019e4d-1359.dat aspack_v212_v242 behavioral2/files/0x0004000000019e4f-1398.dat aspack_v212_v242 behavioral2/files/0x00020000000066b1-1876.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2608 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5604 2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe 2608 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7c537035223867895b501b2663416c94_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5604
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 810KB
- SHA256 d2e04bb4e8776c1800326a583d98eda2e545e2e9ebedc9292021202ac2f8f019
- MD5 7c537035223867895b501b2663416c94
- SHA1 5a1eb5f81c30cb35ac0f75d207afd9445acb426c
- SHA512 9c2f62c1fd29066e5a0b7d4ec2399c656f3c043ec5a38f5e3e30af61b0fac8c79adf086ea4b31577c6b66ebdc6444f936afc58600ecb006d04db95e28913a2bf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg:A3mnXoZjzyaEFo3+aWiauoOas0NI1g
- TLSH T12605AE139BD010F5E25741309AE55663EB757C321BA0DACF636882252F327C0EF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 909KB
- SHA256 bf7ca8647bef3fc728b1f12e8af9465920d7184182dc4cdb44237f168c4845d1
- MD5 d663987fd9f4d04df56ca9fb0c4edf01
- SHA1 21a0c975359818a1a6829f02f569aa463236e13d
- SHA512 57dcf6894469914febf26c187471eb85bc036f761608a5961f8f690fd7e50af7da3368f608c3a253c8bebcbadb6385f54efe675259a651e99efda26594f1f600
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas0NI1g82MqDBxc:A3kMoI1eMqlxc
- TLSH T1D415AF13A7D010F5E256413099E59A72EB79BD321B90DACF635483252F327C0EF3A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 48a37788b67c38405e7167b4b8ca9f306ae2f6031b4d87d21c9339ebbd13569d
- MD5 01fff4b31fde7941c688c27924716a0c
- SHA1 8478040513bc2b06b0333e58a3270173dba34656
- SHA512 bb3f1fd7bdc5f0a71741df3fe0715fbcf5136871bb027d13bcdfb6fec09f04b0795d2e9196bd7fc44c61addae8cf7630110b0719e15453fee0cf080945cd101b
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas0NI1gP0Le5ji0hmxNrM:A3kMoI1kPji0Aj
- TLSH T1D1557C17F6A44275E073C174C9E6A69AEA7138521B30CACB5394C7283F237D2DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 825KB
- SHA256 b512f853ec6d7f74857b1b4d2e3d1fd0b35123489ad156cd653b1e86652017f1
- MD5 0edbefa79cfd19d5603c6758399f877e
- SHA1 fae41e6608bb92b0daea863750cd87fbf111d2a9
- SHA512 bf272523d75c3f92d2c098b55e254102387852be84ee35096035ddab2375855e7cefa600eccc02074c4b2495fbe6c82676ad61330822de8e9b075112f6a42c9f
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas0NI1gRa:A3kMoI1
- TLSH T1E005AE13DBD010F5E25741309AE55663EB757C221BA0DACF636882252F327C0EF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 858KB
- SHA256 af1489fbe833415bae6122deda83ae70a6b4a3822325a66e5cd7c2bc67b12367
- MD5 ef0c34c83e89d96369b3004b23bf8bc5
- SHA1 78e868f76a94891b27652579c2c18b843c8793f6
- SHA512 8a9102ce896e05358bb22c75fec5ff7d1a5b6fea4bc3c19fe22d202a3abd61376a8a643643955ce824ea1f969bcf8ea9d93771c2ea6c15124f0412fdc12fcdff
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgyb:A3mnXoZjzyaEFo3+aWiauoOas0NI1gyb
- TLSH T15B15AF03D7D410F5E257423099E59663EB79BD221BA0CACF636882152F727C0EF3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 834KB
- SHA256 6022694efcf234d180b2bb14ad9f57e7191ca3f556ecbe69593e06b58fae63af
- MD5 846c690edce9123fd0e85b91d19f0c5a
- SHA1 7d19c9b00964fa8a23ef546252c7b76cbdf9d707
- SHA512 a06e63b75c5f70e176f9a42dea636ab92c566eee359663d9983f6c05362e5a4e0a8bf157c8d4913d97b8da58413cff79e635434d88ff7430ed041cb76b1390ed
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgpZ:A3mnXoZjzyaEFo3+aWiauoOas0NI1gpZ
- TLSH T15505AE03DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 834KB
- SHA256 88729e56e2c58a0a4269136063bd77797bdd7207ccf7b7e0135a5e4b6df40a64
- MD5 f33672bf4d12c8084acdb411f5574539
- SHA1 fc447581c119bdc633cf1dbc074701d93de9a0b0
- SHA512 dc472be725bd4fe3665371203d8f1f718a55c0e87c651309f151af2bcf15510415d657d9414ea3bfcb44273bfc96ee9148efea379ea359ae38ecd12ba7c67dc3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgC1:A3mnXoZjzyaEFo3+aWiauoOas0NI1gC1
- TLSH T13D05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 834KB
- SHA256 4addddb97b6992a8fd25f442bf49d6d426ba216d50443c552810a22867dc076a
- MD5 9b0650fb86cf872fbd5f209bd6736217
- SHA1 d52d0c5f23fadc84eb6af68740b0a6971c929ef1
- SHA512 3ddece0d0fdec509a48313d550464cc2040d554b6ac6b77fdad7cc08f25ceae0e4d461a15eaff9b4369912acf75f5e6465ccb13e2ea0863b360f1ab0023061cb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgo6:A3mnXoZjzyaEFo3+aWiauoOas0NI1go6
- TLSH T1E505AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 834KB
- SHA256 ae55702ff5c3bd7eb8816c64c74212642563139f578912e31376285733891256
- MD5 c0d2d6d13cf96ba852641a6cfa7d39a7
- SHA1 c8ac27fa43a89f9541108b98fa9c4e54a776a154
- SHA512 6b133f4b7f11ab6cbabdc1ac0d3563ab8d59191cccecda62eec9e103a0e9736a139c200cf6c66f0270f9ac120c1947306cdf4fa69635040147c1461860eab2df
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgsN:A3mnXoZjzyaEFo3+aWiauoOas0NI1gsN
- TLSH T14C05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 834KB
- SHA256 6b76f1459f200478bf26494e1882b769429822b845d9c4615d3d4cd1afde795d
- MD5 5d3c1ee78a557e9e45278639815c2c25
- SHA1 fcf4d0c1e990f15ed04b5ae60c8c7ce4dadd85d1
- SHA512 3e51b374c58b5e0d00d72567569156304293e7194bbcb001b93c1f2a6a73c9d0aa8e3ffb80ed4b60408ef47e854aab838d4d8b27e2d86f80a28e04a266da2286
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgif:A3mnXoZjzyaEFo3+aWiauoOas0NI1gif
- TLSH T1F805AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 972KB
- SHA256 57d3df5a17b7ccebe848d5f366faaae0415874a955bb5a03dfff536f50322082
- MD5 0d7aeb3269614f5a7185e33f7e7b2c2b
- SHA1 82bad558b7198e5ec62e1aadd455c5d16f3d41b6
- SHA512 a54880648396f296639d0b6bb831b5344499da6c4f1046dc4044e3e58f28e6cc7a70ad295cc72abbf51d930ea016a669331d575a8b60ef07c023d271f3173790
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas0NI1ghzy7:A3kMoI1us
- TLSH T12D25AE13A7E010F5E257423499E55A62EB75BC321B60CACF636483252F327C0AF7E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 834KB
- SHA256 a813bc4ae6d65bb935d1e16af556cae7e5cc1e9865daf1409f4f86e4e55b7f86
- MD5 7e00e78e77e2809db795082c22f7bf6e
- SHA1 e3bb93f02ad1df5efdb08a9603bd82cc580752b9
- SHA512 e9ad832483c6e8b08fef877f3d7f6bd03d515b2fe150b14d9b24518d935eccf70c85b7bbfd241ee4e42658626f0ab86743cc3a3fef30b1861300936b44185203
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg8o:A3mnXoZjzyaEFo3+aWiauoOas0NI1g8o
- TLSH T1C005AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 834KB
- SHA256 b87821dc1b7638d02a3715655ba4c10b8b1a146ad838967cb64653bdb1d21566
- MD5 c484d77d061dfd611c19181dc4a61617
- SHA1 4debdbd6f9d10fe36376fabaf6e0bf0bd52bd3bf
- SHA512 f33be0757c46a1ca5f08c235a5431df5ff6f24dd20e87704cbc0309ea485eb4e1c43b652945a62bb2918da940b35e5b30ae2d957b2af647954a9a4e45aecd5f1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgcu:A3mnXoZjzyaEFo3+aWiauoOas0NI1gcu
- TLSH T19B05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 972KB
- SHA256 4544cd20f61651d40effdc558b086b4d7a00fdfc5c388f0d881ba838d9fea8d1
- MD5 7563b2c18fd844f48ced4389d29341c6
- SHA1 be3b79f62e2cf3ef9557de1a1571d2aaf8cb038c
- SHA512 6bdd3fe5100ef2ae50765d812933e46f23fa8c1ae77412d4d722d4e3b3b3d500d1672094dd4236d6f9406136ca0cd3bc83e807ba2fff138c2e412e732f26b773
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas0NI1gwzy8:A3kMoI1LT
- TLSH T12125AE13A7E010F5E257423499E55A62EB75BC321B60CACF636483252F327C0AF7E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 834KB
- SHA256 d1ae8b70d7e8a0dac3b06ca94e94bbfcd9c509d3184529501f1beab80f9a436a
- MD5 57ea8fc9161288695b7136239cf54cc0
- SHA1 90119962d0b26c159dfd1baa875f917ce36df65c
- SHA512 d7b73cad9234167e69b52f875084c21dbf3125e191fc3fe3f80017f079205454f1bff7d3d295a9713800ce5a8f01017af6acc9e0612d83ca89552811bcd8907c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgg9:A3mnXoZjzyaEFo3+aWiauoOas0NI1gg9
- TLSH T1C205AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 834KB
- SHA256 05e25fae482921b60fdeeb859a66dd0a0d7dcdb5fde2d6667481234589b0eb8e
- MD5 4fd32ede975ba6db1b0ee56aa1417706
- SHA1 3ee8ab5dbee8550c912939e071d121e7a4b1578c
- SHA512 dc9b4774742eccc689ebbb973adfca35a0620e6ec051d25ad371c8edb7d2a8f1e5de408705e6c1605896c7a21766b79dbe4bd36cc146227510900085d67e1df4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgoc:A3mnXoZjzyaEFo3+aWiauoOas0NI1goc
- TLSH T17C05AE139BD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 834KB
- SHA256 3e25ecccc366d1118ea266a7cd2f727f91aa4126146bf73f53fd28c036e11013
- MD5 eca260777af21b18e09beca789d9e051
- SHA1 9289df8158f92a0f6da8d281444941134c9e500a
- SHA512 65434749234f99908fd3c1e17738d8a111b9b212aa0966fd97bfdb47a493b360dc2b44b62995029f24679c4f04e1ed51b50f53fb0742598a533612fc2995675f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgBp:A3mnXoZjzyaEFo3+aWiauoOas0NI1gBp
- TLSH T1CE05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 834KB
- SHA256 ca1caa7a8829f92781e892d01ac25f22bb38c3d51c4dc862314469c9b3149b80
- MD5 3ae860fb75a634deb2a3c0676b59a379
- SHA1 9b53567d1e77dc6b5c679d7e066760361e85bec2
- SHA512 dabc37d4eb7e0737bca2fb1d6972e32e96664360d1f63b6050ac009df68da3f142377c057588d4a79cddd2caf9eab6f65d75ae3edcc05b4e34e7301e632cf699
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgW0a:A3mnXoZjzyaEFo3+aWiauoOas0NI1gWN
- TLSH T10A05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 834KB
- SHA256 cd3732170ddac73a83204a3668e83f24cb667afa2fbd4efb29cb6c813b9b244a
- MD5 cc25355b3c00a71e063e382d36566927
- SHA1 864d5984bb4b7fd20ed5613c59fe1195101a0a8e
- SHA512 b1dbcfb0e57486a6ad106acb417a34f59d2a981703feeede99da27a037eefca9cf8e7b39e282351c4bda4c0feee38c9ad69ffe96dab05cf32e4380208180ab80
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgaF:A3mnXoZjzyaEFo3+aWiauoOas0NI1gaF
- TLSH T19105AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 834KB
- SHA256 afdda4b6b451ebf55ae1b895fa523e5293a589c0643da2221243a1a7f7be195d
- MD5 070f5f4e880d360974051e10b35b3684
- SHA1 220def926c4e33a5658fa1846168e4561136e394
- SHA512 eed764f427bbcba8d99fe0fa27b43c97c304ef07faef7d51f5b5ee03d014a66d9b687912e28f1dd3c381f71c88b9edff6cec25c371c1f6f796c0513c6c69d365
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgvC:A3mnXoZjzyaEFo3+aWiauoOas0NI1gvC
- TLSH T16E05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 834KB
- SHA256 4a3aec4a220c4fd444544c410fb45e776c78836fc744b39d6f17ae083dfb5431
- MD5 644963ff56a970c4278be4f9750b77c2
- SHA1 e3530dc67093b18db6ef9a16881ead1a232116f7
- SHA512 c2628ca1c849025f4e2c865bd9bac273ae7694af7134485fd30d7cc35d34b289a1959a640cf59f264e9b04e2f5a17e55b1b99d0ab00d08467d3fdb6882075591
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgQw:A3mnXoZjzyaEFo3+aWiauoOas0NI1gQw
- TLSH T16205AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 834KB
- SHA256 7b62acd4fe2b69578d381f62090f061fd8b7f5fa69c93046d3ca374a3008d905
- MD5 ed54c949d490d018de6f5496b2c72c20
- SHA1 babe1771a14121a11968d5cfac1bd16b1afd3bd5
- SHA512 3a416576dcc41adc6b21fd541eb10b5b515f076bcca567e03de309a1ad4e3fb89aafed80e01ba9c69b1ba7b97194dd1b8f2cdea5f58909ed9adcc909f4feca49
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgvT:A3mnXoZjzyaEFo3+aWiauoOas0NI1gvT
- TLSH T12905AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 834KB
- SHA256 ca7a9842e3ec8eacdd01bff84b9b6f0aa98966fb97ba52dc5aa5e7479e7c6c94
- MD5 ba369c7ba6e18f6cbec449d716208acc
- SHA1 9485de0dd8ca6a4373fdf54258771465e0784691
- SHA512 25f45d61333a36385de24fda37e05a815a45a8ac003654110e087021bf4e0fb269232a7ce903c57c7842ab52d8475a2833c1cbd174f5c1058d0bb84fe401f37e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgpu:A3mnXoZjzyaEFo3+aWiauoOas0NI1gpu
- TLSH T15F05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 834KB
- SHA256 7b2bb9b01db221f4de12e9da401897e40bf622dc9c6459424fdea32ad6f29d04
- MD5 6d1f6ea797c10d7cc6d6aa68f28929d3
- SHA1 225e6330c6414030d92abb4835c697d3e80ceebb
- SHA512 201e4036b5626d20197ac93682f05aa39892d181b5357eee0fa74d8850c65a62d2c11ed75a488d21176e7ce3b96395463193d5fb13e0fbce3653c93930ed22b8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sghb:A3mnXoZjzyaEFo3+aWiauoOas0NI1ghb
- TLSH T1F605AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 834KB
- SHA256 7eec36d54a1ddd15db17dc4a3514ec42c7d38a50c960b55a61b5d4ec3591c74a
- MD5 2b26e9672587d298476616d6fd65b705
- SHA1 b7396f88eac46ef5eb34f4156bb93880da45e4ff
- SHA512 bd1395adad79ee932b0eaa0d88b8ccff3adeb3aaa5c7e3214298358d0380e43f34308113a3587f5981e90ee0afc8d0c7f1c1185943e9092e776f4af33cc6a6bb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgpf:A3mnXoZjzyaEFo3+aWiauoOas0NI1gpf
- TLSH T13A05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 834KB
- SHA256 6ede956ce5b30ce0a341b4bea7199cba1406ffedc1a68629ef1cb545b481b247
- MD5 c065b0f1978b868924eda54477e97c38
- SHA1 5c0fd72adab0addfe4ea2316e73e0e98b21b2eda
- SHA512 712c74960b7ee076708caf35d359ec93d902627f2334ee5fd60d3fa565a0377202c4a0679925308b7c0280cd4d4805865cc4ab5e5acac44b384103e132a6d245
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgSK:A3mnXoZjzyaEFo3+aWiauoOas0NI1gSK
- TLSH T13805AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 834KB
- SHA256 d124e39fce2b452e01c7e809c5a874269068b38ae085183e73cfc9c5f95e1aae
- MD5 8aa6abac54558187e2a7fb35e9bcfc32
- SHA1 783dc3c8eb5bdbef0d2734cdf5d054116a5e11c9
- SHA512 f9a74807e6262cab422570006e55c772dc6984e3dec8243a51ff236c07a0986f583db405aaa3dd77b571317dddb6fd191d6d54248ff7bce9c3257c1a0938d1cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg3k:A3mnXoZjzyaEFo3+aWiauoOas0NI1g3k
- TLSH T18705AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 834KB
- SHA256 3309519d8a29140ceef9327ac81a85e944aff62b9c8efa6912e437564ce3533e
- MD5 c01a0823b7debd271c5ff52c8e38da5e
- SHA1 02b7ef105e1dbc959b4b12306d1de92a4c609473
- SHA512 8a2369b6a2e606b27ee151e59611e4649329db80fc429c276c7c62a7e1b503e3752df7ca0847439856cf5841b75cf0ddfb83aa35d2ae242267a1c6df0f83878a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgA0:A3mnXoZjzyaEFo3+aWiauoOas0NI1gA0
- TLSH T17C05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 834KB
- SHA256 6a343ab81f88c3b42d882c39e89c875330d842bedca49176c81f5fb3e620845e
- MD5 84ea068ad15c9a4e4cf37cb44d568c8f
- SHA1 6aaea9835fae62ec28d4447c6384eef8c500224a
- SHA512 aaeec6e2e5678c5d1a9976bcd933debba45456195660e9887730fe7fe0593b920d7146bcc0fa153edb37617866caebae196dbcfc071fec824ec2e6bd39986e3c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sgb70:A3mnXoZjzyaEFo3+aWiauoOas0NI1gbg
- TLSH T1CD05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 834KB
- SHA256 64a022444e3410bb343147012cb130733d75214bded7aa9fc6e9482c152682ea
- MD5 5ef1b729f628e59d2de08dff95405b6b
- SHA1 25769be2fe00dda7899cee5758a3c3f327ea8c64
- SHA512 b89b3e218abfdca1202db89c82eb5976c7d22352f71e9e88caaa179ba100904f9d4c3807979d3007db0277074c360d0b7e06be617b18d7760cc5eb7a214b5663
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgWr:A3mnXoZjzyaEFo3+aWiauoOas0NI1gWr
- TLSH T1C605AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 834KB
- SHA256 f83786fd7606f95181094af961c3ef84fc2b751d92c2c814fa6342afc7ccd2ae
- MD5 a26e33b2dd77e8f8b4562820fedfc457
- SHA1 b24cb71b78f9217b7e06ae455ad5c818c5b264b5
- SHA512 66eb363787fdd6845ed8d19f4466a2c9da3807bdbeba4cebe708179de8a836f311de82a5604328558a4b6c340ad9e985d13781e50769e3caf4cf9722fbd13681
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg8n:A3mnXoZjzyaEFo3+aWiauoOas0NI1g8n
- TLSH T18305AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 834KB
- SHA256 57e2cc945fa16ff3d229b37adb1bbfde2cc581a65dfb53d38f74c477075ebecc
- MD5 5f99f53ab068e6ffb95f6983231b2e01
- SHA1 754d676ad0572b7206c7c99a29baa8564bc55837
- SHA512 3045eb8dc888a53b0480a2da0e12b43f92d312d8b6a7ea47e4c2a71e7a343407be26dd7385dc16ee4e90588b122ab0b1c8c1c53e18ce28bd2d9314d60226f130
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg6x:A3mnXoZjzyaEFo3+aWiauoOas0NI1g6x
- TLSH T16A05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 834KB
- SHA256 c177f3fff449b70108de16521d7be0ec45ea613b6b0f9d9b30dd1a97406255f1
- MD5 ae88b5d068e1e4009591cb52d37bb232
- SHA1 c830bdcdc68027b01b59684a5149e477e23a9245
- SHA512 7914287b05be817995183152f4f364d677ef49e9434d85b6a57b6a3894c657177bca0a31990526a07eac131b83e8b534fe588af0a08446f850bc07ca7853ff42
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg8A:A3mnXoZjzyaEFo3+aWiauoOas0NI1g8A
- TLSH T17805AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 834KB
- SHA256 c6d15814077910a26d5a24ea1d8034703748295f40e38d32af5742984cc2b351
- MD5 6b9d65769602194056398ab990074ab9
- SHA1 4a997f5e92e4e3f42fc7c34af796591c45374ffd
- SHA512 2d6a6fba97a541150f14154b8724f930f60a1060e41aa90dc2525009fe636d7ba5d4c0efb72f4f3140430b8ec1ccbd26199d0012214bb125ee1f8c3080c63572
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas0NI1gl9Q:A3kMoI1x
- TLSH T18505AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 834KB
- SHA256 2c0b61f33975a22d431af52b9094235e8789343c4143a1f8b2562e4d3beee6cf
- MD5 83e6bf5815c8083f791b3e827b233458
- SHA1 722238ada1e7d45810a1bf14951c484149b51a24
- SHA512 89c067c30f8a04d5ea9575d43b94cd3e37e24038359343c962e58c23302017f91b999bc20b29757a66d66644bce21eed3076214a8b2f5b44920e4a050cca6f15
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgQ4:A3mnXoZjzyaEFo3+aWiauoOas0NI1gQ4
- TLSH T17705AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 834KB
- SHA256 4a0df46c427e5111eb8e1e466bba11013cef48169d2a0e221ed5952a12b4044e
- MD5 ebd551bbe4ca678ca708c3381dbdda58
- SHA1 6d061d8e4e97bfb63fbc2bb1aa8fd6008ae3c8e7
- SHA512 b6636b76a001e035815ae2e6bbee4818ba1a0770209bde9bede0b24792f53944f126dc04109ab3d2ddaaec42c6d244ac6c511d142957dda9c333f2c1c8573d31
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgTu:A3mnXoZjzyaEFo3+aWiauoOas0NI1gTu
- TLSH T1AC05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 834KB
- SHA256 e7c64d474b4fb17aaa0f8419e427429f26b7fd58a2530294f5edbe6390c730ac
- MD5 5b2da823a115f73cbd13de3a4766fb4a
- SHA1 ab990a704beef7deb1e5d30dac86020589bddb11
- SHA512 395ae11c9dae08e36755704b709c19b30d33ee0b37ee306d6be993f1367ad68fbec98aa1f442f6f556d81a949bdffc8cb31cab7fb6bce849c76d7eb58c035cd0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgOj:A3mnXoZjzyaEFo3+aWiauoOas0NI1gOj
- TLSH T12105AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 834KB
- SHA256 85691bc9fe2a33558c02d1a16a9b227b8c7a313446e9d2327e21b33052c7dcab
- MD5 a96005be164b61ae83e6a09cb2f7bb88
- SHA1 28d7a354f87cd3cd99833309c60e3aab4b0a30b6
- SHA512 9f96f8e213dafc8a6f9ce8718ab776cb9c6f1c3539d496b8965685bda6d839852d3f4c4f52f3a4a01dd1783d6543ee8c1c4a49cae6cfd314f2b30f592eae8e85
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg7g:A3mnXoZjzyaEFo3+aWiauoOas0NI1g7g
- TLSH T18305AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 834KB
- SHA256 d7f9e897c0ce16abedef2b6021ceee3ff9043af1c838528912458d021b8b19b2
- MD5 f6be58730fa5f2fab1b5220d1bf90a0a
- SHA1 0765344c54f64891ff5f4395962969d687e6be44
- SHA512 775f80adfb078b598af10df9b246750ed76b965c91f911960a9360be8fbc05fff32f7a894e744c25fc737a6e62ab7b3ee1fcc5d172b95ccbbe7aab4fd946f1c2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgmI:A3mnXoZjzyaEFo3+aWiauoOas0NI1gmI
- TLSH T10205AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 834KB
- SHA256 7598a5f36f822793e05f8778fce445b12623389b6619fc147fcda08b11ef5f0b
- MD5 08c11ff55368cc909d80abae5dd1c6cc
- SHA1 dba5bd96ea676dbc3471fe01e9e5978c2bff9614
- SHA512 ee6b61c1294e37f267f017b1bdbe34c78611fdca30ad34c04882c67efa06255c2a627eb943e896dece6e8024317642dbebe7f97912d74890ff5c92be3794067c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgUo:A3mnXoZjzyaEFo3+aWiauoOas0NI1gUo
- TLSH T16C05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 834KB
- SHA256 cb050e0f0a1ab8e4984487045a2c810b821032fb9a3695d21384895c95ce6b18
- MD5 d6af4b2b82e812426977ff9c3b1c9472
- SHA1 86546c803446b2d46343b0dbaba4f771fa4e263e
- SHA512 873a4e6c7ce914d9e012517fc61ec51a9442b48e1770555829ef31f8f8ee9ee7893d847c376b9d67c11767147a2637bbe31f95f39843e37c6e17f516473d55cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg3+:A3mnXoZjzyaEFo3+aWiauoOas0NI1g3+
- TLSH T11605AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 834KB
- SHA256 9af1bd0fae171248914e4d8b647e2d72b347ee8a3ef97c3dc0d4d3bb5dfd38bb
- MD5 9a476ced6574c30c150b30b10284225c
- SHA1 7edb1026003ec0e59911729e4f905b043fe36c5a
- SHA512 80b98724540e06ffcbc6631c2a373a439842ff08caf74db0e3ccf5ce558e13430df221337e4c9fdc098a930dbd9db0a74e3149022abbab2a43ad8e9cabc9f06c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgNQ:A3mnXoZjzyaEFo3+aWiauoOas0NI1gNQ
- TLSH T16D05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 834KB
- SHA256 3e90811018d5e23c3e2ea7cacd5239d24ca831ac06782bea3303842f573f418f
- MD5 b3e8bcdec838b96a4dd3d560d753b279
- SHA1 3990c47337f19383c97930898069f9c4cf9cc967
- SHA512 4c4ad7bfec80d3b78cee86a00b366279d8deaf15c6741266e3787e5c4fcc852d6a605e7792957f5c8cb326aab55568c23fed6d92039dcfa49c8981fb31c70042
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgCX:A3mnXoZjzyaEFo3+aWiauoOas0NI1gCX
- TLSH T17405AE139BD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0FF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 834KB
- SHA256 fa8004c286c9908cf5d84730a8018b5a61aedc73253155e1223331cbc2291ce9
- MD5 e261278c4ee8a9912c7d799e1faf37d4
- SHA1 d6efd1610206aa360d05f0a06a56b86b88abd27a
- SHA512 67cc5742cb249f9f19c52aeb6b3f4c0c48be8100865f2744a7ef124752911ca2ef9dc62da74b4e7a418644f40d5ce9f15c8198ac3d7433bef8e800fe71eb0bd4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgkL:A3mnXoZjzyaEFo3+aWiauoOas0NI1gkL
- TLSH T15A05AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 834KB
- SHA256 2c6aea4fe0f1818b3788693ef7795000ac5c5ae44ff078d4bfa66a78d53a4fb3
- MD5 269fb614ccd3eb53e9dea77ae25799da
- SHA1 8b5adbf2ee71393e1c88b50f8c1df04f1bc39327
- SHA512 0d0a7405d85806b800938f2adacf162485c8f73f42967e3fd4027fcfe7283920f950f42c4a07d18de44eba850c05fed6090a0d4d681d5a3177ef05f6d7575b79
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgAFC:A3mnXoZjzyaEFo3+aWiauoOas0NI1gAM
- TLSH T11905AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 834KB
- SHA256 177c19300017471a371bf2ffa26e453d28d73a08f6054feacfc4c35abbac78ff
- MD5 c802e0b7436d779229a6251fbbaa3632
- SHA1 69f2a87326577d436f4f5b2b1ed4a5350d592c87
- SHA512 dee1dc9593bcc288a5a4b704ad31bc2a7d14b911f97827f2f3fa476b262c72bb027746197165a719eedf960edbf6a4f7fd02645a8ffe82c3f6067761ea149bff
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sghh:A3mnXoZjzyaEFo3+aWiauoOas0NI1ghh
- TLSH T12305AE13DBD010F5E25741309AE55663EB757D221BA0CACF636882252F327C0BF7A7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 865KB
- SHA256 f43276acbb86af1d9abaa620e127eb66d60056a8bbf64b5c841b07162b9cdf74
- MD5 a48e655f33523572f8c2b8ef17237602
- SHA1 b186068639fbe2d6373bd3eafab1f36447179fab
- SHA512 0bd8eaf2d86de2444f54bc005b82e46ef305c7d81268402e74a571016f12c8cfb648021c7ba41c272816add30e094efeb84bf2320e4420ebd3429be4a57b82c7
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas0NI1gB2+:A3kMoI1D+
- TLSH T1DC15AE039BD010F5E25641309AE59673EB797D221B60DACF636882252F327C1FF3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 871KB
- SHA256 9bf2d5814a33e0a79e06e3c80bb5d2fb38c8ea68833367fbffc5607d314d608d
- MD5 c5799b2134efb5f4cf1f51be927347f5
- SHA1 e58fba10d2c72f292c19da30cbbf33e78ab82686
- SHA512 60e08a84f15db14d8b28ad23ef63d58a1c5f443c25f55955da8c0d71a0553557ce326c3cb672ba235b22868812ecaad6bf1370a090caad36dd5456daecbf62b7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6Sg16:A3mnXoZjzyaEFo3+aWiauoOas0NI1gE
- TLSH T1D5158D13DA9414A5E206513096AD5622EB35FC2E1B9086CF277C8F252F31BF0BB3D769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 889KB
- SHA256 81b24594e43c2c826d5d45ce13bdcee460d09c001ffd6154274c8bf79d10df58
- MD5 3785ced88fe4ef5d20a7f091efc4f560
- SHA1 2f2c46035a83fc8abdb752a66d97a8f3c2ca2714
- SHA512 f4b7f29502e45ffe2a84f7cff5f4a4f031b1fbc41a55f8897ebd138a8720ba8144f58b08619059e7c6a2837367ef479680b92775d815fe9361c5709924b4b1d3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00A6bi9I6SgLF:A3mnXoZjzyaEFo3+aWiauoOas0NI1gLF
- TLSH T195159E03D6D010A5E7874130DDA99662FB39BD620B50DAEF2368B7252F327C0BB39765
- MD5 SHA1 SHA512 SSDEEP TLSH