Analysis
- max time kernel
109s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 23:28
Behavioral task
behavioral1
Sample
2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 739KB
- Sample260707-3gfpvsfz4x
- SHA256 ef22482c6458f055cce2ae26215a14bdc3ffecb7aa8c54714cb43b092093c951
- MD5 33b624049cc94727e37fc046ea93e8b4
- SHA1 626582e8830e52c2247ea137b1423369dac4dc58
- SHA512 04f7d99c6c5e71af1436cc9881e9c5e3469255c9d28c492986b7ee327ff9d3435ecda7694c7eb3f7b44ea158d683079237b18010e8d2cf4e1bf4eefec7348b6c
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyS:A3mnXoZ643mnXoZ6KoZM9zFVSOS
- TLSH T11AF4AE17F78104F8D40AC1798A599A32E671BC550730E6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/5768-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c529-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b30a-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5768-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/716-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c97-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019857-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a6a-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-410.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-477.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001898d-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-675.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-829.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-960.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1015.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1058.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1071.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1120.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1145.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1358.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1404.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1405.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1406.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c529-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b30a-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b316-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c97-60.dat aspack_v212_v242 behavioral2/files/0x0004000000019857-228.dat aspack_v212_v242 behavioral2/files/0x0006000000018a6a-265.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-410.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-477.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-503.dat aspack_v212_v242 behavioral2/files/0x000400000001898d-601.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-632.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-675.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-749.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-829.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-901.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-940.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-959.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-960.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1015.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1058.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1071.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1120.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1145.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1170.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1184.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1192.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1229.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1332.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1345.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1358.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1383.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1384.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1391.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1404.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1405.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1406.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 716 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5768 2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 716 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_33b624049cc94727e37fc046ea93e8b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5768
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:716
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 739KB
- SHA256 ef22482c6458f055cce2ae26215a14bdc3ffecb7aa8c54714cb43b092093c951
- MD5 33b624049cc94727e37fc046ea93e8b4
- SHA1 626582e8830e52c2247ea137b1423369dac4dc58
- SHA512 04f7d99c6c5e71af1436cc9881e9c5e3469255c9d28c492986b7ee327ff9d3435ecda7694c7eb3f7b44ea158d683079237b18010e8d2cf4e1bf4eefec7348b6c
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyS:A3mnXoZ643mnXoZ6KoZM9zFVSOS
- TLSH T11AF4AE17F78104F8D40AC1798A599A32E671BC550730E6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 f162383dd72527f0252a7e7904f5952362c53d9f046ff7d02a1a3b076f5d2920
- MD5 5842b77fca91b94fbf29e26467d3aa28
- SHA1 a451cf8d7355663226e81eca64e70b2587dbc7e0
- SHA512 f21e3f3f79bdb1fbea0f245912d22637514517bd62c0d8f2539f35766907a82f7438e21d0f341a2b5c7ae7b1f158704865ff361c6987ca96ebb73324af2c70f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6KoZM9zFVSOS0Le5ji0hmxNrM:A3k03kfZM9zfePji0Aj
- TLSH T108557D16F6A442B5D063C079CAD29A6AEA7138450730CACF0395D7293F77BE19A3E731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 754KB
- SHA256 fa9a0f3730a04a45b050382babb0ca5ee9da9247d9c31dda70ea170cafcddab3
- MD5 43101c8db7ed84b014e6b11dced77763
- SHA1 b6494eb613d049005e1560112480d4bd6baa7c41
- SHA512 c83db3fd0a80a1b8771edf196e8560232ee1224f441a36cfe66f5a04085bebcad023d093da68cd9582b6f3364a5666bd6b82613ad9379ce3876b7e6b83cd5a06
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy8a:A3mnXoZ643mnXoZ6KoZM9zFVSO8a
- TLSH T15EF4AE17F78100F8D40AC1798A5A9A32E671BC550730E6DF13A4A6163F73BE06B3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 787KB
- SHA256 91921b10309ac7cb10f440f78e305c532a868d66df4af734dfaaabd1e451fd6d
- MD5 ca83a3b09e8748598c822bf599d1651e
- SHA1 ae0a5a41f0d43c732849bac036d4eb4e6083160b
- SHA512 3f63d4a81c6229d59f2c31497baeefe2eaccd007927c249595ea8a593974a7d4aa7b9dfcc7919c7ae5c788a9e85d52e04db611c3d5d0aad1b6f7981e21f34127
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy3b:A3mnXoZ643mnXoZ6KoZM9zFVSO3b
- TLSH T1FD05AE13F78000F8D45AC1388AA99A32E671BC551730D6DF13A8A6163F73BE06B3EB55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 763KB
- SHA256 f55fea6a99d7cc715336de3e83bbf81574649cdfc724b3c0f34f7033b0f32933
- MD5 052a2cfbc448c90501432bb5e4ab844b
- SHA1 209ca2332298f82b2cd531a7679b469ca998edee
- SHA512 06a7a37a2ec15071cc1394e1b96603e88973b1f252956486abfd78d9b4f0c7a91f0bb8825a243932ec4b3fdfafe8162fb936a660b9557853d98b6bb36728bbcb
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy16:A3mnXoZ643mnXoZ6KoZM9zFVSO16
- TLSH T103F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 763KB
- SHA256 f769fa857a8c8ce97b52fb3079e160b188ee42155d8aafd6a60f6c2796a9e3ca
- MD5 6eb4d32d85bf1d8a6787b838af93ee01
- SHA1 7ee20492c5b485fa0a57e86773da6141294b860d
- SHA512 14d4880a3c599f81c35a8738aca430ca1b77b3b8911d7f432ef57cf0ec178be406c76b8d95f4e438eeec1222af3620012394f0ba7f3ebff4bc0a13defc1fd096
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyJf:A3mnXoZ643mnXoZ6KoZM9zFVSOJf
- TLSH T14DF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 901KB
- SHA256 878db0dfbd1399c33d9f0580fc017603e56d9fd7e34c30201798dec99cc1f683
- MD5 43e574ad879f8f46321479c484fe088f
- SHA1 33f9ff5ccce7ea6d824b3545cc8f3d809fdbec52
- SHA512 6bab3c56730ac6823ddd4f46669c6df144a1e3b06c23bd14693b0b3cc3d7253e9a2f55c3038a5a6fdc615f81e1c13fc8e6029bf1213a50ec0095d5085685089e
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvydyPz5L87:A3mnXoZ643mnXoZ6KoZM9zFVSOUzy7
- TLSH T134159D17F39110F8D41AC1398A969A22E771BC650730D6DF13A4A6262F73BE06F3EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 763KB
- SHA256 482ce6bb6963efacc228c2fac5ca2b6a0c347143458661440db9c124d97dd899
- MD5 e2dcdc07a20fbdf5c44111532845e089
- SHA1 8ccd75c2d7a7a19749d23c7a22381a8d238296ea
- SHA512 5c4343f195ae50397e6e17ea28e073c44c31ac33fc21e4fb4492a78246b870acab1fd1c7d5e5c1421c2457135008952d34f4620458ff1ee3d8fa15db99076a3e
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyLo:A3mnXoZ643mnXoZ6KoZM9zFVSOLo
- TLSH T119F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 763KB
- SHA256 69fd8feedc2a8b8b52bbfe3a65d42e12b7c120a12aace40535346f435c229afa
- MD5 dcb8cd5454f2a5a9f5d18c0617647386
- SHA1 22a94e1d9cddd0dac7f523213102705b4d07d07c
- SHA512 f4b81f9f6716316cfbcceee2d30857239abfb569d1f64caafd547cfb2bab2d5031d93216f6627c13837eae970f791b3121b5c9f14c254048ea45d747e1264df7
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy/u:A3mnXoZ643mnXoZ6KoZM9zFVSO/u
- TLSH T10AF4AE17F78104F8D40AC1798A599A32E671BC550730E6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 901KB
- SHA256 87c53457b0b548d8b2ce412e38110a5dc300ac80f8ab852c06aa1a3abfed77fc
- MD5 9d4f25c1345343db504fdd57fa8c0e0c
- SHA1 96c599dbca3e821f2b89729e4008ca15fca41e2d
- SHA512 eb785207f0ede7c8b97882526b82012877c48766754422ba6a31ab685e3f8e33193d9b1cfc5cf0552225bcabd9ccd60071da99503939781921a74ade63f9e5ab
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy8yPz5L88:A3mnXoZ643mnXoZ6KoZM9zFVSOlzy8
- TLSH T1B6159D17F39110F8D41AC1398A969A22E771BC650730D6DF13A4A6262F73BE06F3EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 763KB
- SHA256 062bc42d3fbef76735f1de5725c14edaaa5a884c1e85c3185a65b80d5d7d82cb
- MD5 3cd0474b489050031a8975f92f97698c
- SHA1 97a291bb866a5125f26c294f4c1678fb481c8901
- SHA512 e8d92c206c6b4af38c16dba65393a777d671f970c91bb2411a71ce921152bdb82a0f420489bc71301f8981809075a7d557b2d5d4e639e0dcdf5e6a3d5b170f9e
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyN9:A3mnXoZ643mnXoZ6KoZM9zFVSON9
- TLSH T1DFF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 763KB
- SHA256 98fe1663dffc9bd664f1b47f9d846c6a24b42fa88d9a458bff86b42b5264e0ee
- MD5 4cf9a4cf61b38b0c7b74f5d6879dd203
- SHA1 215ac6e7a1ba66b6c974252ee0f0430ba4beb1d6
- SHA512 39a29bb1709fb7f689132833bf51a8777fe9eacd36352a814ba5c460ffbea1a000704a43fc4218231842c54e2b69ed4c7f29e2bc20f1e6268b6d6f03cee194d9
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvypc:A3mnXoZ643mnXoZ6KoZM9zFVSOpc
- TLSH T150F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 763KB
- SHA256 eb8a69ae3f77e32a1469f501fb787a6ae53c187df2aa337ce9355b9c97556c82
- MD5 97ad118c2868c493179ea8ee7a982143
- SHA1 e651e0a0b6e7dc2de51088d4d620b8c9f43b9bd0
- SHA512 c401eadee62925a2a3835303b789dd736c7d7eb34dc56d233069bf5a3ebd461915644fc8508cba9041309195d1e23e66dd7ef15d032c5802d6bb75a6cf53a9fa
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyip:A3mnXoZ643mnXoZ6KoZM9zFVSOip
- TLSH T1D1F4AE17F78104F8D40AC1798A599A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 763KB
- SHA256 a757dc53f402a007b74b3cc27a048c100e6978e717aa89332a1016cce9ace529
- MD5 67f06147caea65a7ae22880c2533c524
- SHA1 71302231a6e49a438055fef45bbbeb9e6edce320
- SHA512 1610a29d7a37574f6839425670220c19beb6e2dfb646d453ac0a4efdc4f5abacfd5a0968b7b123acb2310060b163849494f70bcc5ab473dc023e125212f644e7
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy10a:A3mnXoZ643mnXoZ6KoZM9zFVSO1N
- TLSH T17AF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 763KB
- SHA256 7dc2925d623ee43c421d86c4c5c3a62f7fd7855b66979fb49f4c1a0c488be1a9
- MD5 c5a8a1e3a2e4c602e657a68de0e6baa2
- SHA1 add07d0684d2b0f283a72d4c931c8867c9215374
- SHA512 df66579ed0f221d10af1c676065609e1a0745d0e65581e9923496cbd2c3c582bef56a154777403ba45e7517ff939f238935c2418c9ec3ae15709d4b12521d13b
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyHF:A3mnXoZ643mnXoZ6KoZM9zFVSOHF
- TLSH T1A4F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 763KB
- SHA256 cefd436be05b1ba5b6853ddbe599775f34525ce9d970eab2aa40319e95eed0b4
- MD5 3386d401ffb0924fc5ab5b9ea151b7dc
- SHA1 6a56053b76df73bda09c346126263584371ebe64
- SHA512 fc23e285d03235c75f6c47de17c46f5bc3a4ef3439c240f93eb72df19f5081391e1fedaed79ee9f77383fa9afbe4ba3cff0afdd8e3b5d0085bf22febf11496bc
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyYC:A3mnXoZ643mnXoZ6KoZM9zFVSOYC
- TLSH T167F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 763KB
- SHA256 73ad58a91329dd8a6eded6ab8d4a6b444c2be8c2b73fbb891d28015f3e6952f0
- MD5 d39346577500a2fbdb3ca9fd0083482a
- SHA1 69844028cda185dc702c5bc52b82de2bcdd34a5e
- SHA512 1bbba8ea17cff66bf39fe3fb9563b1efb383ab5e002b18589a1bbf9bbcafe9c6ca539fec23e7d42578b61b57ca436ef7c1d3534d2819ab9e3477fc4c0d6bb67a
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyLw:A3mnXoZ643mnXoZ6KoZM9zFVSOLw
- TLSH T155F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 763KB
- SHA256 46e514b2eefd3deaf928575cd5242d302838253380a8b12f7e097f8a1ab9d748
- MD5 c749b472e8a606e7e90b465227de7b2d
- SHA1 200036334799868886a2dead61d03ba814335cf8
- SHA512 d55f11288e02810f96daaa723dd9e61c4973c92e714560453f315ad6ce960b7ef33897cd1a0947ed19642e990c7223152961556c774776175cf84e55ee6d29f1
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyST:A3mnXoZ643mnXoZ6KoZM9zFVSOST
- TLSH T17AF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 763KB
- SHA256 2e3b1bd7f57b88d2dba7e7079c6ab047fa48c6817739add173a387b0c4d84af1
- MD5 39ab8cd1e7b6f208a10c78fba7503595
- SHA1 b0fe450cb3ed9901aa2be6392eed4e22075fefbe
- SHA512 ad94b015508c8b7b76aa84b95301b98ebb325b68e49e30ccf92718d32b6981d0cb3e9eaf708930e6f338d8c315ded3cc6bfddf9ffe24d5a6663bf331e3fae628
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyiu:A3mnXoZ643mnXoZ6KoZM9zFVSOiu
- TLSH T138F4AE17F78104F8D40AC1798A599A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 763KB
- SHA256 86672bc4997c7931a722e480f2925299b7b76a224e6ad5fdf12089117547d03c
- MD5 6ba14a27e2d40e4783b20141f371d5ab
- SHA1 a3b1025f0b4b25366ecbc9e5713a3e68524faf74
- SHA512 3b3b84e127c0e842c34a6aad154a129c4d1f48c06e2d34dede559cab7a26a45fe02cc309c3c041ab45df1efa372ff7364cb1e48e799cc5ac16b056d3799fb1eb
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvycb:A3mnXoZ643mnXoZ6KoZM9zFVSOcb
- TLSH T135F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 763KB
- SHA256 8b62898adf95ebe9dec92833e6a015dcef58d168649b49b8adb52b2a5b0f276a
- MD5 b08e0136a7e4a67e1c2428c12f64e506
- SHA1 22e52a50365f3271543afd3c0410d6c5ba822160
- SHA512 3762ed71823549951181e0928e1a0bdc82c524a92fe539819b4b2d35d7c50d00136ad098b3f9d2ec82c4af8f095391f64af70c81e050e068b18afd4078d10fab
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyCf:A3mnXoZ643mnXoZ6KoZM9zFVSOCf
- TLSH T1E1F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 763KB
- SHA256 bd118492e5327491b99f710ebafb679ca145e5f753f3e16bdc3110212697f3fd
- MD5 b6156e503fe7204ac1da9b03b22a034b
- SHA1 668c7ee20213abde7cde9b99a3b2f4e0f37c635b
- SHA512 df99dfa3322530e9774111ad2d616e9a4adfe0fa7c86edc95d3ff9aeb770b1d9e79c8d84464d8fd63fc9d6f22a58f668ecbd43d0c2d05131fe5d3189b6579809
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyPK:A3mnXoZ643mnXoZ6KoZM9zFVSOPK
- TLSH T12DF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 763KB
- SHA256 53cf784482c6dec2fc4612d13dcd8ebda6d177642ed570080757add90bc02a04
- MD5 b2fea92781c08d8c5ad5125ee49d94bb
- SHA1 e99c9d9ad586e3d587a7104e582ba422fa1e051e
- SHA512 6d4ea7befa626e3b065271b3c42b7205bfb2e95ccd3a6550367d55c961ba1d300e458e7645bf5ff1922430f7071804d950fe4214cbde4a0826692c8049bf1601
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyok:A3mnXoZ643mnXoZ6KoZM9zFVSOok
- TLSH T130F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 763KB
- SHA256 523b53b1c8ba097ed887fb9ee4f6b4506bb33ed293852bd62dceb96cb58a7a2f
- MD5 5068371916465b52cd14630bd7135bd9
- SHA1 9ba9cdfff5f8ae23fdd78ff24f318578eb9840b8
- SHA512 bf59e9e7cdfed6ed990ff253c8a231e79e19d2659ef824b37ac3239cb889b70c15662720e38e65a424e1a5bc43eef8ac1c957a85d01620f6b2615f9f2ec33253
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyJ0:A3mnXoZ643mnXoZ6KoZM9zFVSOJ0
- TLSH T174F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 763KB
- SHA256 7483d7c90fc8ef1d707df783d1b778677f876993b70a70e6b2011c7c3296b136
- MD5 fb1c9aae8fa2df9cb7b15cbff6bec9f1
- SHA1 b540cf78b9d20dbef0d447f2a36f80d5be95bccb
- SHA512 ebcedc6b5cfea25b2a9b95cb721c90cd9244a881db7d986618df1b25894cb70d24976b04f7652292871407df14c618918f458f2f4e72d5b7c67ed6d615e3fec3
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy870:A3mnXoZ643mnXoZ6KoZM9zFVSO8g
- TLSH T173F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 763KB
- SHA256 dc3eeb854dc6a04575e8625591d50e90e36e17b15744acef01abe0e4945882bc
- MD5 6a070201be28cc4d2ead5f10b832bd4b
- SHA1 f304aaeab55be4c6f5d07fcf1e9516cc0d87af84
- SHA512 ddaee8bc8f7e55d7512c7e0ffd883847c0fd852437d7d14dec815b8c31c7da817466d1717331bc757e8984ea4093b638bc0e78ad59de5c69d0edfb9cc0b61edb
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyZr:A3mnXoZ643mnXoZ6KoZM9zFVSOZr
- TLSH T1A6F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 763KB
- SHA256 4130c74a0415ede03808bd02e06c47e9a179177ea23086ee6dff1102f9699d6f
- MD5 25f6d482ba21d214eca62f3601f17424
- SHA1 16582adc340c1097fa71ce85cac94837f1ab11e5
- SHA512 936da8b7494936ec92394f91259183b55c014209c85f0f8717556a8d56fb483eb995f5770c411f0b32efc459835a70a633c42cb3bb637b8645627c686fa28475
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy7n:A3mnXoZ643mnXoZ6KoZM9zFVSO7n
- TLSH T1D6F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 763KB
- SHA256 59885f9fa3cc09cc23a02b55944f226fb76d45a845230c2e2a351e2cfd14e583
- MD5 ff72d4cf490a5295d5cef1b32042527a
- SHA1 620f16b2d7533dbd989f9721bab4748426689034
- SHA512 b99c6a8b11eeefd861a35ad47a33201a8cb6a3339df5d5b00db76c801e86e828b5c2cd48c03f38edee417b0c895658efae17b713f53c18c8e8037d9b0e91687d
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvynx:A3mnXoZ643mnXoZ6KoZM9zFVSOnx
- TLSH T178F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 763KB
- SHA256 93953fe66e2ff4adef66ee249a0f3e5c357a8fa85c10359cf75e4062fcabad42
- MD5 16331795086419779fbba6db2ed65222
- SHA1 6cd550f1c2956c996e8f3c7cea1c8eb5b7b9fd0b
- SHA512 aea88653d60250e7f013ed26ef50a000a9a812d9bd64751b1885512012b66fc1a56072a58398bade6784f5e3e366aabd8beb448af263a80afe1c6d89344da24c
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvydA:A3mnXoZ643mnXoZ6KoZM9zFVSOdA
- TLSH T1D4F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 763KB
- SHA256 8558bc73459912339f314804ace5e36843dd0b17ef86b59466e04983d8647df7
- MD5 8716320cd53fb955254904e0aa9cc622
- SHA1 389bbb8339bb75d959237c40750421e6f56877be
- SHA512 a2f266ff1359fc133283883a445b45c951a4551f63d3c93e3fc44a1ae91e9a96704c893f8b862e976dfdba5355a035a7d0c9290f6e1c8a4d6b9de96a240934b8
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy29Q:A3mnXoZ643mnXoZ6KoZM9zFVSO29Q
- TLSH T13AF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 763KB
- SHA256 bf425e0d0ee0a46b6bee3f992031d36790ca9201671ad6e84784096ba473f66d
- MD5 529b53e5a7a7307155780b3025766cf6
- SHA1 d4e3bc54769ba9504fd581605e16fe6aedc8e4ee
- SHA512 9b478d0189fce463c9b89e1b19f3f74b4e6f1761522e385801719e79e706b1a6e2c2eca032a6d888464779c8667ddd3fcc33dd441794e77913d4a1a895d66e6d
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyz4:A3mnXoZ643mnXoZ6KoZM9zFVSOz4
- TLSH T1FAF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 763KB
- SHA256 690dcea016c9c8ed66753737a9331b4ba2082c7b72491d8183627fffd2c6b766
- MD5 c59cabe0dbf7c31ef24b185725b274f9
- SHA1 cbbb99d7793dfe64cf18a2c11a43bd06d543e305
- SHA512 fd1248cc19da844a05f5a965b5278ba68a19d1f634865d9194f43c96ff0d72e985015ef083db6ced74356412732acfdc7d08a9848a97c7499887a55af56fe310
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy6u:A3mnXoZ643mnXoZ6KoZM9zFVSO6u
- TLSH T167F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 763KB
- SHA256 22161ecbaeee64a5d95a96d770de903f1744d924f4665b254985bb248275acc0
- MD5 c802e6236e83291c65b9dde64e195297
- SHA1 6e9293602db70593e309291d4cf725b6808a8937
- SHA512 b2c3d96bf0cec2c554f27491c90c4d5f434a7cd8160609d5777875935c76d97b3b88989e4136ea9a075301955fa239a0828afd8ac73113f49fd499b17f6b25aa
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyrj:A3mnXoZ643mnXoZ6KoZM9zFVSOrj
- TLSH T1FEF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 763KB
- SHA256 f5638e909f13f4d108f4976b41ea1ba178c3c56f338598d2ffb98a8241dee8c3
- MD5 a5711792947816d3fd7e106b571526f7
- SHA1 ed3938dd13e99c16b5efbb566823870231ddcde0
- SHA512 f8ba0e4ba9a012340d409a1294e2bab2e69e1be1d5cb756d494160e14bb26a37992688b506157608ceb7033fdce4b417505b83eee04a28886745caac97b57ba1
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyWg:A3mnXoZ643mnXoZ6KoZM9zFVSOWg
- TLSH T149F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 763KB
- SHA256 8bf0585c19318d7da66ef1239a5cff127aa439c08b8cf5ba05a33aa8b7964d96
- MD5 429324f9f5618187ccf123a30272f0f3
- SHA1 025ffb4f9ef59cc4c68d7842fe40384ea2051aa6
- SHA512 966bd2778cb62f3f01765daf82b42adace526cd38a1dafb32c15249bcb6dd59cc54daaf6a84f092775016a5d6a256482501732f8a9403d4cf5c1d7fb2f225d42
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyZI:A3mnXoZ643mnXoZ6KoZM9zFVSOZI
- TLSH T15BF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 763KB
- SHA256 1f75c25ecd51463574870015095dd4dae89883fbe19b6b463d652cdf54ed1215
- MD5 b70f1c81c7d17967759fd59368971528
- SHA1 e49ff8046b74d04ab012f456d5cab32dee57203e
- SHA512 0a134082c11c1ff2d3b0d6cb1d7c0887ad0e5fee62ce737dd7b7d6bc0b78a5a82d2cd2d1c8bb3bd52123d8e7b1ff8983a0d85ce1c14c6736112299999c83de6b
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy7o:A3mnXoZ643mnXoZ6KoZM9zFVSO7o
- TLSH T1C1F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 763KB
- SHA256 7aa9930f47699ed28b09f784e2c48c772d8da8576c41cb3d59c7baa48c4e367c
- MD5 f0d957a0f9550e37e80e34075746387a
- SHA1 e76bf354fa5ff51d83ca778795867dcb9b0dab89
- SHA512 1dfcdc83c8a95c5a009d5282d887a42929e96657f2802810673e8e22eef2d49584bce39e8b8043c429216f53625abe90465764aa5b111b93575d1cc3815d3934
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyg+:A3mnXoZ643mnXoZ6KoZM9zFVSOg+
- TLSH T124F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 763KB
- SHA256 e8cea229e606137bbc0ad18ab3e1292b119915d791424c7fa4284814b97a4519
- MD5 d650a75417efbcc199fd3a659b34ac63
- SHA1 9ba2e8dc3307b0e3cf96f7d3f55ebe7866247c12
- SHA512 5c3f623793095b08351fccffb9676ec45a1c54158c4cc4385e982eb31240c7cf828def719b9d6f1d4bbc255159be8a8f27bf2cb916d42bbf1b0bf646f9f0d285
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvy4Q:A3mnXoZ643mnXoZ6KoZM9zFVSO4Q
- TLSH T1FEF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 763KB
- SHA256 c80f50107ece6169274607d9f2a29ff914800191646f61df6509fd27a0db12ea
- MD5 3a444f6c540dac81041dadad867814af
- SHA1 b2199cb2a9d177616836ee7133b78f6f2441954e
- SHA512 98f8a91e14a86cdcb9e2297635a76ad1f57fd3e9f6eedeb01b4ca69196a70e0e037598158e058661eadda00b90c47019c1fd28f10f9b7d43ca96d2ada9ac5c18
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyxX:A3mnXoZ643mnXoZ6KoZM9zFVSOxX
- TLSH T16AF4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 959KB
- SHA256 597cb8fdc211e402802929d6bc5d78179302ef739c369249bf79b06ea61f0895
- MD5 794b12917bb35f04fbb82d43aecc7ea2
- SHA1 634cb8c1ef24a088e2036070a9b096e11651adda
- SHA512 b47cb7800149f940452e9c0bdee0bc4e4b0e383bbd1e590b701684dee4209aa31a25fffc2b6acc2904fd4b1fb505c4162958158f19349bc89aa4df988a978416
- SSDEEP 24576:A3mnXoZ643mnXoZ6KoZM9zFVSOWjCXF7IwZ:A3k03kfZM9zfSC17IwZ
- TLSH T11D25AE17E78104F4C85AC1798A968A33E6B17C150730D6DF5398A6163F33BE06B3EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 763KB
- SHA256 3795f585a1ec7d955874216541035d21b309649de27ed9650911c4d98a778281
- MD5 0c783fa23d97190034cc2e1638f34224
- SHA1 f4378069f9c69625a83b64d5d2a07e6d4d95a3b7
- SHA512 9ebd3eab898af54882ea5f84e2abc2a9502c126322c538374686ba26ce6f1e1e5f0a5a08f0e7a0a361472b99c20eadc617291fdd3be1a6c6149e1843d71cef6e
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyLL:A3mnXoZ643mnXoZ6KoZM9zFVSOLL
- TLSH T1F5F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 763KB
- SHA256 18c67394d75ee7581affbbd9c53b9f3fb4ffe745c1dc8bc9625e8c51883edb76
- MD5 ce2b8b6470c07750a31b94d022f0d878
- SHA1 6b92694db53d2e11eaeef9d4be96229b0f8f2c3c
- SHA512 636123baaa2c1a4d4813cf23497b7b3293a58e0dff60aab959cb929d472ad1ab10e980500d790235205573da869a2ff3d5a57b46befafb01daa99cc31574492e
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyRFC:A3mnXoZ643mnXoZ6KoZM9zFVSORM
- TLSH T1A5F4AE17F78104F8D40AC1798A999A32E671BC550730D6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 763KB
- SHA256 92f0260485538622ab1865945f66259b595923f4156a6a416b542562cdbed0e7
- MD5 5b46ff5f6d95b1d655b665ad208f06fe
- SHA1 6a127cf692db1758874ef7689a959161ec19572a
- SHA512 e9cd67811a1486663775e94a6a93c8fd49051ca35de306670713d11cc387e0ece9db6bda9c927a3b7c76991c8d483285721ad0f16a40eb520349245ae4bb6bfe
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6KliZwb5zzFEoS2cPvyah:A3mnXoZ643mnXoZ6KoZM9zFVSOah
- TLSH T18AF4AE17F78104F8D40AC1798A599A32E671BC550730E6DF13A8A6163F73BE06B3EB94
- MD5 SHA1 SHA512 SSDEEP TLSH