Analysis
- max time kernel
144s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 17:18
Behavioral task
behavioral1
Sample
2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 774KB
- Sample260705-vvjpnsas2l
- SHA256 f6121981132f31ff0fc894002e5940b5f87b80dab2623bd18dee5f0554e77e32
- MD5 1589fe008c9e614b51c6c47307c875a5
- SHA1 28d4a33bd3fda36463fb8bbdf2d3e108eddb8064
- SHA512 d41a3e8141227e0e8cf37a0179edd45fd6091f3255e1979b236a08470b440246564746390522c72ee176a2fbaefbc89b3eedf257e0f010cbf98b268fb8bbe73f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L88:A3mnXoZjzyacNVOE/ZxUi9zy8
- TLSH T160F4AE17E7A110F9D11A823499E64A22FB75BC621760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 35 IoCs
resource yara_rule behavioral2/memory/5868-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c61f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b293-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a8-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c60-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5868-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3840-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ae-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198af-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b5-239.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b6-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b7-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b0-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019934-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019945-516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019948-541.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001994f-584.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019950-597.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019951-604.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019952-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995c-618.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995d-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019963-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019968-639.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019969-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996e-655.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019972-686.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019976-723.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a54c-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a54e-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a747-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d7a-1226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d78-1348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019d74-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b773-1805.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c61f-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b293-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a8-39.dat aspack_v212_v242 behavioral2/files/0x0003000000019c60-58.dat aspack_v212_v242 behavioral2/files/0x00030000000198ae-201.dat aspack_v212_v242 behavioral2/files/0x00030000000198af-208.dat aspack_v212_v242 behavioral2/files/0x00030000000198b5-239.dat aspack_v212_v242 behavioral2/files/0x00030000000198b6-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198b7-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198b0-266.dat aspack_v212_v242 behavioral2/files/0x0003000000019934-497.dat aspack_v212_v242 behavioral2/files/0x0003000000019945-516.dat aspack_v212_v242 behavioral2/files/0x0003000000019948-541.dat aspack_v212_v242 behavioral2/files/0x000300000001994f-584.dat aspack_v212_v242 behavioral2/files/0x0003000000019950-597.dat aspack_v212_v242 behavioral2/files/0x0003000000019951-604.dat aspack_v212_v242 behavioral2/files/0x0003000000019952-611.dat aspack_v212_v242 behavioral2/files/0x000300000001995c-618.dat aspack_v212_v242 behavioral2/files/0x000300000001995d-631.dat aspack_v212_v242 behavioral2/files/0x0003000000019963-632.dat aspack_v212_v242 behavioral2/files/0x0003000000019968-639.dat aspack_v212_v242 behavioral2/files/0x0003000000019969-642.dat aspack_v212_v242 behavioral2/files/0x000300000001996e-655.dat aspack_v212_v242 behavioral2/files/0x0003000000019972-686.dat aspack_v212_v242 behavioral2/files/0x0003000000019976-723.dat aspack_v212_v242 behavioral2/files/0x000300000001a54c-1008.dat aspack_v212_v242 behavioral2/files/0x000300000001a54e-1060.dat aspack_v212_v242 behavioral2/files/0x000400000001a747-1097.dat aspack_v212_v242 behavioral2/files/0x0003000000019d7a-1226.dat aspack_v212_v242 behavioral2/files/0x0003000000019d78-1348.dat aspack_v212_v242 behavioral2/files/0x0004000000019d74-1382.dat aspack_v212_v242 behavioral2/files/0x000300000001b773-1805.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3840 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe patcher.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5868 2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 3840 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_1589fe008c9e614b51c6c47307c875a5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5868
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 774KB
- SHA256 f6121981132f31ff0fc894002e5940b5f87b80dab2623bd18dee5f0554e77e32
- MD5 1589fe008c9e614b51c6c47307c875a5
- SHA1 28d4a33bd3fda36463fb8bbdf2d3e108eddb8064
- SHA512 d41a3e8141227e0e8cf37a0179edd45fd6091f3255e1979b236a08470b440246564746390522c72ee176a2fbaefbc89b3eedf257e0f010cbf98b268fb8bbe73f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L88:A3mnXoZjzyacNVOE/ZxUi9zy8
- TLSH T160F4AE17E7A110F9D11A823499E64A22FB75BC621760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$
- Size 889KB
- SHA256 7d431432c5f31eee23ebf39155e687a0322152de04257a3f3dd0e5bb3538b25d
- MD5 65a00847b90d2841d0a61ba0ddc7dcb7
- SHA1 8a4a5e021b9991cf85c8179aad5f49b392ee167d
- SHA512 00e0f10c52fc8c5f738a8a26ebee521869307291ff7479b8c76143b731cb937cc2d0751e28bafe7ec6e94f75b47a89d23738be29a3028b0caf65adb63e1d6f01
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8cnRpAr4svndNIaUnE:A3mnXoZjzyacNVOE/ZxUi9zycTjE
- TLSH T1A415AE17E7A120F9E116823499E54A12FB75BC72176097EF236882252F237D06F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 32847737f7647da20c2c0d90c1153d3142d80f67a017613c3fd0b205102a3039
- MD5 70a8d39c1aaff1c28175f98592cadb50
- SHA1 e8dbdf0a50fc80933466e8a6699f7fd224ae6351
- SHA512 75ade5191aac44602c9716f0e89537041b67b689cad373b8ba700f88e290b73afd053f385d4964c033f60566ddb085757675c4ac14b95dffc4ac8882596e6918
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUi9zyE0Le5ji0hmxNrM:A3kMKPPji0Aj
- TLSH T1BB556B17F6A442B5D033C179C9D29A5AEB7134521B308ACF1399C7282F27BE19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 789KB
- SHA256 579ab8f54e10f6124ae5065d76b6608498fc1185866d84b3e6df31173b1918cd
- MD5 24289619ace0b432056a3c1ae569a1c3
- SHA1 6a3dd7213504a3a8f77227e27483a6cf229169c7
- SHA512 de453ddc2cb83e379d5d611dd97c389e8b9f23136ea4009de1fe7c2232df4bf2a2e2163149a12b2898ce8ebd9b1388719c7b88ccddd971254df9557f258119ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8ua:A3mnXoZjzyacNVOE/ZxUi9zyua
- TLSH T15105AE17E7A110F9E11A813499E64A22FB75BC621760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 822KB
- SHA256 525d9c3ba2a92bac5d75250beaccf07e2fdf614a3fe3d9ce92a166fa26715006
- MD5 666f7404f579d9454ce5cb29821f3d5b
- SHA1 8420aa943e626dd75f4806affa45fb9fee1c5a05
- SHA512 15bb95bb8039af88c9ae7f3ed5dac74dd189f989b7e2eb3f0d789164b44f8f153c83693a8e3157566eaa1f75bf25b1312f8b483e79a1ec2e5e8c0dd13c392594
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8tb:A3mnXoZjzyacNVOE/ZxUi9zytb
- TLSH T12005AF13E7A110F9E51A823499E54A12FB75BC671B60C6DF236882252F637C06F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 798KB
- SHA256 5089478155d2b4958530d9b78f7e5788cace3ed7fe59b9504e758b826f6c148a
- MD5 ec0fb5246f18f69044f465729f080e9f
- SHA1 256eb28e085785d1a8e204218da05a6a1905c4cd
- SHA512 a5a67813ff2dddde04ec70a63c4d8327ab060ae6644293bf58eca704ed8c104f417e0c65d851433146cc593f5d97cc980d49e65f1408ea305e7325bc193d7003
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8wZ:A3mnXoZjzyacNVOE/ZxUi9zywZ
- TLSH T15E05AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 798KB
- SHA256 7d472ee471b74cac32d0030d2f69e345e4dc6340bfdcffa180c1d0cbe45474d7
- MD5 77abaa475ced1d0d3bc41b07f28b8066
- SHA1 2ff8a6a9329410004df40eabddaa42cefeb77bdd
- SHA512 daa9cff39cd932642867b68a888d70a53a49e416dc7137dc667eff513ba981f6b2fc88040a40f217f696a8ef501aad250124ce30ba341c2e130cbfd635bcb6cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8X1:A3mnXoZjzyacNVOE/ZxUi9zyX1
- TLSH T19A05AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 798KB
- SHA256 a7abbe996faf253de216638c07831a9139297f8f752c32cc2ebdfc94185428f6
- MD5 78e948c15fb2ce436f43b867df6f447b
- SHA1 d264c430890997da57161163e8cd011aec759483
- SHA512 bce703f9eaf6527a5f2b01ecf9c61e8330ad8ab6d44a692d2230cf5b5612db8960725e881d66da2cdf68676df2ea42492cffbddd202e772448ee6ab27899920b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8P6:A3mnXoZjzyacNVOE/ZxUi9zyP6
- TLSH T12B05AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 798KB
- SHA256 7ae6b7d2242ec626f1a6019660621428f5c466a0916eb4b279a88829ef5b0eab
- MD5 b632c3b75a7e5dd5794a4c5af32e261f
- SHA1 bbb99f5d3defc7117afe6754e58fe8c995ee6e73
- SHA512 ade38205c45de8f202ab33d860eb6ef745c43ec2661642ac851e125bea74f786c818239ca84c38418ac3d8abcbd1b1b9650f22efc0147efaf0af5eb28e92804d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8Jo:A3mnXoZjzyacNVOE/ZxUi9zyJo
- TLSH T12305AE17E7A114F9E11A813499E60A22FB75BC621760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 798KB
- SHA256 afc4c274e5f5a93ea48b8b219105be5ff1a5eefebdf35ef884f0895dcbf0f4bd
- MD5 9c0b4ab2d58884de4fac5d62a13777ba
- SHA1 47b5d616135c4b8116d2934a4abc530096a998a0
- SHA512 1d437c568d4cfc4927f6f34459aed783c001b3e80a1ea882f3d55bc83cb844e94f952465df8ec1e45c3434c0ad717bb495071ea6979d16dde8e9d1d576dfef6f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L85u:A3mnXoZjzyacNVOE/ZxUi9zy5u
- TLSH T1F705AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 936KB
- SHA256 6db7c94aeddb0f26b896da00d008fa4ac98c80f28dc6b1c0a2a1542db0e531d8
- MD5 1b95f6c1d089b0820d59d1bde064b060
- SHA1 d51ab25cd3f95dba01ed4cf2fd9721c4d2d7474b
- SHA512 ff178cb0d97f7d77c9419eb72624218ca0b9a3a9734daca2406e1b05169affbbe5bfb945ea7c473fe4f080b5e108d1098174b7a7fad7b3c1f4561b747aa1cb11
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8WyPz5L88:A3mnXoZjzyacNVOE/ZxUi9zyrzy8
- TLSH T1FC159E17E7A120F9D116823499E61A12FB75B8761760C6DF236883262F237D06F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 798KB
- SHA256 5cc1b95ffe640f338810598c7e6a58806e7f991583f975d369e76a6b2b81cc40
- MD5 45bd83b0e63d4646436fd04097fe243d
- SHA1 f30478cbc91bf08c4ec8a6bdfa2858742967af2f
- SHA512 16feb19754a59cfa684fb45d9c90427cc325bba40f4e6c5f95c853ac901ba1401e340723155cf6f98f344f4bf83365a5df2d390422680976099734cf02dadd42
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8jF:A3mnXoZjzyacNVOE/ZxUi9zyjF
- TLSH T1B605AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 798KB
- SHA256 f3494eba658dfbbe7eef34af585f83c57fe472014ac8e6719f14152d011554d3
- MD5 b20f30bc2198643889912a00fc7c851c
- SHA1 bf3d80ddacd1596a3abbcc8cf8ce900f9dea3ecb
- SHA512 67b2dd99b3e79b572a834b464a31563104ff48a9d029e8e138e2336ef2d9b37b2c0cea79271436aef50f6363a6647ee1889a8d2c1e2a7a87b8731d9807e6226a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8Yj:A3mnXoZjzyacNVOE/ZxUi9zyYj
- TLSH T11005AE13E7A114F9D11A813499E60A22FB75BC661B60C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
- Size 923KB
- SHA256 dadfff5d9d97c7cbd85b44c1752bf3ca2ef69a3d23bf2d0642857580ce3fbe08
- MD5 84918049391626de643002d34321f28d
- SHA1 4ea1c73d3cb613761fd113dc69e465a900cf922f
- SHA512 65e6d89f973b37780be0a7ba7b31537344f4ea538913457222193378d43c0cfdd9895947fa8099aeee195e3f03324aceeb90c929478044f3d0bc1a9ad475181f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8tnc3/BHdBdi:A3mnXoZjzyacNVOE/ZxUi9zyoHdfi
- TLSH T15B158E03A7A510F9E426C13499D14612FB75BC661760DBDF236882262F737D0AF3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 798KB
- SHA256 9010dfc291aa1890667737126ec577b436d95af17eb25e4355ad920d3fe5b06d
- MD5 e98172b95e09359e21bd153440a1a156
- SHA1 84a340136ababd00d243fd8c8f15646cebc34db8
- SHA512 1965966456d3420f9ee362a42d1fef006f53a4fa9d721e837accb5e271fb7e25f1c18cb799e08a767e479b1fdc48c1e78c0fc4a78d9ac53d4493603e3b3f0e7d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L867H:A3mnXoZjzyacNVOE/ZxUi9zy6D
- TLSH T1AB05AE13E7A114F9D11A823499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 798KB
- SHA256 ead568f8bae643922898208337def60ee89107ac0614970aab1be233db8b2b9c
- MD5 d0c1d64b05aca1ec55ec558d1b725ffe
- SHA1 9a58d5b77372d068647ce0f57a3e6a25c83ed8b3
- SHA512 1d4caf0ccff2b6d22f5d60597af7cf4481af336396da522830938b7c2109528d3a3521df7b38baa451f6fbe4bd98b192dba989cac4d03064549837250f2a6fb9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L86d:A3mnXoZjzyacNVOE/ZxUi9zy6d
- TLSH T11605AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 798KB
- SHA256 35dcc8168cbb2661e59f427f830193222e833644807aabb80863e8c127bfbc08
- MD5 08c4481d66389dbf501f4259b970924b
- SHA1 2a271492a6f857983a74624c021fd052dcf9a0cd
- SHA512 803d095b5e3703ee44e7536ffc7b489850814b2356f297d9e66980fb9c58e55addccd54327081967d868f20ca25e759845d19d5bb6bc0e0bcb34b3af2b5afccc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8aM:A3mnXoZjzyacNVOE/ZxUi9zyaM
- TLSH T17005AE13E7A114F9D11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 798KB
- SHA256 1c32529bcac874b5c124fa9c5907e55ca19b01b1aa515272734c84cf343f388a
- MD5 be43bd1e521aad3d7dbf20a123e2f06b
- SHA1 0b10d0d25fba6bda80d0bba31adb32b187acf75c
- SHA512 41022dd6b5bc1eeac633ff5e655ee8caf19fbb3a3cef4460ab75763014cfddb9becc8f0c4118e266e936a2db3891aafbb4aedfb87e4b5cd868ca3592c0a4b66b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8XW:A3mnXoZjzyacNVOE/ZxUi9zyXW
- TLSH T16A05AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 798KB
- SHA256 19165842be3084e6a4794d65caf380ef151245e573882257c50038dc6c8995c8
- MD5 364e3090dd067f1ed90c4330c1b71c7f
- SHA1 deb7825b9a4534409f318b05cc61debe4573352d
- SHA512 cb7f5af2cd539235ec80cc30ef18b56022785f67278dfbb29eccde2f61f969b25dfc6caf8aad47a3c5139ca76a52a4dfd2366383857bf0164b19cce83948d658
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8S93:A3mnXoZjzyacNVOE/ZxUi9zyS93
- TLSH T14205AE17E7A114F9E11A813499E60A22FB75BC621760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 798KB
- SHA256 84ba54c3441f35d322157f383cb84a88ec7f0709d1c77e969f0ea13b3c3a8648
- MD5 9455897042a0201217ac5894f3461d71
- SHA1 5516d357283d81117067b64db1141b59cdec46b0
- SHA512 ec1e557b5a63ba63f9b64fd5940d208f35e2aa5920ed806217a919c8fa4425087c5ce38521da285aabbb7fa0e6c9720434a3a39055efff145073fedbac08c3de
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L80/:A3mnXoZjzyacNVOE/ZxUi9zy0/
- TLSH T1AF05AE13E7A114F9D11A813499E60A22FB75BC621760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 798KB
- SHA256 ec0e0b5373136f676086054cdcc61c83d05fb373d45c8a69a16280c4b38cff39
- MD5 b283e2232db36c52dbc045e81bba20e1
- SHA1 2b8647cce4ec6f55c0f3274e99d70afd195971b0
- SHA512 754ad0a6181d731594e846bc6360146a5de6e1640742d987f91f171c0575a2a1b57079e119ceeb89433559f83e038992d8e9b7ee6ae06e24cc1661354d874f07
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8ca:A3mnXoZjzyacNVOE/ZxUi9zyca
- TLSH T13105AE13E7A114F9E116823499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 798KB
- SHA256 07b928bc3bd7f9091795fe03b51604b5b9ef670d9f3b1520c858f72384dc414d
- MD5 3be00d670526cef8641f375d85c4da90
- SHA1 df1906e417032f6eaac5794068132ab677658a80
- SHA512 4c9b93d678519f4397594780508497d9194f5a2f38293b2e795ba60ccfb16282026e7df8969e95521a01cf388ac965b22c5ac91d049fe2b8cc5d2b28229bf5f4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8kj:A3mnXoZjzyacNVOE/ZxUi9zykj
- TLSH T17605AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 798KB
- SHA256 bc1a0fccc06a04039295e6d20d08a560672bab96133eceb2bb29a7e10b2c3d01
- MD5 75e53401411bb2b79a2e4a024e416bc2
- SHA1 6dfa2291ece85b5fc4f42293c9931b4c97d43b7f
- SHA512 9542de1afe58cd5cb3db6728babc4113a60036496c5db7d396ad9cea8f5ab6a727deb3a9288ebe51eaefabbbe153ef1c35f959f46ae12cc1558ab86e9ad618e2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8JQ:A3mnXoZjzyacNVOE/ZxUi9zyJQ
- TLSH T10505AE13E7A114F9E116823499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 798KB
- SHA256 c4225b9fb7f399b5b0cde0487e4d6acf429f73c619f5455f8ac5ee3df44a2ecc
- MD5 8a1d5c215d009a3d25420ed0350ee45b
- SHA1 e1532adf144afa960941f5997f9af7952f7d52d0
- SHA512 419fdc232c9966b263963517d7ebe7c8a5fca4ba1834860a6d59aa9d23e5fca20f65d7d6f0d9cd28c9faef53167434ee451ef9194feb30b06e8b74bbbbcb6a98
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8oi:A3mnXoZjzyacNVOE/ZxUi9zyoi
- TLSH T15505AE17E7A114F9E11A813499E60A22FB75BC621760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
- Size 872KB
- SHA256 fbe21de74acc5f0af32981711e50577460c44e465c0ff136f073b583d7ecd703
- MD5 950ae5e76a5b6d2f75d452bebe7a145a
- SHA1 be1db6f7c057a872c289c7d144f0af02b9b6f7d0
- SHA512 749d62a1ffd118d2619213bbb5ccf456b01e16638685e9851789e7f26223b1d592c0a479ed7bf2126aa89620735de2278e7215454cef072a531e8a9e86f4f0a8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8YQYfgHa9:A3mnXoZjzyacNVOE/ZxUi9zyuf2a9
- TLSH T149158E13A7E110F9E127C23499E54612EB75BC621760DBDF235882252F627D0AF3EBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 798KB
- SHA256 83b16d3da070b217478a37e6ed410cef3a40f75a6069eb3764b56fbfcac9c8dc
- MD5 972b3746d6223edc4cc4597a6796351f
- SHA1 6af87a81c7f83d7d9e43b8c085928716148d823b
- SHA512 4a6653e916acfcfe503650ae7b2cda48fdb71b8601ac68c9151eaf46638b4a08c5f9211ac5e8f528a1c3a67652fe1cd66c0bfab1e4fe30a687f73709da96af49
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8C9:A3mnXoZjzyacNVOE/ZxUi9zyC9
- TLSH T1EC05AE13E7A114F9E11A813499E60A22FB75BC661760C6DF236882252F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 808KB
- SHA256 2c9fb266a7c9e91bf1a00df76329fd7779630451f27b592636dcb7bcab93d8ce
- MD5 cd5925ce69a9cdb463ef97b75f80bed3
- SHA1 c781ea1d19a20798dcee9ac72144f9de8ea6c645
- SHA512 162b60bd2f1008d59148ec01eab46efe7862d0a5c245dff26d97b12cbfe4f8231dd5fda6fa263d42cf13e5b9c582dd183a416f562ca4fb4a1d9730fe68b88e31
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8l1:A3mnXoZjzyacNVOE/ZxUi9zyl1
- TLSH T1AC05AE17E7A110F9E116813499E65A22FB75BC621B60C6DF236882252F637C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 850KB
- SHA256 929994808e1c41ed77bdfb13c474e67fb4f2891f540c209c7c6056d4c2204e4e
- MD5 1516392f931ef51aacc99ea877532f94
- SHA1 fbbc8a922a7d905f5ae25dc443b0bfc47efbb470
- SHA512 b230a98040a95331f42ce2fdf11d80c7f9c7ffcc8f47197148d466cef5c5200be74ad5ab3abc70d95ece96e3e76ec96fc8f77d9910610cd528c879eaa3eb85c5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8OKHkUl:A3mnXoZjzyacNVOE/ZxUi9zylkUl
- TLSH T1DA059D07E7A110F9D4168134D9A55A32FB75BC621B60D6DF2368E2252F32BC06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 818KB
- SHA256 a69a45114bb60e4195ad2985b3a017e716f63f94daf37985904410ca607d4eb0
- MD5 a9cddcaf2a6a3a19302d138e3e7b1331
- SHA1 a4c005ac8c4d27940ca709d1b78a8a73034c16f7
- SHA512 aaf196728ca12e9c91b2af1f41dbcee94ac633b410cf275b5b71174c05e62db5d02cc33c4b22f5f68e059bf6b5baf48bf83d93ad6106da57b046a919225b6b08
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8twZi:A3mnXoZjzyacNVOE/ZxUi9zytwE
- TLSH T1F505AE17E7A110F9E016813499E55A22FB75B8631B6086DF2368C2262F637D07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 829KB
- SHA256 e923e731d5be770f26b329c42088b720cb9cfad3f8236d6dcd48f350b2ffc370
- MD5 76baa96df97fcb965e322f342d021cb8
- SHA1 6ffd0bc8c23dd882bbd339fbfdd79b454dcab6bf
- SHA512 28ba9620a8ac22ec1b655e8735fe8a453ecc19599d1598d46e7a8ac6e7869178ec25fc08abcbbb27b35cb61740730bc6332d85de9bbd2ac8e86012e91201b6be
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8y2+:A3mnXoZjzyacNVOE/ZxUi9zyy2+
- TLSH T16705AE17E7A114F9D016823499E54A22FB75BC671B6086DF236882362F637C06F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 836KB
- SHA256 fae8b4764e1100a76b43e149123c5f12ea5ff7817790465aceda1c0dd03ffc4f
- MD5 3485f44bfd803ba8e52794993babab60
- SHA1 ed76f64fc0aa2f0a067eaa4e5946d44844a03a1a
- SHA512 3e2f873409d1a7246cd6100a5b4d8183aef7ba643be392f98a81fdd3041f9edb6369d5715dd0a68543f2a31bc730c243e6b7611e21e0f193e40825163a0c389b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8w6:A3mnXoZjzyacNVOE/ZxUi9zyt
- TLSH T15D057C13E69014E5D116913099994A12EB75F82E176086DF277C8F212F26BF07F3EBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 854KB
- SHA256 fc59ef00880372be812c414101387a47d34d0092082b861308e2b04391344173
- MD5 e8e71e4a3c8b74c700385b80476969bf
- SHA1 b600a4b272121a45751c3a0a7be71361e3662dd1
- SHA512 8c45e431530ead03d95b01facd44dd134b48020084f915af88f511f2cdb7d4e6094efc60a7dab54f3a60c23518b42a5e8d127b9a075b80103c8eb436c1fbb7ee
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8WF:A3mnXoZjzyacNVOE/ZxUi9zyWF
- TLSH T1E9058D03E6D110E5D6568130DD964A12FB75BDA21B608AFF2368B7252F327C07F3A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH