Analysis
- max time kernel
105s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 17:09
Behavioral task
behavioral1
Sample
2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 827KB
- Sample260705-vpajtaes7x
- SHA256 d9725b7bfd4bf39d97217377109f15bf93beea5f7be115812151b71fbda94f22
- MD5 76e8e74a3d38c77291b2c5c06cf94343
- SHA1 035475dc492d32c678a4cecd8bb164457ae2faf9
- SHA512 5f46260f79b3c1d964897d446f22be328784b1b83cd72d1872854a631a436abffcc72f4427c2045d718fa121da89ed34ee410458e0bfe81d1c7e9b7186edc978
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyS:A3mnXoZjzyacNVOE/ZQZM9zFVSOS
- TLSH T15605AE17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/4792-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000016cf4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000016b46-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b8-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3588-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4792-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c79-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4f-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983e-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a4c-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-597.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-708.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-783.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1085.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x0005000000016cf4-5.dat aspack_v212_v242 behavioral2/files/0x0005000000016b46-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b8-39.dat aspack_v212_v242 behavioral2/files/0x0003000000019c79-60.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4f-226.dat aspack_v212_v242 behavioral2/files/0x000400000001983e-263.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-402.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-475.dat aspack_v212_v242 behavioral2/files/0x0004000000018a4c-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-597.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-708.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-783.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-802.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-851.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1054.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1085.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1134.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1153.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1223.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1327.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1346.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1371.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1378.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1391.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1402.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3588 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4792 2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 3588 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_76e8e74a3d38c77291b2c5c06cf94343_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4792
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 827KB
- SHA256 d9725b7bfd4bf39d97217377109f15bf93beea5f7be115812151b71fbda94f22
- MD5 76e8e74a3d38c77291b2c5c06cf94343
- SHA1 035475dc492d32c678a4cecd8bb164457ae2faf9
- SHA512 5f46260f79b3c1d964897d446f22be328784b1b83cd72d1872854a631a436abffcc72f4427c2045d718fa121da89ed34ee410458e0bfe81d1c7e9b7186edc978
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyS:A3mnXoZjzyacNVOE/ZQZM9zFVSOS
- TLSH T15605AE17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 f91acc6e7994719a08af3610360f7ce5cc50b3403ff7e817b3d2d0a96432ed95
- MD5 b2f18a49cfc51713f93f67f0d5f93a36
- SHA1 5960f70ee15d86364dcd630d9b0e21192a1e9014
- SHA512 439cfa0c6bc5e8e8bdfd5bfaa4f1e22134ee8c5fe50139b36e248241ac8a1dc4f0aa944aa35fd633c54c8eaa44d77b9004d564612eb739d86a108c77942f0a98
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZQZM9zFVSOS0Le5ji0hmxNrM:A3kMXZM9zfePji0Aj
- TLSH T1BE658D16F6A446B5D033C079C9D29A5AEA7138421B30CACF1399D7392F337E19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 841KB
- SHA256 22279c50ab6f7c6537d8f309b3f591a172bf4a23dabb289906aec3ba7303bb74
- MD5 7443dd9e78779b9fad933f86a1ab67f0
- SHA1 7687bc20f6cd35a76651c1e43d61e98d527feabc
- SHA512 186befda0e54ae7804b8dc084368f60292a2e877e8b92bae32e064810c8ad74954f3f19fa62286e69def7d15200418a28bdcd08091f40bdb189ddb979280007d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy8a:A3mnXoZjzyacNVOE/ZQZM9zFVSO8a
- TLSH T18005AF17F79014F9E8178138C9A54A22E7B1BC661760C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 875KB
- SHA256 22486d462c7fe9dcde10a9b03e8653f0643637b367831d707152aef057682197
- MD5 e2f42f3100a2fe89a31b3b42dfb3bda8
- SHA1 265cc1eec0f3348b9e12c15056c6385f2fd0580e
- SHA512 1a505b4449020870b5b46f0dad8c8344bd2621afa777a35fabaa3016867e16680fb05b26d3f3ea0dc5d7eddecc4e83edb4160a0615097cf493c0e4022130dc75
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy3b:A3mnXoZjzyacNVOE/ZQZM9zFVSO3b
- TLSH T1E815AF13F79014F9E817823889A54A12EB71BC661B70C6DF136892262F737D06F3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 851KB
- SHA256 0c2ae887dc0dfb07de2ddb422598355ad1b57b5ef8c36c295ba63e3ccfdbcfa3
- MD5 4afdb05c84286b297a2ff47f67368c69
- SHA1 71cc2da79bb7a0c3faddba2e44ad7012e317c541
- SHA512 edeff1db3f0123f250db0f4097d7d2d77bf75df2ed97aa8325035f272b31265f63f30bb05a80402c51c37ce04e41ea9f8e576b89ff783f3c487ff02767d25d10
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy16:A3mnXoZjzyacNVOE/ZQZM9zFVSO16
- TLSH T10205AF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 851KB
- SHA256 936b3fb87e931834627c70db962890ea10715d2458f35269ca6ff538cfc878e6
- MD5 af6c238d81a4dd43fbe0dd6bd3867138
- SHA1 b94d82a458a8ad9f48f1ec2d38f62433dd7dbff1
- SHA512 92b4fea09c45d8d3ec53a0b360c7fadc3adbd7d0f595f63bd290fc9e9acc388e60586f6aefb3f0040d52011f3cac3c01b5856584ad00f590f0cdd8943b2ffc79
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyrN:A3mnXoZjzyacNVOE/ZQZM9zFVSOrN
- TLSH T1F405BF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 851KB
- SHA256 e443a4c0fc21517501aacddc5bd7b552cc220f1f0a2d7a5bb367e2355647c7eb
- MD5 96ba2b864d8a889d6e3e0037c07ff76c
- SHA1 e63da3d3dc9542ff6ee31eaf30120b3896cc7034
- SHA512 6df80d2df2044d0e1b9a81a7fa9103461635815443602edfe28958b22e7d79c54dd59de41182743cdd81d4fa78448a6050f6d998e360be644b2a5645868e8131
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyJf:A3mnXoZjzyacNVOE/ZQZM9zFVSOJf
- TLSH T14C05BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 851KB
- SHA256 e1afb113e1ff75255f7552220241fc67efc789ae7c6145bfeedda81b9638594f
- MD5 5fc2fcc0eb206ef510ab3c1ebd8b5ea4
- SHA1 66c3701371aaa5e14e5c5b2187f6977ae8d0a443
- SHA512 24dbdb060176428edb77d86c99e93f95dc5a394946f1981ece0d96f41de3a20f39352c9ae392f886f7bcf6db58267d09a18132ba5f2b4281cc77eb331dd2442b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyLo:A3mnXoZjzyacNVOE/ZQZM9zFVSOLo
- TLSH T1D605AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 851KB
- SHA256 b1450e4f0ba9cad357f696e5a5154c2de5a1bd103dcd58b696ec09bd964f705d
- MD5 21fad55075f042e138a48d5cc0aa96b3
- SHA1 6483a027b257430c2467ee2a41ac1abdbb39fae6
- SHA512 5a3d887b66fa6e60ec17ab023ea467a8143a684b12fef5912916f0b9bab3188a31c7d020974cd4856c5170be4d0e6481781ef7cb54ebe5a5dacfc902e1e431a0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy/u:A3mnXoZjzyacNVOE/ZQZM9zFVSO/u
- TLSH T1FC05BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 851KB
- SHA256 c275ad899914cd637592683adde9dc8e3c2d68341ad4687463a88eb51b18e7c4
- MD5 f382f1635017417b2bf272dff180c36c
- SHA1 bd3121288a4e54d285619d336a9211c256ffaf9d
- SHA512 58349f117d2f6334e33375dcd84f95fb2919f98da4de6c3ac084529da009c0a9bab5fe9d64787a9243a0deee54b5faf1a64599bdf0d95cef622d6db3018f42dd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyN9:A3mnXoZjzyacNVOE/ZQZM9zFVSON9
- TLSH T18A05AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 851KB
- SHA256 f5a6690d3f35387bbba52cfcf5f3776a3fc0289c82e6e1c454e93b71a5c8d36e
- MD5 1436ffc68a0bab5521ad558fc0fb85fc
- SHA1 41a9f2e62952d24887a683188d27b54b300bbc02
- SHA512 70cbd7f8a08d1c80ddeae5a8dc146dd7a4a41cd651de21933f5da12dcabe429bb9378926891b659bd860a6fe38f57ee56a1d5cafcd642054bed777cc216aaf9b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvypc:A3mnXoZjzyacNVOE/ZQZM9zFVSOpc
- TLSH T1DA05AF17F79014F9E8178139C9954A12EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 851KB
- SHA256 327e2db6d7033e084cb2179c516c717b2cb4b35042cd8ed7204a9ed5e6fe11f8
- MD5 8719a90bcc6112a3734a1ba9b637788f
- SHA1 c821a071082a02b2a5d214ee3258b2ee8b21e0ab
- SHA512 6b1352239aa558b092967a07ef21ec041236310dbf451a232d168286e874ab6fe555b3b7f210a4d4928b59f91f84112b3a455f2ce121528eea6104ae46b8e594
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyip:A3mnXoZjzyacNVOE/ZQZM9zFVSOip
- TLSH T17305AF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 851KB
- SHA256 47f5e669b5247bf3cc0301dded482a0ab27da3eba8d2b25456c199a40313c6f6
- MD5 8f82f42fb74b8be852ec03a3f0a29bfd
- SHA1 a2cd48fab2c82e1b0ef48b591978e0673d955342
- SHA512 8538aa0a0c0a072d9fb8dc1ab7ecaa13844363b7b680a8a43abecc5feed5042eb859e8b54095eeb404a8b18dafc9c44ed16245757f06761c64bc80ec39fc32be
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy10a:A3mnXoZjzyacNVOE/ZQZM9zFVSO1N
- TLSH T18D05BF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 851KB
- SHA256 266af14a911688410f9fdcfe01d3e0aa10d5fc55367fd94478fafffb5042310d
- MD5 a075987e90b2b5c149da52139b796eeb
- SHA1 f7d14019f7bb6d8befbb356a9181f312414b1557
- SHA512 ef053896a58cec4bff8d34b5eeee3ff686d8d109b2e749be6eb220194801dc3bd72819742728251d3e4a1a62b81030c722da2190793e3d6f5f49a52f00bdcfb3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyHF:A3mnXoZjzyacNVOE/ZQZM9zFVSOHF
- TLSH T10505AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 851KB
- SHA256 89ab5a598ca4a711a1982b95285eeed910b2de8ed41eb64a87d800bad00d66b7
- MD5 dd67d381447de8060ac1efcbf8ba5fd8
- SHA1 f5d96290a09f8d5a9a19aa67dd4f7668fd4a7c51
- SHA512 d0b0071b6ef8e6f1034941140522d5e93c4a69e1de47546530c156ff52fd3c1c8a632012b2dc4fd4c619a46dd604e309d4e469c148ba03fb66f21e8326c53505
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyYC:A3mnXoZjzyacNVOE/ZQZM9zFVSOYC
- TLSH T17705AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 851KB
- SHA256 df71838064572f5c23f7d52b5ffa41d30c221be840be9febec883bc8e01a2732
- MD5 0249a31919100cc5226ed2f5deddb868
- SHA1 846f49654c914304c3b73c67c6418c634420cc77
- SHA512 615c654883d0adee65c215c9bc4ddf263552c644e11d9279de3e84e7263e86daa246b83083482305a1586edc8735896ceabd70a9f2b7c1fa6455820a5b86cde5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyLw:A3mnXoZjzyacNVOE/ZQZM9zFVSOLw
- TLSH T1F905BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 851KB
- SHA256 153363b7efa0564ed6842f3e621422d8c2a4c5b108499bd16702b8940e183f1a
- MD5 16daa32effaa9d3b8a433fa25b30439f
- SHA1 187b0feb9cbb4838227be32c01ec5769ea6cdc20
- SHA512 7652f50e04f33483b352dfe56173847d3bbd6bb4d2508147a23e7cc3296378dc7298dbdd9d171232c565193c40c1ff25ddc60b3da90c969f79b7fc879da10c69
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyST:A3mnXoZjzyacNVOE/ZQZM9zFVSOST
- TLSH T16D05BF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 851KB
- SHA256 cd87ac066aeb35024d2e8efd6fcc85ad2005dc73f24d980aeb83883bb2d448e9
- MD5 6f1c65a3a54cd0d2c2cf477d30d9a744
- SHA1 a0abe4337ba6bb771d92a84b6100af123e822483
- SHA512 fc7c221e4de9a42278921e3b4a2ec8f8533c8d67afad8fe0bafe816266dd79a327c98b37eef0812a92c661e4a4d21719351cde8a427cf806772a7c584720aec1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyiu:A3mnXoZjzyacNVOE/ZQZM9zFVSOiu
- TLSH T12A05AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 851KB
- SHA256 01dec5dea3fa66433ce2d25b2d31694488c4839a5144e2ddd78d660eae0aa106
- MD5 696c9d550a6476d8ffbab99b46207c8a
- SHA1 917afe3ed02a2b8c8f369f10c4ae4eb8a475bb5d
- SHA512 87019d602c997e0f0688d61abfba945be182719b222ff7854db138111b445e52f48febc3e9dbce591847b7db85f9207a79e520efe080bb6e9b4e374d311426a8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvycb:A3mnXoZjzyacNVOE/ZQZM9zFVSOcb
- TLSH T13B05AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 851KB
- SHA256 32edce7ad2188c7d574c868d36c4f2d162aa418854a10753ed081842bedd9aef
- MD5 ea2323db5d967862b5875cb31daf03a3
- SHA1 756cca8322866f6d761d3fdc4a842fb2d6452640
- SHA512 bfaadb54c322ba9df8d8519329480658973387b327ef3edfc62077659419f02b31a9595dd441ef9698b8a031bba03bcad52489a2de90c63f8bd787326f7d88f9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyCf:A3mnXoZjzyacNVOE/ZQZM9zFVSOCf
- TLSH T10105AF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 851KB
- SHA256 65912a6ed6b4e58037cef0644fc4817c0777b3cb8df04fea1dba66f01d456cf9
- MD5 c840291a046bee1e94cbc3a7392bf6b9
- SHA1 30bf0a1dfe6667cbe2701db49296fb500880983c
- SHA512 035e768522973b3e2a7f193ee975ad7355cc2e4188d5ff5c80a65c4b4e0092402875c013423ebac4d8f70c82e7f17aa4bc237e3b7a3653bdd7238d0f15171324
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyPK:A3mnXoZjzyacNVOE/ZQZM9zFVSOPK
- TLSH T16705AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 851KB
- SHA256 a916393f51133eee721f0850bbf98a14d50d9f9ad957fc0586bb6e1ce3a8a3e5
- MD5 a64d2cccfe97a23d60c97a0755ee9597
- SHA1 0ac3cbcc23e41360d383c78af18953f3ee90dda1
- SHA512 3352308953ec91616c86f4e7926ddec109e2f0ff45d6d7dc2697644bffeebb2b0ddd393f1d7fa1b31e35fafb210aab71945b1948763265e1881481624115283e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyok:A3mnXoZjzyacNVOE/ZQZM9zFVSOok
- TLSH T1C405BF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 851KB
- SHA256 87d149a7a4201a949316153df3af235c4350bdf0e35dcbf19eb5395fd20f3cc7
- MD5 003d6a800e4201c4e96a66149b6a315f
- SHA1 b79ee593c4513e1e0af35904dc647d63d0f635f8
- SHA512 327111d5618c5cb6dd01bbbab30ef36482eea4787e2c158573fcea1e2f911953f78a51192b812c054bb98cf005f47240ac88394b94c9f8e5d37196f3ff0a899b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyJ0:A3mnXoZjzyacNVOE/ZQZM9zFVSOJ0
- TLSH T19405BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 851KB
- SHA256 72cc0b46f047f6587473f0b24c005288d6d6b09fce9bd1692b0ddc67466173dd
- MD5 ba5e8d0c0e2bd2ee84f3592b036c3cdb
- SHA1 f51ec70aec7d5725d082bf8935f23bc67cb4fdaa
- SHA512 74f01257d90e2dc5a2ed4f521d991d16e2b780baa09480bf6be2e48cdc22045845dcfa5f2d2e053cf3a611f97b6529a173f75f2e50cc1e2aec6bff9745e60aa3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy870:A3mnXoZjzyacNVOE/ZQZM9zFVSO8g
- TLSH T1BE05BF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 851KB
- SHA256 a79971095f9b9fb2bd4b25a7f3e8246aa5c3c5da307d424c599f3d900e0b460f
- MD5 375cd515722eb984489817646c0a4dd4
- SHA1 59239ceecd4be5aeb265f4df2f6787181aa837dc
- SHA512 6f97706d57efb1f87bb9b7325076ca9bf272b4bd619c2fea929e38193a3edf3739de5a6edc82bfac737f933f95256ba75a13cb532dc6e527174f689f53442931
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyZr:A3mnXoZjzyacNVOE/ZQZM9zFVSOZr
- TLSH T1AE05BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 851KB
- SHA256 449ac6d44559db1cc8280cedc0acbbffc1144c1ef0445a498ca25a9e967b13ce
- MD5 cc7f8953892fe0c0d1ac561551755f30
- SHA1 96b893df0a4d1c0816b6909dcf8af0e25ee89b12
- SHA512 684b5f6f530a4d8d543a49d088973b260460c5a1dcd04588a26c5632eae741e7e7f1d87023f8608e5eb045cb86108fed0f379819f24465287c34ce6d4abda188
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy7n:A3mnXoZjzyacNVOE/ZQZM9zFVSO7n
- TLSH T18505AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 851KB
- SHA256 b87c1d19ea8d3270a49e96d7ce5bc9cc74192647b7c6ed7edb197fda52f8727c
- MD5 6da469e972781458aecc055034f39ed7
- SHA1 f0e838366c3c82adce8e92ddc33815d05c58b98c
- SHA512 75560b2fee69ef2a6c4a7be4d4ba3db92b1121730805a8c0e60500f88f87536af62909c34210dd72e8c4e0e32f8b09164f591e05d7c55be2b811499dc01abd22
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvynx:A3mnXoZjzyacNVOE/ZQZM9zFVSOnx
- TLSH T10E05BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 851KB
- SHA256 228bebc9a753ca824bd4f170c18580fc901675d65500471d308804be6466b116
- MD5 3a1149371e7934a05622dee56252bb77
- SHA1 68c1b59ca41964434e6af7a4918e6d8a643c9d20
- SHA512 7af09d7bd35c5d600ef4dae27e36c36d01f22a762505f1406e35250debbb06beb7af449928b43bd2272edc8e84d87244c255abbbf91a248173e5a8a54919c767
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvydA:A3mnXoZjzyacNVOE/ZQZM9zFVSOdA
- TLSH T1DB05AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 851KB
- SHA256 c03e1070e6def1049a577afbde8d8d803297a8f0e73437151b48abf407df47ec
- MD5 e9d8c49220f2b80115d3a9ab62db9e45
- SHA1 156b4ef2627eda929fefa650447d9c2e97b159da
- SHA512 ef76b976e4c929eee9f6edf0c27cfefea1e6fbbd808a16f342eea1e8d97e767d1279e88459dfe49f3d520fde7ea55997f59c37ace97e0b6e699f33e854b0c37f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy29Q:A3mnXoZjzyacNVOE/ZQZM9zFVSO29Q
- TLSH T1DE05BF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 851KB
- SHA256 7071c463435f9baac3ac53f66e5c454c99b294c05c93fd7f270d720cbb1354d0
- MD5 bd93375738bccd0f89879b528bb63f30
- SHA1 6a131bee6cb9cbb8a25eb0b6f49b37eda43420d8
- SHA512 861c3a341069d3a7627225f365462e43a9657a5938656cd9682fd1fc54a021e8c45d92c0a1a65575f58898363533d588e6c730dd19f2577750943dd0e9b0ac43
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyz4:A3mnXoZjzyacNVOE/ZQZM9zFVSOz4
- TLSH T1A605AF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 851KB
- SHA256 6425edac3916a2703dc393d5f76d6cee698cb3463fa5a61970447b1e21044dd4
- MD5 0d0eb1fee8cc78c782c3b8fa49ca0c22
- SHA1 be047c14c9b3cc3bf62ef4f09b2b1e74c82405c4
- SHA512 ac18bb37bebcce51ada221ef203b4437c3f327fb21b6fd3c9aae1d3440dda48594baa3369d095d2cbb6ce328199bd7233da900f8897e2f6a8690062a3d554993
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy6u:A3mnXoZjzyacNVOE/ZQZM9zFVSO6u
- TLSH T13605AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 851KB
- SHA256 b41f550296eb1a186d266e17f2d9726765dcc0e9279b5dcedaaabb203cb30de2
- MD5 f802860917b7939de71f2bea60c6d2f0
- SHA1 d51c7d4f980f64774fd3a355341694ce7a409b4a
- SHA512 fd8efbc98216cd5a10da4fa671854d7d4d2c4bedf01a0c8033a95ff37e9bc57a4f7dfc5aaed25b40b026f618581aa749741e0f3499f637cc2355a357b1e7dd71
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyrj:A3mnXoZjzyacNVOE/ZQZM9zFVSOrj
- TLSH T12705BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 851KB
- SHA256 6299c44c85ec59a02d31c51ed137a7372a9f56ae9b420454dd7e8e63537c9cb9
- MD5 57e31c7360b8e0ddbe9a7816fcdd3a26
- SHA1 74aaeccc094fc766a60e9a99706be93298442765
- SHA512 29864f82fe91275b8a6eff012a35e1befebdf3c1ffba0ee292366a7899c0e1386d607b03e68f908caea4b47859dce4ea1ca37a9292170abafba2bcd1e4c18546
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyWg:A3mnXoZjzyacNVOE/ZQZM9zFVSOWg
- TLSH T15D05BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 851KB
- SHA256 87c652a106f32c36ccbafc612a6d4ab5a8b3a68dc332437fb8c2897896034355
- MD5 ed011b6c97ced00dd275312d6f8b124a
- SHA1 ce4073a080629c2e84c8f0af164dfb50645140d4
- SHA512 cba4aa824332d9378737eccc17282dfc8497a47fdadb24df3730daf30fc8dac7c4275066d7ad3d568213a99a2770e1cc7c296d86c0b8f862672f7a19f6026135
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyZI:A3mnXoZjzyacNVOE/ZQZM9zFVSOZI
- TLSH T17505AF17F79014F9E8178139C9954A12EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 851KB
- SHA256 f4b26214cccfe1d4f6c39b6db44f921684dcf877f6ecabcf6a37901c343d1605
- MD5 3577c3a0e1a41165ac8768b9752cda07
- SHA1 face6b2d79257dfbccb3d7215fca07163d89b141
- SHA512 886ba017e1ca06ef45cc53af0f2a393b71682d5de65a3bf94a8d336ca4af510e91e39473af6f2ac0f480c3f57716cb839ea4f551de424504c9c34ad6bdffca74
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy7o:A3mnXoZjzyacNVOE/ZQZM9zFVSO7o
- TLSH T12E05AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 851KB
- SHA256 a13501bb8048e4487d41f1d07a68b2d2ab1394441b4de0bfd57738afbe63f2aa
- MD5 a217d2cc9db9bbe5dcce7276848fbda6
- SHA1 1ac0efda59aeedcb12949a587c05d19e5179cf1a
- SHA512 02c770931778019a023ba36eb773cacc8a1a9623deb0196cfb7f2b4ec5a4379e266260b67c9f7e839bdc316bbb76d7cab534402e31ff04719f1b0a11f5f9dd5d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyg+:A3mnXoZjzyacNVOE/ZQZM9zFVSOg+
- TLSH T18A05BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 851KB
- SHA256 d5769100db99f18fceea563fd77279eba3a2c32ad33decba61cfc380425d87c9
- MD5 5ae763b924b6d5e5e6dd08157f9e633f
- SHA1 3da73b712e81c1119d8d36d96eabbf594f6e178e
- SHA512 a58a5e299dca5160b0004d628001a279f3b94b6ddbd169bafaecb9487131a8abb8cef9312fcee5d7c9c806996fd4e820d6e26e2f2d267189b4a3d3643e2d9c01
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvy4Q:A3mnXoZjzyacNVOE/ZQZM9zFVSO4Q
- TLSH T1FC05AF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 851KB
- SHA256 86bff28b23ee1a8018b33eda82734ba49b74747c8763a6c995523f93633cb9af
- MD5 0a6a9e31b2ac6c456524b700a55c5b98
- SHA1 8dc05c15014eec7b61ba3a12354b2bb505b4339d
- SHA512 8573af80fb5915e82321695e0132a85ed1a4866a2e99e22652865698eeb13c619799c16774808dfa448e5463c7d77d451bd4f5b4f8af4e7e7315fd496c5febe7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyxX:A3mnXoZjzyacNVOE/ZQZM9zFVSOxX
- TLSH T18D05BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 851KB
- SHA256 4b2184634745b0ca78f9d1d08596250f026b1ef567082b29793e945a16f3188c
- MD5 06577c2f17e288f39d6cd4d61ced4a66
- SHA1 d0135c090f8a6cc63ec80bdada2e77dc38db0607
- SHA512 742d220b940d74702c79d8d4751da74dd808555c169d7dd6d1a0f37e548b9e9207cced236e88c0808d6adc6db6f7dd3d72cd95d516e37fea77282c7611454e09
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyLL:A3mnXoZjzyacNVOE/ZQZM9zFVSOLL
- TLSH T12F05BF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 851KB
- SHA256 62266593b6c651db1e5474d5a93f61dc4fef28899f8ce6f846e2b710999abd4e
- MD5 4d03e29259c296e2f7940bcceb737150
- SHA1 2d5efa3209d09b80bfe3e3860dd63b5bcfb769d2
- SHA512 9c6948b5e4962ee67beaf459c2b206ded2fb43cc564fbfa0090cf992abf5a5ad4550af615ed68e200f54bd090a1f2d9485607587c96fc279be67284898d12a15
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyRFC:A3mnXoZjzyacNVOE/ZQZM9zFVSORM
- TLSH T15705AF17F79014F9D8178139C9954A22EBB1BC661760C6DF236892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 851KB
- SHA256 816e57a0f592117569797e6ed21c1d5a635fa113b650fc00323c850649e99344
- MD5 a39533248675b6a585d8028c36bb9cef
- SHA1 4c0cee25718414eab61b13a1340e5836ef88b911
- SHA512 2c334c1167c21b0a80495bbfe6d497b00c1a0532f1a9a68e9be5ba9728e4e549ab7888f07c5724003e3540ff924f22f2aaa5669ed58036bd70ff29cea6c0e194
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZNiZwb5zzFEoS2cPvyah:A3mnXoZjzyacNVOE/ZQZM9zFVSOah
- TLSH T1C105BF17F79014F9D8178138C9954A22EBB1BC661760C6DF236892262F737D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH