Analysis
- max time kernel
82s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 13:38
Behavioral task
behavioral1
Sample
2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 856KB
- Sample260819-qxp71sfd44
- SHA256 aa5258978a3253009a0948644f2639377f6bdbfc1459a491015546622fef83e6
- MD5 42c6ef763fb580f8efc8e306c68bca84
- SHA1 eb29ddf7ac95d6df8a3293b957035fa3db1ea26d
- SHA512 bd016a6a9e66b22826ab71bce8ec18a6d0164d60a9ae773c40f1495a7d8a56078ff42126e10c6dedfad189cd3b75a787fe73d694327dd71e28e1d3e22e88a802
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAu:A3mnXoZjzyUTWaLl3z0zDMCpxBAu
- TLSH T17415AE17E79014F8D827C239C9A64A22E7B1BC660770C6DF136456262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral1/memory/4444-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024341-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4468-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4444-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4468-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bbc-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002161f-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023445-153.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021277-248.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-267.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-400.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023445-479.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127c-504.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-595.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127d-614.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-633.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-724.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021280-743.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-769.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021285-794.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-808.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021284-851.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-876.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021288-889.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-902.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128a-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128b-922.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-941.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128d-960.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-985.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128e-1017.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021292-1060.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021291-1092.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1105.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021294-1142.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1161.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021297-1193.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1206.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021299-1255.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129c-1334.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1347.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-1367.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024359-1618.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00130000000006cf-2109.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024341-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bbc-42.dat aspack_v212_v242 behavioral1/files/0x000200000002161f-61.dat aspack_v212_v242 behavioral1/files/0x0003000000023445-153.dat aspack_v212_v242 behavioral1/files/0x0002000000021277-248.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-267.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-400.dat aspack_v212_v242 behavioral1/files/0x0004000000023445-479.dat aspack_v212_v242 behavioral1/files/0x000300000002127c-504.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-595.dat aspack_v212_v242 behavioral1/files/0x000300000002127d-614.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-633.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-724.dat aspack_v212_v242 behavioral1/files/0x0003000000021280-743.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-769.dat aspack_v212_v242 behavioral1/files/0x0002000000021285-794.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-808.dat aspack_v212_v242 behavioral1/files/0x0003000000021284-851.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-876.dat aspack_v212_v242 behavioral1/files/0x0002000000021288-889.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-902.dat aspack_v212_v242 behavioral1/files/0x000200000002128a-909.dat aspack_v212_v242 behavioral1/files/0x000200000002128b-922.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-941.dat aspack_v212_v242 behavioral1/files/0x000200000002128d-960.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-985.dat aspack_v212_v242 behavioral1/files/0x000300000002128e-1017.dat aspack_v212_v242 behavioral1/files/0x0002000000021292-1060.dat aspack_v212_v242 behavioral1/files/0x0003000000021291-1092.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1105.dat aspack_v212_v242 behavioral1/files/0x0002000000021294-1142.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1161.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1186.dat aspack_v212_v242 behavioral1/files/0x0002000000021297-1193.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1206.dat aspack_v212_v242 behavioral1/files/0x0002000000021299-1255.dat aspack_v212_v242 behavioral1/files/0x000200000002129c-1334.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1347.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-1367.dat aspack_v212_v242 behavioral1/files/0x0007000000024359-1618.dat aspack_v212_v242 behavioral1/files/0x00130000000006cf-2109.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4468 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$$ 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe$ 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4444 2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4468 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_42c6ef763fb580f8efc8e306c68bca84_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4444
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 856KB
- SHA256 aa5258978a3253009a0948644f2639377f6bdbfc1459a491015546622fef83e6
- MD5 42c6ef763fb580f8efc8e306c68bca84
- SHA1 eb29ddf7ac95d6df8a3293b957035fa3db1ea26d
- SHA512 bd016a6a9e66b22826ab71bce8ec18a6d0164d60a9ae773c40f1495a7d8a56078ff42126e10c6dedfad189cd3b75a787fe73d694327dd71e28e1d3e22e88a802
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAu:A3mnXoZjzyUTWaLl3z0zDMCpxBAu
- TLSH T17415AE17E79014F8D827C239C9A64A22E7B1BC660770C6DF136456262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 971KB
- SHA256 c9988a280ea16dc0f4714b87a4593e6cccc151f5842099908458a734474d90f3
- MD5 7fd973725be54e1da0e832b44545618b
- SHA1 077e866f0080dd8f94d96c1963f64cc766747283
- SHA512 1a4f0f02caa30108137d6b99988cd0fb9c9201ee49dfab665536f802e1666815c3e1ed9561c3842462068a2c4819ad17b1faa7bd273f53734a8a93944eae8d00
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEACnRpAr4svndNIaUE:A3mnXoZjzyUTWaLl3z0zDMCpxBACTjE
- TLSH T12325AE17A7A014F8D427C238C9A54A12E7B2BC660770DBDF136456262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 0dd95a9214a2f5a979645f9af3a250e744307c0b649f8e8f0ecb4edb0f0aa050
- MD5 61edf2ca97a4b2b6ece7e88266477a20
- SHA1 42ce5111c53c660823e9e77bb81ee8535b2de5c3
- SHA512 73917e0ddcd7754438905512c83b835a41e394efc72a14c5caecea74302991f3d74fe6af1a3158ade00f213e30232fbc18257a646ae434ea3ad3c253117b1e2c
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxBAe0Le5ji0hmxNrM:A3kMhT1Llj6Pji0Aj
- TLSH T186658D16F6A446B5D073C179C9D29A5AEB7238460B30CACF039497292F337E19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 871KB
- SHA256 f05367ccdae84391eb1d095680c40d4bfb6400834d069c1a6e55adabd8e4aa3e
- MD5 e5ccc8231401597589a9674ffce1c111
- SHA1 869b6c38da7f34743b0a1d645032df18a6c760e8
- SHA512 fd73e8c6a635f59f09e3741781db79e19bae9f305474bacf26bccaefb3e48cd7b9b1bb33f879a04bf82a3ed8e2db2e118faa2b35e1291af79666d922c7cf8803
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAYa:A3mnXoZjzyUTWaLl3z0zDMCpxBAYa
- TLSH T11A15AE17E79014F8D867C138C9A64A22E7B2BC660770C6DF136456262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 904KB
- SHA256 dd370cb58fdeecdb939b3f84a703f49fbb8002cdeaa34523fc851d3d0d0626ca
- MD5 d7c8136967dc87ff838bf3e06b045100
- SHA1 721b132f173caae960a9029bdf835b94887d5222
- SHA512 18b87a7140d7b2f85571120f2c0c441955b3179f103d22ae6d0006baa6b1e812dbe8c42cdf476f4dab7d728ee1a680fad3a8fa605398dc9b9a49b13282b6e103
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEATb:A3mnXoZjzyUTWaLl3z0zDMCpxBATb
- TLSH T19D15AE13F79004F9D8678238C9A54A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
- Size 1000KB
- SHA256 61164ae6eabbb1a308d5e0e7db50e5ecd9847efafe0cc571e1e671f928a60778
- MD5 464ee70d7365739085f66d8bad2ae383
- SHA1 7f47705331e1c008a2868e87967d16843831ffe0
- SHA512 537f8f6abcfec92b93b011edb6124d3c544a9e597fa430b5c4dd12a89854d40947e1ca135d07e45b1ffe7e37c0e06f42cb90f38ab4d67cd1926e774783b0c49e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAEXsf3z:A3mnXoZjzyUTWaLl3z0zDMCpxBAHD
- TLSH T121253816E29004E8D45E8139CB954A12F7737C6607E086DF13E4E63E1F336906EEAB67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 880KB
- SHA256 2a81f40ebb18ac47be7096943b84c72b7664dd9ebeecc8ef1d73cc17ff342707
- MD5 67afe8ad806a0af085b3cb464f003507
- SHA1 44ce02966364d226584b98bf8de063c0c879a3d1
- SHA512 d305cd0766bc190409e2d2642b0c4f39667d5e7310b3ee1d7bd4cd63d40c6cd6e97e6ab023ee0fff3ecb96ac06392025f99de59ec5e13d3883be6e8726e23f5d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAx6:A3mnXoZjzyUTWaLl3z0zDMCpxBAx6
- TLSH T18215AE17E79014F8D817C238C9A64A22E7B1BC660770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 880KB
- SHA256 4b89b399af6553ba03b4240a73993bd8e44531eabb3c5ed396bd0f1464f65139
- MD5 1f50ed4f4b98e9ab15ac01e539ca4cd0
- SHA1 c7ae4ac7c9c434856320a2dd0405505429c92ac0
- SHA512 6999df307728ff895bf032a3ba0888906065aa869db8122bfc81d57ce8378b89b518e03d4028960650d9b2e9911560742bbf03bad8492b7ffab13140c82eafda
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAXo:A3mnXoZjzyUTWaLl3z0zDMCpxBAXo
- TLSH T12115AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 880KB
- SHA256 e132768a6c53b941519f996358f9c41ea635836af78a2b4b3f382d4fa90ada09
- MD5 69bfed9d5848c94e02b9060efb34f3a6
- SHA1 568d88dc4b7b889465976b863ba146cabe00c59a
- SHA512 dadb47876d987a2c733e192683dce44715cfd93bcf832c05a4961ce1f8c0d1b1141d78e4c7b442a6e903c7ab670090a0e6100480b57975537bbcff74d2d78a6f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAbu:A3mnXoZjzyUTWaLl3z0zDMCpxBAbu
- TLSH T13715AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 880KB
- SHA256 df90addaab78a5d38dd2324a4b19b2d28dfba0f6634df4f58f8609c79b98a83e
- MD5 36d61bbd8c7e23cb12197caf7d3397a5
- SHA1 681f4ffe976b3abb73e5b560ef702f5ef431bf31
- SHA512 f913b5e3784fa15cd01742e42fab9314d020989fe06c99604fb20ca9d2ea30f1bacadf8316dec5d8924e36a15922d2a57bbc72dee12d190a90cf869d20a4dab8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAJ9:A3mnXoZjzyUTWaLl3z0zDMCpxBAJ9
- TLSH T11C15AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 880KB
- SHA256 0fe1d97f1890cbc8c70be1fdae4349f9c38c270b3919a13d093e78a12d948735
- MD5 9a319b6338c7afb5649415f3cc3006f2
- SHA1 97c8b2ff58745cad52aa6452c9ab69562a58b631
- SHA512 0cb8bf59ee343300b56673f8330af1570706415cbfc782005d4ada110f24b052722e68a9daf081645d29bad6191b7c3499232755922bc942db60e8ae6343dda3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAlc:A3mnXoZjzyUTWaLl3z0zDMCpxBAlc
- TLSH T1AB15AE17E79014F9D817C238C9A64A22E7B1BC660770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 880KB
- SHA256 ba3a17c7646740ecd51bc9782099b466c93b9668fbf6433e9dfc028e2a0362ff
- MD5 73e2d27c56783bdcfd90842a57a63fcb
- SHA1 f41ee59a0dc9ab00d90d2c6dd37d9cb7ef5e5fc0
- SHA512 8ddf8cad36633ccb5d8af70d2c2abaa95a968b2579da95c1098f06ba1962d0138f07743418a2076f8ecf47c98ba8ac4014289344c1e2540ec8bb06159317ce79
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAep:A3mnXoZjzyUTWaLl3z0zDMCpxBAep
- TLSH T13715AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 880KB
- SHA256 9254be80321b3e109a8bab944488644171ca8e900115b906c20cdebfab1b716e
- MD5 4897fdcf47eaaf97224fe68efa7270b9
- SHA1 90c32b3990fa8d11647a13b066d54f0f2af4f8f5
- SHA512 6f180730ead0a5bc453edb30c36c229ac1873dae9651375e570fdb6c8697b49fa33cdf5febb2d69796dd7f06851f801b68a909a4763e492baf436b40e6083490
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAR0a:A3mnXoZjzyUTWaLl3z0zDMCpxBARN
- TLSH T15515AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 880KB
- SHA256 32fb401d353d0f79ae2757d0103d13b16476346003ef7d015c43c9934fae1bee
- MD5 7c7b770f640a490b2e32eb9fb8bb608b
- SHA1 ddea9e12f01f8c824212fb15f9b36d90b992ba17
- SHA512 57475004968f469e0c6c484ba0ea6b570dd456179cce259dd74b87132e8e641517fe8327ee55d654356d3df60f134c1c08a521e47011759a46fb91dddde5ea07
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAzF:A3mnXoZjzyUTWaLl3z0zDMCpxBAzF
- TLSH T1E015AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 880KB
- SHA256 8a01b54e9f86e19d9b34972a91dc2465f1241feef5d0ec9d978a22e2ce52637e
- MD5 12834a64162c3bae5789a4dc93f3f034
- SHA1 7aef661615fa3c3d2023df7e5928ccd911f7b99d
- SHA512 ad79bf610d5945bc852ec97e689188ebac2fc909a11f2faf9dd96ad8273704adc8c182c3e545e9e11eafdcea119bd32c5c75f784692463c5e9c3b230a9edde85
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAcC:A3mnXoZjzyUTWaLl3z0zDMCpxBAcC
- TLSH T16615AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 880KB
- SHA256 995cc28505836b748d5ef948626ed79234e2f7645c84dc9bd088d20507864f50
- MD5 deb1c1940ec3c7b1fbc67d34c75a2313
- SHA1 894aa317c748737a8655677c4c9b4c542960cb9d
- SHA512 5e786e0811c9b4b1788454bd01b3b42029c4225b0c7346ed0e41524869c4c33f527fa9a0e74204c7a2b9e3b665fa56f640a89acdf906ce840e7126cf0b440ef2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEA3w:A3mnXoZjzyUTWaLl3z0zDMCpxBA3w
- TLSH T16E15AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 880KB
- SHA256 bbfb083528838ab3f99af4baaa375a6d19ae576f42a121c6ddc4047d280bcd5c
- MD5 a65fad1f4b687ea69b954c9f4a53d542
- SHA1 253ff2339c024f87e1038411764c59d2c2acbdf2
- SHA512 d5fb9f12183cb171ecbd9a8c234aee59fe2e7c2bcaffeb1ea928d5096cd3a3d3d23faefa2c3cce915fb0bc372c96b14291e12a656896c4f325fe149c3f2d2249
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAmT:A3mnXoZjzyUTWaLl3z0zDMCpxBAmT
- TLSH T1C815AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 880KB
- SHA256 788323b48a7ab45e09c16eebe2bf5ee3eb7b72cfab7af3894e1eca7b6b1dce08
- MD5 3363115f784d2003e55c8d282ef65181
- SHA1 d2427fc2bdb8cb47a4dde04e1d31075b7f755808
- SHA512 9fc57fb6b12397604d5f1b1532c4e2d30d95f8fe522488eb735f5a0505c31639efee9ae5e2f5016908a45841eade918432adfc26e49227d8aacdf8ff380f3653
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAeu:A3mnXoZjzyUTWaLl3z0zDMCpxBAeu
- TLSH T1F715AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 880KB
- SHA256 df2aecee9f71730fff0edf4968f81d683a7e8bf4437e2c3bff7fad04ec2b0d7b
- MD5 b9287236459ca0d8464ffeb2fa8e7a08
- SHA1 cd6da638a2c4f9c055d549d2f829c46fac8cf92e
- SHA512 6e0d3240bdd970aefc407c01ce49a1c9abc50ab14e06d24f9618161278b9c6ba46510f6bb8286e80c09db09cd804d2960e1a862e6ff815d7323792948ffa6221
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAYb:A3mnXoZjzyUTWaLl3z0zDMCpxBAYb
- TLSH T15315AE17E79014F9D817C238C9A64A22E7B1BC660770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 880KB
- SHA256 ef8c42d0547251260e68935c1a11e7e7fc8d364b121a1a0e6eb1b6896df841d6
- MD5 1fa98462ec91efe98cc25fca2f04f656
- SHA1 e414423cb33d8a400f0b48de4020a471d7e57412
- SHA512 16ec3a706a7639f29ddd674d36791853087e70099aa1207f089bbe6e17d205df5a6681e3fadf083cd234917d92110bbad5fd56ef5d17954ff5a099e0c594db32
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAGf:A3mnXoZjzyUTWaLl3z0zDMCpxBAGf
- TLSH T1C515AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 880KB
- SHA256 d4cdc2fab29049fd74006f6f0cbe5889274d94dd555e0194ead76bced5f51e52
- MD5 3c4eeeacde656eebbff0959bef2dc127
- SHA1 0f213adf641ac21b2beefc1fbc62eab7e51fa7ff
- SHA512 699af5b85962ed685b499e9c6d6f7267e85f8eab8648d11a956945747440c5525d67486ccf4b47fcd7f70781e5d16bc05d3e867e29356f58ddd1b5ffb0a86140
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEADK:A3mnXoZjzyUTWaLl3z0zDMCpxBADK
- TLSH T11A15AE17E79014F8D827C138C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 880KB
- SHA256 aa40cb369c9a42e491ca594158011c565341f8ca6d0adeebdf3e5ba0c7373414
- MD5 8d3ea90e1d67dd7c538c8f311be0571f
- SHA1 ef9ef1fec8be84c61fb9b8772741247eecf7f685
- SHA512 9f4f8d497483b5dc250694875b4d361253867e4824955a725641a9a2954079e6dec22463496752ca6fde2ddb98387f367a718364e46979d3697525f441e36136
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAkk:A3mnXoZjzyUTWaLl3z0zDMCpxBAkk
- TLSH T14515AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 880KB
- SHA256 c286201c85a848bc97d9942f4a71d6d7413472b41fc8b1f9734ab7ad610e95d6
- MD5 80ddbc112f1553d549ffd31feef91d4e
- SHA1 e9d66e29544a6c1b49daf98d0b80e6e1e1fec609
- SHA512 d1264d145f03e5e20ebeaf01bbb277bee9ca52065eaffcb2624e49ac9f1966c3e6da61a3df19bdce8d12c0089baf03e32d914fdc6069e15ebadd55fb899def99
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAt0:A3mnXoZjzyUTWaLl3z0zDMCpxBAt0
- TLSH T1BD15AE17E79014F9D817C238C9A64A22E7B1BC660770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 880KB
- SHA256 b279491e6fe980efe3352491cd7bfac412c5269fcefc7975a678ae9d4b7862f8
- MD5 65e8508a388eb193d42a8862947da5dd
- SHA1 45ad049b200aee1f7cdb088bf00d558294a60839
- SHA512 3a690f8f64bf125dbd5e4e5e971ac072c20300ef6169507a0172987c9e66909af49a91f72fd971ae9225c54eb7db3f7b5b06159169cd0704238afaf694d99005
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAw70:A3mnXoZjzyUTWaLl3z0zDMCpxBAwg
- TLSH T18615AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 880KB
- SHA256 82291e082e98fce663b3912e3cfd380ba6d15e5e135656f4aae6419f4083b3e2
- MD5 27c177dd7728dfcabb5d501c4a474347
- SHA1 863d7a1da0d8899b3f74d90bde54cbdd218ce6fe
- SHA512 230c1b0415b3f463627c95637ba9933bf6ec4445b86d16715538e86562582bf7aa6676d80f75539c4228437d8260f4242d60564745ed3bc3bf87b7cf631a0bdc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAFr:A3mnXoZjzyUTWaLl3z0zDMCpxBAFr
- TLSH T16B15AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 880KB
- SHA256 2f881cfec9cc7bc5d830a7d0030517c997b842ea48203cb142d7f6f6772927fb
- MD5 e25cd473460a08828bbb92559b6b3d9b
- SHA1 552f8949f4cb4e63598dfc6a068f24ec3da9f65e
- SHA512 e1414191a8210ae01a1f7f7f5ea476556f37438adcf49bb50d422a96fa6e7556a859ba8ec1e5636165284fa12f13b07b6890d8e744bab28c891e76ad54d774d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAPn:A3mnXoZjzyUTWaLl3z0zDMCpxBAPn
- TLSH T1DC15AE13E79014F9D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 880KB
- SHA256 4d4428562d308c884c9e146c31be09656dba16a46721e057869b6ec58190efa1
- MD5 aac9d1ec6356859357bf756353565b80
- SHA1 35d00dd0c74114e53ff9d7fe37504efec4393d36
- SHA512 12198ae862dbe753e3a131c5a471f4074a517c1d75d7f1b24f1626707154f121c8441c40e57f09e6d46d1797369315eb5589f976e2a6b1a7e5cdde862827017e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEA7x:A3mnXoZjzyUTWaLl3z0zDMCpxBA7x
- TLSH T17615AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 880KB
- SHA256 c0135c5365c83a7f1ae0df47ca354c54f566e298be33b675b696b62ea17ba332
- MD5 c6da3fc56e5adcbee59b009bf3076272
- SHA1 769ef1e91fdf9b3ad9d8957895f7bd90441739c0
- SHA512 e8eb966761fda8c57c05e6e983aba218871986e993f45d3e771872512174115e252f8a85f256dedce6b93a26eb73b817ab659ca00eb80b07766d877138a6a254
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEApA:A3mnXoZjzyUTWaLl3z0zDMCpxBApA
- TLSH T13115AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 880KB
- SHA256 46bd48cde717ac4c7cd5b8f210761c57d844fbc99f4b46f5d86774c7f23fdf49
- MD5 c92a9ce34da51cc970df2fbc59290004
- SHA1 d70742ba90c8bfe99fda14e5bac2fa735cbf11a1
- SHA512 f6185252af05269826077dd3665c3213a629f11ebe7e830f52d833252ffd69fdfd62df4d14e9daca52cab4375f410903a88a2c99c322fcefed5ff3a4da23cdfe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAi9Q:A3mnXoZjzyUTWaLl3z0zDMCpxBAi9Q
- TLSH T12E15AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 880KB
- SHA256 cd0888e182ced29c3e36e51603936717ee299d8df6c0c4f3b6a3271d4c9f2d87
- MD5 b9006c7256546166937b1665146a0399
- SHA1 33b350275d3b994daefb9cedc4bc9505de294168
- SHA512 46c6b46bc5f042a0211b594553ab8f0e927b91294cd1b16f01d3b82a0472fcf361be8ec2e8f1b354753aeb170201c9a6d439e75a4f95ea3c4a2e6bd5f59be03a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAH4:A3mnXoZjzyUTWaLl3z0zDMCpxBAH4
- TLSH T12715AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 880KB
- SHA256 86fe391a59773db692ae16c0b7c063acfc58b23311eedd1481a7e28a2b5c326c
- MD5 0fc174cd4d0e93115084d81fe7c41916
- SHA1 fbe29d886a568c75d6d015da3868f98afaacad64
- SHA512 552ae61c080b6db4acbfe78172792d576525450b26e1e5bdefa00e4a595424a1346118645d09afbee22eeaaa92c1b394efbb7d21910075f21fb50367f645092c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAmu:A3mnXoZjzyUTWaLl3z0zDMCpxBAmu
- TLSH T12E15AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 880KB
- SHA256 65ff8991defff2e25c4b0da008d93d47643bd677da4df1e214f2221dffcc1dcc
- MD5 df44dc8dd1621a5950d8d8e8a94716ff
- SHA1 bfc6ec21a6de563d8a51691c2a55fe382be438ee
- SHA512 78ad954853ce524f3c2b5ef26d67ed46dabd213405e0b53e61018947c0866cf9fd984225bb1b2740f07140102f733cf11d5b5fb7363687fe9fcb9fb1d6acccc4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAXj:A3mnXoZjzyUTWaLl3z0zDMCpxBAXj
- TLSH T10415AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 880KB
- SHA256 a515948d61e192d40699ebfb1928ad2e61cf2d8cb01d1b7cdfef9e9fb2969723
- MD5 c5ba53df7a0f04270d84322484bc803a
- SHA1 c4dc195ece4648831035948ff6198aeae677b9a5
- SHA512 1f65a6d9909e3ad8061e8d504d0b372444d176e87cf586d0b494e3fc2373798754c2a42126d2f3dd5cfb120b72e773e344bf59f0033dd65abc4731943b74fd41
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEACg:A3mnXoZjzyUTWaLl3z0zDMCpxBACg
- TLSH T16915AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 880KB
- SHA256 0d3e7a2fac512d64679daefc1b5af0cc3a159a291f0f587b2736b16d9dce4d05
- MD5 22d59e464d7c24b9c69fc822da386898
- SHA1 967d813d58896c603216729c2cbc80f0829b9257
- SHA512 e497fb4ca821444d68b76bf99479b833620ef62b1b7e6b1589eeb4cfc19813d58d5cce106afbdb8aa5f58b3b74e0ebdfcc801b57858ac9a266d84d1f64c18a03
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEA9I:A3mnXoZjzyUTWaLl3z0zDMCpxBA9I
- TLSH T1F915AE17E79014F9D817C238C9A64A22E7B1BC660770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 880KB
- SHA256 e8adefac24f9c3f07d85c7a78f012819320ff1c2ed316e3911a0b3d5548986a4
- MD5 3b00cdfb5740edb336992a07eb4e9c05
- SHA1 ad09a3c8b9f22f0cbef8d428993d2e1e63d9dc77
- SHA512 9a4522a7336d5fe32b686a9bfe4e1b38526702ad9edea88ba04637d2f16d5ce41d328295cb2b84213e2878fe0c3b012d30f3604126f805ead6982e5fb1dee3e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAvo:A3mnXoZjzyUTWaLl3z0zDMCpxBAvo
- TLSH T12215AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 880KB
- SHA256 43f42f68d89860fd5ff2f3f4b73258f18ef09980c9805fd32fa03463e5fe095e
- MD5 44481de00ca9532c5f520b29c8058f48
- SHA1 56f64f0578f7327746cb8a14743d5be15d17d595
- SHA512 265d9324ae8c0431ec7c6d050b820b51b9450e0ef1497e4840a34f8360b77fb8ca2011e4675990eb05d91c7ab071b95c6612fc6d4a0a48141c473c384aa8f44a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEA0+:A3mnXoZjzyUTWaLl3z0zDMCpxBA0+
- TLSH T11D15AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 880KB
- SHA256 846842737cace60c17660c811fd50d3abbf394bec2b46327497e41017ecf8691
- MD5 02a622f990b1e0a462345059276042aa
- SHA1 1f0a692165d61e1672021775d025a3c15b6c3df3
- SHA512 d0341fc705acecd95a6ecf5c5edd2e13ca42b7f59c89e9ad55381345444b4df94e77295256e9a8ea49753bc6fca111f05254339d1e453db78d46e3b8fb7f1678
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEA8Q:A3mnXoZjzyUTWaLl3z0zDMCpxBA8Q
- TLSH T16215AE17E79014F9D817C238C9A64A22E7B1BC660770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 880KB
- SHA256 e2c26190244c1696544e9e75d98434edf3007feaf76d976ead883d06d3ca4af3
- MD5 e702e3a104ced65865d772bcc59634fc
- SHA1 3e9c0b5bd0679d3d65a5d0e4de69650a88e56071
- SHA512 80231d81cbfc3dcc9cda5540b1b539c2a13708a256ec0bb15e0f481e733b457b73bdeb57b839df8f879b31501a741336124119ac0676cee827c508a04d2073af
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAlX:A3mnXoZjzyUTWaLl3z0zDMCpxBAlX
- TLSH T11615AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 880KB
- SHA256 162761ac17c6ed3de08bb73e127290909538f6b710610127e765dec1b4a39563
- MD5 1556306a1bfa87544e73e67ce9582223
- SHA1 698b66add1cf1bcf3a0997e5710b1675fd1d8f9c
- SHA512 1b0f6a41bd7a9827578ca5b1a31fe5ca4cb3f2fbd6597d12713cc8a57086b93d97a1887c29cc257a51057861332cb85203f466c4f46def03d92d47d04554309a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAHL:A3mnXoZjzyUTWaLl3z0zDMCpxBAHL
- TLSH T14315AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 880KB
- SHA256 9c8d58255a0f44ac6de0f5debc6b68dbec621c374f6b634687031dcb1c0acad6
- MD5 af8c02b7d43ef5c4859b2299141fa1a7
- SHA1 8429dbb6718363d37496321859ba6af5556fcae7
- SHA512 0c3ee3869036e7304c3509390f25728dca72585d5a93cf3962279f7972010e2fcdfc26e70816fcc3389d2c42b3e21a56c639ae8537886f22729b27026eabac1b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEA9FC:A3mnXoZjzyUTWaLl3z0zDMCpxBA9M
- TLSH T1AC15AE17E79014F9D817C238C9A64A22E7B1BC660770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 880KB
- SHA256 1fe81eef63526e2e8a487ee819f544ca65d1f270256db1eb59ecc54b2572ff16
- MD5 ab8124a7028e13039a175bddd33d9fa8
- SHA1 442a274ea5b515dca1d9a45440f9a244d8652299
- SHA512 7f332580b1881b8d1c4140fa8a59dd5c7c2375d7eccbc92aebd07fc26306b304184d25cff8eec5e8f60ecce6df553d454a6679a52a3f4178a38e0bb0a0867276
- SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VEAuh:A3mnXoZjzyUTWaLl3z0zDMCpxBAuh
- TLSH T19A15AE17E79014F8D817C238C9A64A22E7B1BC661770C6DF136856262F337D06E3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.1MB
- SHA256 edcfb4897eaea25a8669d125851aaedb6a38fe45287d649a805658138bf83b89
- MD5 f863743e162e631d08e456e59c87ea8f
- SHA1 db41459c594eaa27d18b6ac80f32adb2e4aa20b6
- SHA512 eb16816ee1c11dec43a243f0fed40470a316dc86571c24d5221194ed0d9633322f2e7d1ea37408879b714d2f7b005fe9f72a4387031708ae51323481b22edfa9
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxBA8V+PAk2hMH3:A3kMhT1Lljoi2WH3
- TLSH T1D735AE23B7E404F5D42781358DA99526E771BC220B30C2DF5364662E2F737D06E3ABA6
- MD5 SHA1 SHA512 SSDEEP TLSH