Analysis
- max time kernel
124s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 19:32
Behavioral task
behavioral1
Sample
2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 934KB
- Sample260628-x9ds3sdt2n
- SHA256 79dba28fe7d5c5b945ec255cc64eac5bae1c5191660247f7280f4f8fa7fd27e8
- MD5 b979051f00526cb35cc97da134a2a33c
- SHA1 f3f38da24d484e3d9a6fceb1c61b144630b5fae6
- SHA512 7ae6965c3aa6ae465c6800b5d9c2d8d85027df3391bfbcf5860188e23f52ed9e74f779e0a0296d445166eae53f46eedc1b172efca157c93ab0addca577d7a984
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtw:A3mnXoZjzyaEzD5TvinrmkzywFqRHtw
- TLSH T19C155A07A6951FE9D01F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4528-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c585-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4528-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1576-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a5a-225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a57-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-286.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-299.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-337.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-350.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-477.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-587.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-612.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-638.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-755.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-805.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-836.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-867.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-965.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1064.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1101.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1120.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1191.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892f-1511.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000018918-1513.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c585-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-11.dat aspack_v212_v242 behavioral2/files/0x0005000000018a5a-225.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-226.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-245.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-252.dat aspack_v212_v242 behavioral2/files/0x0004000000018a57-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-286.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-299.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-318.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-337.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-350.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-477.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-587.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-612.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-638.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-755.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-805.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-836.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-867.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-912.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-946.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-965.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1014.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1057.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1064.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1101.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1120.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1151.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1177.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1191.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1198.dat aspack_v212_v242 behavioral2/files/0x000800000001892f-1511.dat aspack_v212_v242 behavioral2/files/0x000e000000018918-1513.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1576 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4528 2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 1576 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_b979051f00526cb35cc97da134a2a33c_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4528
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1576
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 934KB
- SHA256 79dba28fe7d5c5b945ec255cc64eac5bae1c5191660247f7280f4f8fa7fd27e8
- MD5 b979051f00526cb35cc97da134a2a33c
- SHA1 f3f38da24d484e3d9a6fceb1c61b144630b5fae6
- SHA512 7ae6965c3aa6ae465c6800b5d9c2d8d85027df3391bfbcf5860188e23f52ed9e74f779e0a0296d445166eae53f46eedc1b172efca157c93ab0addca577d7a984
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtw:A3mnXoZjzyaEzD5TvinrmkzywFqRHtw
- TLSH T19C155A07A6951FE9D01F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 1.0MB
- SHA256 2e24bf49f16e53145073612068379feee88a78e1dcbe6f03ebe556d49ac7c470
- MD5 c11918ec80dab948867c691d8d131138
- SHA1 a2be814eeb30211f38504ac7d810fdd1e730a725
- SHA512 e9e0fb6ef2cfdd00550e80434f39fc5dd84a113d9e77e821d35417db4d2aee20d9269c41c42ad4b0e3ec3454c8fae6df0fa193937b40bc02b685305e231397f3
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRHtMhk:A3kM456r9jW
- TLSH T1B2355A07A6951FE9D12F817489924A12E7737C225F2087DF13649E263F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$
- Size 1.3MB
- SHA256 7cc52ab754b395bfc7b27deab729cbd7120a4057e70317fdb23c28c7e0041eb0
- MD5 5319c03b59700eee76eed4514645537b
- SHA1 477c0bcb65bbb893ece7881349fac5f1897d8b1f
- SHA512 38a5e728d20b4a55546bdf556e3a32f58607dfb3024bab92a2c691d879c80e635a1f0fb6da3f2851a5e5dfa1fcf6d23485e0b56622bac7b61c370fa1d60ebd20
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRHtY0IaQ7:A3kM456r9X0Ia
- TLSH T1BB556B52FAA41BE4D46F813489924551FB737C664F2087CF23645E2A3F33AD0AE3A752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 163fd8336a0f982a528ddef0f9c0bc49f8a12e7865aee83d67666aed6e38ea09
- MD5 608d53ce92357affdc1a3703e35c0f16
- SHA1 8e77fb32b7c0df91d25980161d763dac854d959e
- SHA512 2be12f2a5c3982b533a29984938c9cf98fd7b25f9f442d80c7252fc034d1bd66a1223142224e80229c934f4c5c08e31939cffd3972794aa24aec5edbd6f3c5ea
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRHtI0Le5ji0hmxNrM:A3kM456r9zPji0Aj
- TLSH T17F654916F6A44BA5D02BC178C5D2565AEB733C521F308BCB03949E293F277D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 958KB
- SHA256 6b658bf97b898623cb7494bcea2f574861bb89f4b89d9cb954e78eabd440975d
- MD5 9d99c23f76491713142190cc3a674bd7
- SHA1 58ac25f0fe50f3cefa6ff393217d887d294d2ba5
- SHA512 8c7d91634bd42cc0306e9f448f8f81e744569c07381b89354bae19cb569ff3c6d1e39a1ea358948f736bab5c60d30b9a8e219e1b6c2541b7f9f1355c9d9894a3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtD6:A3mnXoZjzyaEzD5TvinrmkzywFqRHtD6
- TLSH T110256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 958KB
- SHA256 e8b5440284e82ae90208fdeeaf24d79b7122ee1c3c2973f6241f1d8697376e7a
- MD5 1466364630d8600dd1f8722e4fdf685a
- SHA1 dc76305035b89e3911761c3f899880af4b095666
- SHA512 192b2bdf77e7fc7fd0d60d328bbfcad2d6b52150bcd96860e29f0a400108e992d242d14502dee75c81527c12cb43f5b44f7ffb5f70c2eeacda36835db813425a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHttN:A3mnXoZjzyaEzD5TvinrmkzywFqRHttN
- TLSH T18D256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 958KB
- SHA256 b192ddb9aad4784e789719d39c1fcbd9c3dcb05a9601b60ec30dd2dc5eaa561f
- MD5 1bdd1c07fab90d31ff99337244d8c1fc
- SHA1 4b8e1c9f0e3b4113afcca0c5badda83358f5a48e
- SHA512 69201f1075b2e1e9f057886f78bd36a5dc1c3eb1a634beacdcdde9e0f3ed134618533da2adb4b3b9213ec42503607f738481653167753b7d360193249633f29b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtbf:A3mnXoZjzyaEzD5TvinrmkzywFqRHtbf
- TLSH T12F256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 958KB
- SHA256 9f3f0d14690e11f7a2d78f10aef4255cfc061c85d2921adf10bad6b43acef2bc
- MD5 ee7d1f3be5cd9cf36e6f1b95453b72a1
- SHA1 70d4deefaab3bc0b23ba0a20b9b246a62d9a35ce
- SHA512 fabc5dd721478a8b3ad45cb966611889397cc3fff4fadae5d6651d8dcb7d4b0fddf9f4bbae72a9e7403d12be3eea5883445f76c16d63e7a203b4a4f0e7bdb9ad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtNo:A3mnXoZjzyaEzD5TvinrmkzywFqRHtNo
- TLSH T192256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 958KB
- SHA256 751b896d09a1e1a4563dad92e9fb77b6a3b3ea399ff3adc0ec6e85ce61015bf4
- MD5 f5a4ea65a1c18d5c7514862c89f32feb
- SHA1 30259fda51535380c8f6891560d26e42ae6723d8
- SHA512 21f2ff57695280fd2ddd6430f5fd731e71dd75ed33084e58119f0f120decc42f770eb4f28dcc0a8e62f7fce5f7322c722e4e9eeb454002276a6d38d3251755f6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtNu:A3mnXoZjzyaEzD5TvinrmkzywFqRHtNu
- TLSH T18F256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 958KB
- SHA256 28d06a5ff88c20ac763c79ca73d79587bd4b117b20dc28bebb1229d852496977
- MD5 6158d2862f66aa45988cfc235c3b4832
- SHA1 62180c9027d93958b8ecb2d128bb3cf4c756d763
- SHA512 d369375c6d082081a5a358edf888a7eb4e56fefb0f1f5d5bdae00ccba1118fbc96453ea4e3469e73a1b8c4a975c8b79d9396c06b71732cd56f98bb0ef52cd83b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtPc:A3mnXoZjzyaEzD5TvinrmkzywFqRHtPc
- TLSH T171256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 958KB
- SHA256 c23fa71c9d9f04a02ba273885db5149c67277687ead38dcac233752c601e0a93
- MD5 732a66c0c9bad1c8f7805ee105222db9
- SHA1 b7328a109b288f6e332e8b065e72d0bfe719302d
- SHA512 3c9463df72a01dec3e63cf9711ca24b200895bc6bad421988069362acf9dd4bc9d23d02390f5f04aaba58672c167e2777a6675ae484df11078cae7a2dd18dc58
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtIp:A3mnXoZjzyaEzD5TvinrmkzywFqRHtIp
- TLSH T1C8256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 958KB
- SHA256 364c6cad0de4427637a3c609f70342f4d76c92775e5853b30fd122b24f479580
- MD5 72691a744fab2f144c9abfceb1957cd6
- SHA1 a46215eb281e9b152002f8b5daf80a601db4fbde
- SHA512 17b9c55253d4dc2615bd9a31ff38b95521ac01baa3dfad731ce9748f84bd708ace393760cc7877d52844becda29e99a1f77d33d7069b1c85540234f4bff6ff4d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtf0a:A3mnXoZjzyaEzD5TvinrmkzywFqRHtfN
- TLSH T1BE256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 958KB
- SHA256 05848e9cfb0a4513d900fe7d30932b821680c533d05bf39ad8175b68d3b61358
- MD5 e2219666739d3ce4ad63b9747b0bca98
- SHA1 c8e0654ab4a48dd01f9da98d45fe5b958f83a794
- SHA512 a4be2bea2dd1679086c9a8bb5624510487f94e3007e1e58ec0a781381add29fc1cfdf0ddada1ddc2d0d70ebc78608eeeb9fe8f2bee0ce26954352b01d61ef195
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtdF:A3mnXoZjzyaEzD5TvinrmkzywFqRHtdF
- TLSH T1C7256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 958KB
- SHA256 96ae5169ed8b1be839f9f94ed3d382323a5d859e78a002da0e18c4837909397e
- MD5 1e17be7563f4c8ebd6763cb0e6fceff3
- SHA1 2ab6978378a15a903f2fd41ddf51b88c76a170b9
- SHA512 d29679d0da869ad01542814bfe5088319419e669f548be182e7d5202909af6f925bfde16ab0bef3beadff01f69e8b51b2fe448a00cb85ce437049443afb42ebb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtuC:A3mnXoZjzyaEzD5TvinrmkzywFqRHtuC
- TLSH T105256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 958KB
- SHA256 f271852378943f8abb8a72e167252a1e5c7240ec39fd6ee32220334fa6ee920d
- MD5 4dfde50f3efa7335f5400786d2b1bead
- SHA1 04d40be918af314b22ebff5f74814efc41205efa
- SHA512 00a526d1de6c37a9beb4fe3f11cf06e7b0f895ab112126ec50d06418bb9d0fdd7022812f8a7bbe977d76d88c8ff8d35a075bb20687edb28225139e9b0b88e5b7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtxw:A3mnXoZjzyaEzD5TvinrmkzywFqRHtxw
- TLSH T186256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 958KB
- SHA256 a9a793f35a64eedfeb0a7a40d3edda2b31aadf4b6b9d07c1f634acf02eb33691
- MD5 58ad293029db41b3dd4605fa0bdd0fa6
- SHA1 91d62ae0f0cffbf553a850b55a02dec4d2d8d7b3
- SHA512 51da718efb2757b9e52ca4ae2a61bc58fcaf02b5bc4e8ed06df388ac91fb7267e8e6419c3039d14c5b98174e9420dd516e389e98922c6a923e515a79ee2e3012
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtYT:A3mnXoZjzyaEzD5TvinrmkzywFqRHtYT
- TLSH T160256B07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 958KB
- SHA256 249452a27ea673ed023dde5f416b9c69db6d8280cdaea37b59e932094dfdf350
- MD5 2c14fd081c2d368323cae5f925f77d5c
- SHA1 0d9f7752abab596c67ae3e63bccf1f0ac1d3788d
- SHA512 7c103095e5304e9bc91878689295607e66300d905db1f788d89cf10881dffde5cbeedea22a3f0f8d88170fe36f260e2f119489e49fc731467951709304bc2019
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHt0u:A3mnXoZjzyaEzD5TvinrmkzywFqRHt0u
- TLSH T1C4256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 958KB
- SHA256 ea80da73bcf8252b6991d960550f6c6e021b281cea4c91c0ca072d15c5e312f3
- MD5 5484a762f39a0a8d9b51ab29af720a66
- SHA1 73ac65e74b9931e81efff6a7700ebeebb0eca480
- SHA512 8f5813cd49da63e8aa230a3feec573b3982872bac2d87a7b73704ec59925b424fdce939a56e0f944533244c3ff9859d3fd3169073dd71ac3e7f813860c14b0d2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtib:A3mnXoZjzyaEzD5TvinrmkzywFqRHtib
- TLSH T137256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 958KB
- SHA256 31a4d2a066e60b1612e1eb2c2a5a404436952d80126f45f09a7e11a552f9f80e
- MD5 3f11f0488f8f9c2f998e05e259980bd3
- SHA1 80186106df11a639460b4449291d8f2da00c2f6f
- SHA512 9f1857b2617fbb9887216fe21ef8190c603bda1dacce9db1cec22511d0459519f0969eaf229036b33bed52907f8e454eeee480a95970ccca0a1186351ff7dcfd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtkf:A3mnXoZjzyaEzD5TvinrmkzywFqRHtkf
- TLSH T140256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 958KB
- SHA256 a814cd1a1e9c2c928f2adf27c3b47827bf71fc55899461405614db62802dd6b4
- MD5 193f19a44665251ebfb802f2f29d49d9
- SHA1 04cde909df5fb8313d09e87ced7581a82bf72d76
- SHA512 03f8b25fb3b01ab8b6db4e7c56e683ae83a8b1c13e7a66b2d50e96f0249a08a87492079b59ceed2908371d721807a15e7b9c0c219314ed04468386a0999de1e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtBK:A3mnXoZjzyaEzD5TvinrmkzywFqRHtBK
- TLSH T1DB256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 958KB
- SHA256 bee59f40f19d2869eecd048c66842c53871ee216b376c00703d17960c63161a2
- MD5 0dd819cf747b52730888768c6739379a
- SHA1 356d6ef577d8f278433b785a45d5f5dd4aa947db
- SHA512 b3158793c73923885cd587355e736936fa2a468a74e8eaa78376b9d2b17603038bcc92a69062e0288eb5b0ad1711a104aed691300bee21dc1774ee4ef766b36f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHt6k:A3mnXoZjzyaEzD5TvinrmkzywFqRHt6k
- TLSH T190256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 958KB
- SHA256 18bd9df9ea93d1c49414f3ca5be017a46e801ebfe7d929a542937346a0025216
- MD5 b94bc28ab21989c5e0574142c5e63f56
- SHA1 2d617c1657b4aa59590341ab1f5966e65ef95099
- SHA512 050d39bc7544859ecbdbc9fab88cbaa759a94a3e0e341a62da255782731d2a75244593f9fedc57370b5c1029268646ad332f1cc020b6ea6a4688f9e73d820f9c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtf0:A3mnXoZjzyaEzD5TvinrmkzywFqRHtf0
- TLSH T181256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 958KB
- SHA256 806ecfdfb0af6bd379778e8a0ebf6441672761872cd5d4a2080a9d16cc681136
- MD5 d7d8adece25dec5e314dfaf17d0dff41
- SHA1 4f8a139ccbd9010d93c48228d0bf8b2162f32ff6
- SHA512 ce885ee42f1023c458ec0674d7c9759c1588b3ed611e8f703579e20452b868e227bbe47da9dd003837cac7ed34e31fa2910334fe5e3183986b71e219dfc1b77a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtu70:A3mnXoZjzyaEzD5TvinrmkzywFqRHtug
- TLSH T1A2256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 958KB
- SHA256 3344c95b530bca64af52fbb2f34ede1a463c5bac927eca370dfd2a4f14047c3a
- MD5 12c9094cde7b6ceb552686ac00bd0a77
- SHA1 2742e05db68ad9aec4b901acb4cf598cb24c8075
- SHA512 66b778f8a8458c87520dd100d03d5992b2f85e6eaa5b34502ffdf348648fd87ac913ec0a722ffd1b4e0cf3da08c9abc692ee8d20ec559e141542cd87651e5d26
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHt3r:A3mnXoZjzyaEzD5TvinrmkzywFqRHt3r
- TLSH T1B1256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 958KB
- SHA256 16a86709d3699008175de958529496f36e5f3f86fc31460e93ca297d967cb6e2
- MD5 4512b42d1e9573c71841bbd93bee1a0c
- SHA1 5e6a707b6a08874e11a60fb2aede3f75adc247ef
- SHA512 0ed6b622a43ff8eadca634fa017d7a5ce9b8dc9873f33cd76ae99ead51be52414d6d6c7c3c8e2f23c2eb1cd422437f1e3d2ee7c318ac434ae6be565cbdf90342
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtBn:A3mnXoZjzyaEzD5TvinrmkzywFqRHtBn
- TLSH T1C0256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 958KB
- SHA256 9eabf2fe12f0f15a57d86da1e5eebccd1fabcae75c3c63173970837e7b355941
- MD5 b99c3beb9221577add5c6366f99795ae
- SHA1 d1f9fb953633d6532b26f0baff891418a38dec18
- SHA512 1e396ece2a3065098598bf54f7d20a6095a51e40a2e957078d74c2d748b31bf779a67be60d876743e00c0a539c9fc8aeb85f65a336cbeea02b1f06e62f632862
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHttx:A3mnXoZjzyaEzD5TvinrmkzywFqRHttx
- TLSH T113256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 958KB
- SHA256 cdb9069ac944d841979226fa0a15ecb1ab3e062f8c1bfb9845a1f26014e45849
- MD5 4468361082a7d7fee9191fc89742ff3b
- SHA1 b3bad5c6d071da6819d93a82a9e073a04cdc1048
- SHA512 51e8414b9c7c8ee1ff8b7bae679876d504cedbd496b794291f01ae0b2194d5be00d23c048b6986205fbe67f34320bfc533572f7bbe159f7a6883b46f377c4048
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtzA:A3mnXoZjzyaEzD5TvinrmkzywFqRHtzA
- TLSH T1B5256A07A6951FE9D01F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 958KB
- SHA256 370ede6c568198809fded979fdb6c4bc5a0f17d99f4b0402ddf5bf8c5958f731
- MD5 9434c2bdba6dd862a9ca7d386bc6543a
- SHA1 cc39afd548e43a88b7e21660d8ca4bb94d3d87fa
- SHA512 0086eb08835a9ecb98d50870bd128caaf35c05c3b2d2caec713a6e5b1b8df4b00e0b7581099e203fc9922243ea3f90366d3a2196fb9e308ab4a1b31cd00a7103
- SSDEEP 24576:A3mnXoZjzyaEzD5TvinrmkzywFqRHtE9Q:A3kM456r9w
- TLSH T1AC256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 958KB
- SHA256 f960573e3b477bee2ee0a0df78a90cf45c0cbf4c8e25d549fafe436089102c4e
- MD5 7b3fc8bfbe7b5b27d272bb49f5c89ea2
- SHA1 b28a7bac99dabe6052a001c2d24ce99ea56c4f2f
- SHA512 8258eba7be7c5d0901c3b123f09cf134f7920584ceeb8e05ca20b2e32296adf80234ef835789402a692efeac90d85243ec5274b6635f1f37d9db08dcca1f2b72
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtd4:A3mnXoZjzyaEzD5TvinrmkzywFqRHtd4
- TLSH T18B256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 958KB
- SHA256 f30f6117cfb6258fa1a2beb3549b086acb173b84e9c379547a76ef206865f192
- MD5 973b79b0e8e748634f79ebe7ac4befdd
- SHA1 fde6baf5b25a4071233fac791a5aec123132783b
- SHA512 713f0f7dcdf21c934096e19e69fc1cfed3fc7ce8fde3af42da4b1a1fdf18ded0ab1cae3a0d907c577e58e22ee26dd0155c805109d94d17031d54af0cb2285d59
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHt4u:A3mnXoZjzyaEzD5TvinrmkzywFqRHt4u
- TLSH T1E1256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 958KB
- SHA256 0a888d0f3c2417bea9d1f188cc67b1b9f2cf958e13650e2384be12cf24c0c7a7
- MD5 e6e125afc3234f62fce929f4d48ddb8e
- SHA1 9298b06693abef50ccd94c9d3bcb0968e974ac09
- SHA512 74c4f568e3ba31090fa0810773092df7acebca509d846be875ab573128774dc29c7283f9abc454eb2ed0e815e16af28ee57fe0a9b924884ad25176b3ccb95ca3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtZj:A3mnXoZjzyaEzD5TvinrmkzywFqRHtZj
- TLSH T116256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 958KB
- SHA256 ee92b7f793a75f40c4b28ff854d6849bef5248a5f460269fcd327a6cb5fbaf9b
- MD5 dbd50a5c1291cda81366786c7148e8bd
- SHA1 d63e50ca9a1cbd7dc49984112e301a0d861b6938
- SHA512 e5e2b5ff366c66338828271c4ab36b6f3c40e0689416c255e7f222a0928bb1131f07a353c008b94e02eb76fab78535e53aba96bdd9d0b73c8c289f99550fb349
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtAg:A3mnXoZjzyaEzD5TvinrmkzywFqRHtAg
- TLSH T1BF256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 958KB
- SHA256 2380155dd0c11180c9769316e7fe0d443b93c73fe83e0b17b46fb0d1acae687f
- MD5 8762d91ddd8fca890e27cc4142663705
- SHA1 f6a1c98f450d3fb31e0d09ce73bba51bdffbd714
- SHA512 3b3f7b4a22100625ac628b09d587363733bdf73060f6842992eaddfc19057bb55907e509530d57d166e65264db59909a5c804a7641de255761147a429cc5fde1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtvI:A3mnXoZjzyaEzD5TvinrmkzywFqRHtvI
- TLSH T184256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 958KB
- SHA256 eff7116339cbac3844a23276e2a83d4827b538aa7b270e79c93618b513f10d50
- MD5 f549fc269bd1e629c1865933a50ee402
- SHA1 932890cc269c57cb2ca034b1aed93d105a0b9b37
- SHA512 173d8a7773f1f369a7abbacc7b4132ad6b40220772e87d67152077d536dbd94709940c27edd40d380a227303f2f81db5eef34e80e40e35b51ec21cd31f4863f9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtVo:A3mnXoZjzyaEzD5TvinrmkzywFqRHtVo
- TLSH T15D256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 958KB
- SHA256 4549d97356c0c91d0f5cd71e106437c7961a5785a8126e8958f78fc16ee4e2c5
- MD5 429ff63ba82ca84b808f275fc2c0bd4a
- SHA1 433cef4870816150d38c0ccf0ce0b760afa91eaa
- SHA512 eea4d7b2b481810797069347d1ce622857b122aa265a0ded30d1e6282b6cfd805f98d7ddf4f517230b65bc4d691e9814a5a66df390c2393d0bf382b17bfeb6ba
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtG+:A3mnXoZjzyaEzD5TvinrmkzywFqRHtG+
- TLSH T1F1256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 958KB
- SHA256 a3d586fe93398212f2dc4e30cc5133bc16c1cab202f976339d877de62fda95bc
- MD5 604e6747e75043f9089bb51c3dd67871
- SHA1 0f23ed10bda899cb3d45239da0562004c3b9f82e
- SHA512 d687bc49d64be1ea103bcea3fe9cba38b12da0544fe55e0574eacbe69e5923e37efb0c527b398bc9ade6f3362fe6eeded7c6d580248864260dc45ae159777cbe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtGQ:A3mnXoZjzyaEzD5TvinrmkzywFqRHtGQ
- TLSH T155256A07A6951FE9D01F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 958KB
- SHA256 4d87227fa6d87a9085aaa0c83d55cf574d9bbe46e986c109984bfe275b97ba1e
- MD5 956aa10f6b2ebf0f08045854cf01dd8f
- SHA1 f62335871f93c8550b70f2c1d310a4b276529422
- SHA512 9ff16a48a87c0d241de58b3ae1496db2b483e1f8de981434cb535db5e05004105692ff1e1424a3df67cdfc727abae6a3ce6cdaa4879ce8fc9a7677c6a23a69a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtXX:A3mnXoZjzyaEzD5TvinrmkzywFqRHtXX
- TLSH T151256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 958KB
- SHA256 e4e7173c53a08391f1b2b05ed4f1f53f5aa10a11b8439d37103e824d22b2bf22
- MD5 12e115826ffc47d0c2aeebb01201818b
- SHA1 4b09a8173f6469d5b1408a358599efdb97acd890
- SHA512 1853b66367baba1a96e1cd7ade7455f3f4fdf38344aac303e7bddee9ac43e74af7f94d64bc43966efffed48f4dd7eba28609678e6dd2fe35a2fbecedcd82090e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtNL:A3mnXoZjzyaEzD5TvinrmkzywFqRHtNL
- TLSH T10B256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 958KB
- SHA256 a896a04e1e77b262b77af7f686462994fb4efab04b1c074a96a6a8fd8d749f01
- MD5 d754e8109818cfc20d9a685ffa088ec6
- SHA1 efd92b75398df52b68dea137f7c23b40386b68e2
- SHA512 1031d7efd319e2ef9eadd83b35823c7917b5f48576cdd815c0948fffaf6000b2e787e5a92929b1d85e527bdfdfc64178f3db7e1b4151694e7b594de10a19f2ee
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtLFC:A3mnXoZjzyaEzD5TvinrmkzywFqRHtLM
- TLSH T18C256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 958KB
- SHA256 f8f22c52ebde7980d967396ebe1a45ea653e955599c696952151364fc7849ca9
- MD5 205e8c2ff50c6e0aaf1b6fb81f791ffa
- SHA1 7afdc3dbc3885a8a8eb946a9aaf4e4c428d312a4
- SHA512 e6d8ccf6667b67fd0f42901b467a3f3be23187c83c012ca21563edef0c9964baa7b49494a05780f313e985e6fc986f4f15c5e4d369f80569f3670ab1e7f98f50
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEzD3JeU7vinrmNyPz5L8wFq5fHtMh:A3mnXoZjzyaEzD5TvinrmkzywFqRHtMh
- TLSH T1C6256A07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH