Analysis
- max time kernel
102s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 00:42
Behavioral task
behavioral1
Sample
2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 781KB
- Sample260710-a2edbacw6x
- SHA256 2460719f59ac986b4322cad47efb7f2d5c7775a3d926260bc62d341f3cb1671c
- MD5 756a568620d1c869099150da4867ebee
- SHA1 51529bc70a9ced55de762f90ede5607118a54941
- SHA512 7589c95bc27f62f3db807f114362f0c92312acd226cd0f0fd43dfe5c6710085958527f4de65263f6a130100f8d0c04059d95732ae837fb016785515820181960
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnUaucr0XU3psmeIq:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i1
- TLSH T1D5055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/3296-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c51b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3296-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f9-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4960-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8a-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-303.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e0-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-535.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-719.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-738.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-769.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-825.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-875.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1047.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1066.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1103.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8ad-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8b4-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8ba-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8bc-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c529-1730.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c51b-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f9-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8a-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-303.dat aspack_v212_v242 behavioral2/files/0x00040000000198e0-442.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-491.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-535.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-603.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-719.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-738.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-769.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-825.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-856.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-875.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1010.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1047.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1066.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1103.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1171.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1178.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1185.dat aspack_v212_v242 behavioral2/files/0x000200000001b8ad-1368.dat aspack_v212_v242 behavioral2/files/0x000200000001b8b4-1381.dat aspack_v212_v242 behavioral2/files/0x000200000001b8ba-1394.dat aspack_v212_v242 behavioral2/files/0x000200000001b8bc-1395.dat aspack_v212_v242 behavioral2/files/0x000d00000001c529-1730.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4960 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe - Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3296 2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 4960 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_756a568620d1c869099150da4867ebee_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3296
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 781KB
- SHA256 2460719f59ac986b4322cad47efb7f2d5c7775a3d926260bc62d341f3cb1671c
- MD5 756a568620d1c869099150da4867ebee
- SHA1 51529bc70a9ced55de762f90ede5607118a54941
- SHA512 7589c95bc27f62f3db807f114362f0c92312acd226cd0f0fd43dfe5c6710085958527f4de65263f6a130100f8d0c04059d95732ae837fb016785515820181960
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnUaucr0XU3psmeIq:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i1
- TLSH T1D5055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe
- Size 898KB
- SHA256 375f873868c22af287375047d7a818902a2920dce21043e145664640dd230039
- MD5 750c343c4f9e9963d19baf0d98046064
- SHA1 4c158b08f89126bc9b3bbb812b209d56694277fc
- SHA512 9a4a8bf65e845ce043f22dd3fcd7932b2edd99b2d83a2042d65771027e44be1c7e8555420266a6f203ef74445437f3de1d86cf137bd7112f407d4819f4dd2068
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3izUBUjn8CxoFi:A3mnXoZjzyacNVOE/ZZucyzv7MFi
- TLSH T108154906E69410E9D01E8234DB954612FB77B86217E096DF23D4D23D2F227C0AEFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 b65baf486a37ec60affdfa133c532680f1a6cc19f95c2ad023da0e8ee02721e6
- MD5 e0d72b5c4b00f5d2ca2323a97d055480
- SHA1 f4d3610549c9aa0873b74d9225681fbd7c872e5d
- SHA512 6f1b8ee3571abc78a66d2ee8ef1ecf9905e897686e4345e03963839a6dba5a0fa731875b601ab33a0b5607ef5de9ca3947fa3252a3e8a3388559806aa3e77c86
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZZucyx0Le5ji0hmxNrM:A3kMhFPji0Aj
- TLSH T18F554916E6A402A5D02EC179C7D2965AFA73384217F086CB13D5D63C2F237D19AFA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 795KB
- SHA256 77c1d6d895374eb2246df2832b7468de130a6d5415bd802d6481a7d1b548a8da
- MD5 123780777fb481bc7c2e88378f075d8a
- SHA1 e57980bdbe54efc36f31637e94aef49122e6b07f
- SHA512 82d08d304569d29b1211348a88fc9533231c177e47d950279945a848f50e4aed422b74367d1ba768d7bdeda8d1e04a09ffca97dd65a78ce322803b75caf06673
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iTa:A3mnXoZjzyacNVOE/ZZucyTa
- TLSH T132055907D69400E9D01E8134DBA54612FB77BC6257E092DB23D4E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 828KB
- SHA256 35f81c84df69e169e1f7f4be4f084873244914af0977ff3a5e54ed2d938ffc78
- MD5 ca38396f343e33a4172fd2f600e89960
- SHA1 6b5f2aa86cef8c3b116489c3bb0a689db0f60d85
- SHA512 1217e988715cf9b36be0992872ba64a0bbc045a0fa1fc97275c756ca45ab444e0891751317bd5446416ca6899d62a3fb16c86ea0d2bcad4ebdebe5cb07da752c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iAb:A3mnXoZjzyacNVOE/ZZucyAb
- TLSH T17B055A02D69400A9D01E8234DBA54612FB77BD5617E092DF23D8E23D2F727C06EEA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 804KB
- SHA256 ab328779b1c071e61f2c9de3e7b04f64bec676f86f09539116c1b6792eddf5cb
- MD5 03f1590c4cd33055a877882a89412306
- SHA1 0aa24cc1cdebef15121996eb64d333e4193ee681
- SHA512 0577168ddd52738d858484273c9a061aeec626402f09482f27568258caa95361169f0629ed6ce1e4438a95894bf690970b2d197ec9625bd1c91991999134e89b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ixC:A3mnXoZjzyacNVOE/ZZucyxC
- TLSH T191055907D69400E9D01E8134DB954612FB77BC6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 804KB
- SHA256 ab010ea429ea75ea207e459620af779829cf2180145b1a6a281cbfaaf454bd16
- MD5 44f61f86d6483cf776cb74f25803ced4
- SHA1 f8d78e386070de95c3171467e4d5ac0248ab708e
- SHA512 f41cf7f3c462ed5ab741e166d9c24167eb326b963daf60072e2da08d23fb62b000e3dcff6c9b9b2b135fb56f071cb776ca05787b9926733b90022a4d34f3d918
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iSw:A3mnXoZjzyacNVOE/ZZucySw
- TLSH T12F055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 804KB
- SHA256 c1f4af7457ac8f0336d5d97d6c626518a5b6e77c469f9a637243ffa8dd7a4407
- MD5 cf69bca7335e5fc5d54a8906d3a5b187
- SHA1 92cd065515c0fe249b9e1eec4b264e4cdffb27bf
- SHA512 595df987040cfcb387cc35e69621d44963f4e052e32b3f14c96aea6e395290ecca0fa919dc65e0f680d832b61242ffa595dce709bcd53c40a86d09f15958e53f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iZT:A3mnXoZjzyacNVOE/ZZucyZT
- TLSH T1ED055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 804KB
- SHA256 a18f77c1bbc328a9a7468507caf797f83a327ad2c0da452b266ae1e8b6793291
- MD5 00729a321744f3404e630dac9fcd40c7
- SHA1 491a8b6c84f448b37bba43823491975018c30ac9
- SHA512 8d47d07a4f14b0400b017c699772383ecc3ae13cb49e49712485067b1a798edc09cb9df000f2c5c3763d0784604a418c4898fb164c61a8a352dc6e2c558d69f0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i3u:A3mnXoZjzyacNVOE/ZZucy3u
- TLSH T1E4055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 804KB
- SHA256 941e9b70a21da4f8324ad671608c4556ed6e93cd0a1f3d9c3e53e25bd88b4e85
- MD5 907f0b7b795e5b6a46bafa080ed43d8c
- SHA1 87bff6d4a44fcba1295aef7ac46f5f88c5be0362
- SHA512 f73ae19f6fb8e732566c42240793f03f2f4eafa8c3ad2375949fc1c99fb3c3b79db131ae4c44bf8541c553b8629ce36cdc9283ba041b87b3122dadc1174fcb8f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iLb:A3mnXoZjzyacNVOE/ZZucyLb
- TLSH T1A4055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 804KB
- SHA256 71f0bfe82cd3a99533308f9106f55c111901fa403530a7545a9abcabe8b34593
- MD5 3fd8145d355d95d182dbd731b25f6fae
- SHA1 8fd300aa242c4eb0b37bb71f8331439cb0e7865a
- SHA512 ba2b6360a0faa46a355db79281f550f553247cf3de6b02851fdc099aa86400baed4942e17a730a5a0b94019f41b439197c549e85a3dc5221f0d00c85da92a9b9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iff:A3mnXoZjzyacNVOE/ZZucyff
- TLSH T135055907D69400E9D01E8134DB954612FB77BC6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 804KB
- SHA256 cf51d6166b3b81488d9aa5d596076163bd27d3900c1e53b1bee17348b0c641ff
- MD5 722ce31c9c076f59a1787ce20426873c
- SHA1 b846bcbe09ca5e5a4203a570618c9f733b6d16c5
- SHA512 fa99f38a4364e6532f69276cec35044f4c6ae5c325e16f2dfec01df65a35d5f990f02697d52a73b4443e30adbff01f23f017fe8761aa5ea59ab595d17e07ba19
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iIK:A3mnXoZjzyacNVOE/ZZucyIK
- TLSH T142055907D69400E9D01E8134DB954612FB77BC6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 804KB
- SHA256 ee2206da3362cdc262500880c29de9498bcd3f301ad61264bbaed68df132cabc
- MD5 f8ffcd45acddcf09ce64fb2f1ba4c5e6
- SHA1 57f4effeb29c28bf06b490a9254793e7c203232a
- SHA512 1f0a9565b13e365d97816568cf136551bd65e68adfd6dea65cf493dc08807b4a64ee15804cc3c8eb76540296a8401daebfbcd9e828cb42d80225cd7484711d17
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i1k:A3mnXoZjzyacNVOE/ZZucy1k
- TLSH T13A055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 804KB
- SHA256 f75361d906ea0a543b91e81cb4e9dfde5681e4f0fd8bcae4ac7adaf79a2d2f2e
- MD5 9ba94b0cf56d3ad0ac26bc2897b78739
- SHA1 255db3dc1a7ca26de3d35a1112745c4e64417a61
- SHA512 f9e3d47eb9920a09eec9d75345a4814e81286dbdef39111b7d7063b9f99c3ecaaab6e489143b71a205b4e98caf691f3f62a2d101e9a5ba255deba27cf4426bda
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iq0:A3mnXoZjzyacNVOE/ZZucyq0
- TLSH T1CE055907D69400E9D01E8134DB954612FB77BC6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 804KB
- SHA256 0d996bb320cc91eefb997693663f0cf6a257400f84aee1c31cc7f9772553be8a
- MD5 5c4165603d1c68a0580e1767ed81e014
- SHA1 b0714cdb1ed1df51d68450b5c5aacfa49fa2fe2f
- SHA512 d7516c04f8aea12f915f22344cc19b5bef32f34f799e5b665126428781fbe6540d70f9e785e613e33039ea884538b91ed15dba8714b91642ac8090936a4c2d2f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iZ70:A3mnXoZjzyacNVOE/ZZucyZg
- TLSH T1B6055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 804KB
- SHA256 58507c3cfa9758289c64349f8a4eb88173cea1d6074d6eead30e2439236da7d8
- MD5 e6585c960ca115821b25d3663e568d29
- SHA1 81343cac3f00260b87be5841a328e2044c7d1fdc
- SHA512 a2bb0330e50043523d80540024b002baf31a695a841aa39d32170963ef44b90e4bf548bf042c0f44a01968f44d0d3e04ab26cbbfaf1cd82280e8c88b16160f8b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iAr:A3mnXoZjzyacNVOE/ZZucyAr
- TLSH T1C0055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 804KB
- SHA256 7da19bfaaaa971d55041dffc41c961b88ffdf7bd345ce03cdf1f55491339b774
- MD5 e9462ccc88da0828bf9f4c37bd008a30
- SHA1 20d261004a3dfcd9c4cd6fbad0eae5358a5ff1cf
- SHA512 59e4567e3d0363c50fc8b2fc72dac109117575491b1735f5db128d68d8bca9a0f020848b4d34f53d7bce5907553cd4eadcbf975f5e3f55ae848febf02ded6018
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i+n:A3mnXoZjzyacNVOE/ZZucy+n
- TLSH T1A6055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 804KB
- SHA256 0a3f89ac6afbac6460aef8f508dc807736b3f07b99ff6d19437e678e16a6353b
- MD5 82d35a6232ea77554e05a53a86c08de4
- SHA1 f5bd2a4b67d06490aa479b32a9ea5dc723f82220
- SHA512 de79b33ac8dfab0001a53dbc6f2bfa970af65a9e66c70d233a97d927aea01365bbb82fede5082bdaf0fa446aec3dff19daf7085062f3100aa66421c15a7bc81b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iUx:A3mnXoZjzyacNVOE/ZZucyUx
- TLSH T11A055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 804KB
- SHA256 5d121d704e713ce528128e346c46d8056eb1d81595fd042791db8e528d1dcadd
- MD5 0c14cba78a497a04d3aa0df23c22c70d
- SHA1 d219cdb5643feb47a5410d3e0fc5291805d056dc
- SHA512 6c23c3a41218817a7d4fec6ca4425c0568fd2aa11859e40f25099390ce70ee8eb6c01ae0cd118297d026a62f03dbf788275fb27ec283c7bae625bb703aecd253
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ieA:A3mnXoZjzyacNVOE/ZZucyeA
- TLSH T1C8055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 804KB
- SHA256 27fb2b50ae89236b7281c4adb02b914d55bebae94381db9ef9ac69f0937e9371
- MD5 79c76987dd02c741ef92244a30785a9a
- SHA1 f0229e87c346ae5d728c9a04ccdb47e8f6454a0f
- SHA512 b52f3d2176c10ae094d527830de36bab3e88e5dee05d636f29f44496a5f66c374c73de910ca09ed5cd05c656e5aa9aa768778bd80c1efb648e88194801c7ebc8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i39Q:A3mnXoZjzyacNVOE/ZZucy39Q
- TLSH T15B055907D69400E9D01E8134DB954612FB77BC6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 804KB
- SHA256 91b2f45835c9051c2a806544602930948f225358c69de177052e72e10a2aba33
- MD5 e1cb64ef552e81cc7114aefbae0cdcc0
- SHA1 c49d50ac55d10a35d56b0e600f129759b911d9d7
- SHA512 2a47f98aff08570d0ed3d94e05c3627c39f8bb8f813f6c9e552135aff403cc64ae6ede3f1b461150c3694444c7220ed0af4f7f65f7ddda11ef9efb46d829cc69
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ie4:A3mnXoZjzyacNVOE/ZZucye4
- TLSH T19A055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 804KB
- SHA256 03f71c8f4ca2b8c6718d73a741a83cd3b4c11c7a081f2093803ef99f53dbffd8
- MD5 271d0ac65718ef4c00e4523155449a86
- SHA1 d67276034ff112d9fdf1e7cdf7e76553d84105e9
- SHA512 5e408050d7d45fa86058b8880af0d9cc22d4311a5a169d49bb0707268ff0d86cb21684b52365761aa6e20e084f31dba3e0a5a5d827d2901a2499818a75edf60e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3idu:A3mnXoZjzyacNVOE/ZZucydu
- TLSH T174055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 804KB
- SHA256 046e198bf47cc4f4183041c55965495035490d16e34a854a04372cdb394879af
- MD5 3dc21a05a9e399dadbf948f3c3a1ef5d
- SHA1 ce14c7c3fae2dcb4ee8e87131505261a39ab449a
- SHA512 4e97af0d03836dc0bce52f65326ca65984a06ccdd324c6bc2d2469c94410308ccfec831617e00be88a762feaedb87073688ae917f9b97a9253982d6dabd145cb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iwj:A3mnXoZjzyacNVOE/ZZucywj
- TLSH T114055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 804KB
- SHA256 7577b4ab8879fc313c7f146635a7043882aa09a1e2dcc044fa0618640c7202ce
- MD5 8d8a0fb7903ffc0fd88f69a17f60d0a3
- SHA1 1e15f2ce36f62f70fdcfc9e9745007af18d12545
- SHA512 563cc2e8b0615c672d625e62fdd641acac06d7c7c34e71960aae2b8414f6b906a3e71fd7aedb1594d3ad10c2e790d22d16634eebcfdb6410223621eb6d6fa834
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iBg:A3mnXoZjzyacNVOE/ZZucyBg
- TLSH T180055907D69400E9D01E8134DBA54612FB777C6257E082DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 804KB
- SHA256 117664cac9f359ed8bbb16ca4ef21693e5fa5bd3bac3d0fe0ea9bcba5a444715
- MD5 989d94ecf0d9430403b12c7ec5412e14
- SHA1 78be398707ceebe0635514d19cc139cd356d9ae6
- SHA512 c458a0d184e9305f6a2bbd8045f9fc17b1cf218da6ebdaab628325eedaa7f77a94357e4a449036124c2bd6fca8db0f5d10f1990a073d9ece2e602b4cde6a05c8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iYI:A3mnXoZjzyacNVOE/ZZucyYI
- TLSH T1A9055907D69400E9D01E8130DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 804KB
- SHA256 1af3b49548c0c4ff037137c23f07156971363c2d9a0ca522d88ae180d920cc9e
- MD5 e048627903533ee27759c60868d2d503
- SHA1 31488d21a502adfc22d52e837049f0c7195159bb
- SHA512 8b187c17eed50901e3036860e560b2a3869071f2de8d8b990deccdae499c71a4ce4f9f13b5aece7d38930022fce30f3ad8a921c24ad250186208767f2b04ea7c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i6o:A3mnXoZjzyacNVOE/ZZucy6o
- TLSH T181055907D69400E9D01E8134DB954612FB77BC6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 804KB
- SHA256 b8f6c054aa20842907a29c19f00e4ab04942265dc5b398265d14e9eb2861b276
- MD5 a98298a808b88ee725345abb3e287592
- SHA1 df964c314bdf9f6cccf10815ece0f36d3a2ab12c
- SHA512 6574fd7db4b713a88aaba599240dbc939dfe156c439d03481abc04d92c04c3dcf66a31d8a9700e641bd8fae064a1ea43f66d29149877abf2ed54cffe2c0db288
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iR+:A3mnXoZjzyacNVOE/ZZucyR+
- TLSH T110055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 804KB
- SHA256 1c48e3acb8e87f6c7e80f3244b37b34a475c0f1714f1fe05145a5ab84e459652
- MD5 46c95d849c586fe0c3446c5a5b8ccde0
- SHA1 7bbeb0305b9cef17faf1ac681334f3ff1c840691
- SHA512 a194f5ec69f944c03741daa3a744b7c6fca7a7f162f84c81d3e5ab6400a21f0825ed2038209028481b9932463224bd6ba9a84bf9cf7b2903729d335295d78a62
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ifQ:A3mnXoZjzyacNVOE/ZZucyfQ
- TLSH T10C055907D69400E9D01E8134DB954612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 804KB
- SHA256 3142af0e39ba6d2a6b27e6a66db09d5403cb08f7ac15b2b6ffef25901b06604b
- MD5 dcfcf90fa2b66b8521dbccc8f975f6cd
- SHA1 08b18b2efcf7ffb869c209f7071b26e246e54dfd
- SHA512 2f4812da810a174455ef57875e511491a3b4e4bbf642403041aba53311d7ae44a93a1156c7c143c918075985b55d62cbe2f3271c59c6b5fc3b7d6c122b83735d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ikX:A3mnXoZjzyacNVOE/ZZucykX
- TLSH T19A055907D69400E9D01E8134DB954612FB77BC6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 804KB
- SHA256 d24bd280fba44fbcfb14cd2073b7e6587be8337d87f6cecf6b13d5f11a3b718a
- MD5 25badbd3148af6b854cdaad9f39c177c
- SHA1 6423378480e246549524795eb9bba47772634e5f
- SHA512 4abfc9fdfeebfd7af4bf1b7fab16098220000d0eed5d815169af2e452be6e0c3cd06572e31a024f985ea50d4698f82f6dd5a047bfe65cb349d737203627c5525
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iiL:A3mnXoZjzyacNVOE/ZZucyiL
- TLSH T18C055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 804KB
- SHA256 a853fa5fd1b2e606b628e6557bb0b9d0f67bd25289c5d8f2c0dc0fed9a5153cf
- MD5 2f5fdaddf1332910e209a6c87cbb2049
- SHA1 dd7cc8f9194fcb0711ae027ee8b1bd94ec8a9834
- SHA512 c9354c3a13573fb06e23858f0ff89060826f19f94f12d90ec4f11b9337c7e3ce5fc64e5eb4d78b4ff7dd45cbfa34af75570aac569df8bf8f68d7c9eec7e28c59
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iGFC:A3mnXoZjzyacNVOE/ZZucyGM
- TLSH T189055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 804KB
- SHA256 a29677a7750a84663c35da4c88e54d60db713124ecad0dd42975c8db50d6261a
- MD5 f609b2a98929cec93b756cffdc747362
- SHA1 3221de6430e53061fa162d6c08314d6a9ab6092d
- SHA512 a1d6bc3a652ce6cdbe466e7db3a6003f071739c1b60c0c099b94ec28653f6640dabdfb0bfe6423ebed773efffb8f9bc5de4f36bf47ff8617b69d746fcf418453
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ivh:A3mnXoZjzyacNVOE/ZZucyvh
- TLSH T1A7055907D69400E9D01E8134DBA54612FB777C6257E092DB23D8E23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
- Size 966KB
- SHA256 a42a438eb0d39859d67f5a56c8c425b6b6494a5e4b20e11c01f962ba2c0e9861
- MD5 d301410c40f3e890d4e9eb61583c14c9
- SHA1 02e6d03132913e99daa2bdc3a9e9108c3ae197af
- SHA512 0517a0ab61ac439a88ec548c9b5682a67c2aee42daac292b6c501766ebd77651e90865720eae3730faccd3054711946838967f291ca5af5c61d963741367895a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ioTDUjD5F69oU5DO69KA:A3mnXoZjzyacNVOE/ZZucyoT6mpR
- TLSH T184255B02E69004E5D45E4630DBA54622FB77BC565BE082CB23D4F23D2F727806EEA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 864KB
- SHA256 4e31be499fae47bb6f0084843f5fc2d2375d7a9e90d5d677d8e2d504cc338fbb
- MD5 b4f546d934cdd8df7d6927e64618c5e1
- SHA1 814a4a9488c2ad43457aded41762c6c09cca2924
- SHA512 f0590784a515e10fa36988baf51ac1903ec6bbe3ec3264845768a250fcd79207b9895d82098ff25eaa89dd5c3e31f613682bfd9d66edb69e8d08f58d2d3aa252
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3iSFdX:A3mnXoZjzyacNVOE/ZZucyw1
- TLSH T1C6155907E69400A9D01E8270D7A64612FB777C5657E092CB23D8D23D2F627C06EFA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\plugin-container.exe
- Size 921KB
- SHA256 ac5bce4fd0a9a5510d8f4b993119515f00fda71b1eb203aae80b0a7dd27cb7be
- MD5 823b192dd26fda700a7bede230078c6c
- SHA1 8bc51082dac65f9a7673ec0efdd3db726b1dbc17
- SHA512 93145cb5c74f3f1f90abb277b50eeadc78c550d42db42721dac824b9430108cf10973e29a1cc576e34d916ab9c71880049f135ff44672e26abe3ea386b6ceb5c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3ipLeI72m:A3mnXoZjzyacNVOE/ZZucyp6Iam
- TLSH T10B154806E69400E9D01E8174DB914622FB77785617E092DF23D8D23D2F62BC06EFA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 845KB
- SHA256 cf89b4aba461c4ca9598e0a9a73cbe47e2b5ffc728dff55cca8eae671307d695
- MD5 9937cbdb6551d417604d4c2696185296
- SHA1 7ccb0677179a047da732fd1d444d2141837aa868
- SHA512 0b72b5adfef97ea195d623358cbb27bd0052e25e0efbcba8d40dc141fa97f11600b997c02152f31aee09934bc503b1e78d224ac24bb395c93d6334183d7cce63
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZZupXsf3i1Ihp:A3mnXoZjzyacNVOE/ZZucyQp
- TLSH T11D054902D69400A9D01E9134D7956A12BB777C521BE182DB23E4E23D2F327C16FFA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH