Analysis
- max time kernel
99s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 16:03
Behavioral task
behavioral1
Sample
2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 862KB
- Sample260710-thpjqaey5y
- SHA256 7c16517be4caac665ee3294bbe5aeffbd92743ec4417f854777c2058642e6161
- MD5 e0d391b0e3915056b56ff43ebfa8f2e5
- SHA1 49541667e38daaddc2de4aa30447ba4ff633ca6d
- SHA512 f006af8bdc627ef5ca7d8f78337b0092d706baa559014c9087d7e5891df74dc9064962bac10cb28370c9d8e742c239c69bd9fe6e661b966830b87a8b2bf3e399
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3z:A3mnXoZjzyacNVOI/7SUD
- TLSH T11D153806E69400E9D01E8174CB964A12F7777C6257E092CB23D4E63E2F726D06EFA763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/2308-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c510-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c86-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2308-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2288-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000018202-97.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001baff-286.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198da-450.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-653.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-726.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-745.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-825.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-881.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1138.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1350.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066f8-1846.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c510-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c86-57.dat aspack_v212_v242 behavioral2/files/0x0003000000018202-97.dat aspack_v212_v242 behavioral2/files/0x000400000001baff-286.dat aspack_v212_v242 behavioral2/files/0x00040000000198da-450.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-578.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-653.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-726.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-745.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-825.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-856.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-881.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1009.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1089.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1138.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1294.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1331.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1350.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1375.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1382.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1395.dat aspack_v212_v242 behavioral2/files/0x00020000000066f8-1846.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2288 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2308 2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 2288 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0d391b0e3915056b56ff43ebfa8f2e5_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2308
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2288
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 7c16517be4caac665ee3294bbe5aeffbd92743ec4417f854777c2058642e6161
- MD5 e0d391b0e3915056b56ff43ebfa8f2e5
- SHA1 49541667e38daaddc2de4aa30447ba4ff633ca6d
- SHA512 f006af8bdc627ef5ca7d8f78337b0092d706baa559014c9087d7e5891df74dc9064962bac10cb28370c9d8e742c239c69bd9fe6e661b966830b87a8b2bf3e399
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3z:A3mnXoZjzyacNVOI/7SUD
- TLSH T11D153806E69400E9D01E8174CB964A12F7777C6257E092CB23D4E63E2F726D06EFA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe
- Size 960KB
- SHA256 3115af4f45c0a93008171f8c1fd43a998a309164fdc86aa52a26b63c69b950c6
- MD5 19d4ffe5e9134d1d540d13b4c75cdbe1
- SHA1 a3d6ea6543a0260f9218fae21e298fd1c4aabd45
- SHA512 bd69eecac624d83969df5463fe745bba80257b6c3ac8771c8343b4289ea4c69dc322aa84cc9d731befe15b8a9360291a1115a53eead4d2d006cb5fbed07077ec
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3c2LoqDB+Uc:A3mnXoZjzyacNVOI/7SUM2MqDBxc
- TLSH T10E253806E29400E9D01E8134CB954A12FB37BC6257E096DB23D4E63D1F326D0AEFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 d0f00ee8f6e47e30929608420ee65c0f9083f59f2b6ffc2b4edb4c57eed8fdb8
- MD5 73b4add831ca98e57f8fedce21bbede0
- SHA1 0e7d44b3bf05e574625c1eea44410eaa69d905b0
- SHA512 1620666a5f9b6630981f9cbca74678d1514bf3fbab6224532bd71e7783307ec3f6ebe3ec3032cc819b46db217b44aaa3ebca6347fe24a53b62f4371d7ef72503
- SSDEEP 24576:A3mnXoZjzyacNVOI/7SU/0Le5ji0hmxNrM:A3kM4Pji0Aj
- TLSH T196652816E6A402A5D02EC075C792965AFA33385217F086CB13D4E63D2F376D19EFA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 910KB
- SHA256 1f2574fe1d96823cf49efb8aaebc68575c203b1fe39f353fcb3c401119ef855a
- MD5 8a785c650855937225785cadd61e5608
- SHA1 3836d2a920d6f84adc3d06df2ea2424830edb874
- SHA512 725511ace8059542a6d72ee2588c98d5c8a080215f091f5cf43294363e4dd373bcaf745c8a011044a6b93e279362c7f4281b0f20ea2bf5adee068490ac15ebdc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3Sb:A3mnXoZjzyacNVOI/7SUib
- TLSH T12F153806E69400E9D01E8174CB954A12FB77BC6257E092CB13D4E63E2F727C06EEA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 f010caaffda569811ceaad86b525eda4efae519fe4705547bda4176355e3d25d
- MD5 29bb028fe2ffa0fc1c32be32515f6b1d
- SHA1 4afde65a59ce55168d53ca068c1fbe3bc4aced7e
- SHA512 6796d9d27a3291f1437fdeea9981b7c9dbef5235fba4e4e05549a2129a585154719bc1675cb1ca755e9e6075152aaa4723e2d275afd1a7be319d61b3a7c5a2b6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3hp:A3mnXoZjzyacNVOI/7SURp
- TLSH T1CD153706D69400E9D01E8174CB964A12FB777C6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 12956391a1e1d03638820eae52140579cb09e5e20d1c4337a4b48d732fa41c2c
- MD5 bf3770c8cee9647ffaf688dda5396703
- SHA1 6d4454e84641478c2707981f735706fbd42a2c84
- SHA512 5d34d15ec6bf563d57fa7bb6aa916f1e41a7b501bb4fb3eb6024b1480a4818bc0f085d9f2331fa0bf0ed8c700e61175d6255745e5beb8d098d67e7743e2ae0f6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf320a:A3mnXoZjzyacNVOI/7SUmN
- TLSH T1EE153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726D06EFA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 de8f43c2958a790da1f2e304a48e167fafbb6bea1799f7d1bc2c6f9ea4017b06
- MD5 590a18ad38e45c3d4aaf83f3a2845963
- SHA1 4a4c57ec764df8de6f2b48d65b62b7985e3f57a5
- SHA512 25cf8411c599bee5d4d51bd331ef3cc8a3a28b5f328f98cc435f58a4f217b6e311405dfb256dcf5e4c6b0ff1aacd0c3e9acc81ed0a1c157d27386d28002f33ba
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf36F:A3mnXoZjzyacNVOI/7SUqF
- TLSH T17B153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 558b04df0ded0c8ba8eef39922215cb24f44e9f0061fc2556ff3aa4e28ce04b3
- MD5 e58afcfa7afa7dd3a5bde7c07e5a1f19
- SHA1 68675077063a69076eab463998d709e222b4c83e
- SHA512 cf5aa115f1e50a15871fefcfff7797d5120d1346c38ca1d0b49d8017527e2baef00ff94d1412446bfe3b09c1c65477665dea533770360ecddd3717d2bb1ef354
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3PC:A3mnXoZjzyacNVOI/7SU/C
- TLSH T178153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 aaa783d2846d57f8e12ac113f8695b932459df870e74ac27bf4ee1eefecbf4f2
- MD5 4372697d63c1e3682558023c7d63d042
- SHA1 7228603417014ff11f533ae3e344c60d493250c6
- SHA512 673c2260b6cece91ac4a20f5abd3cec17543b12e149c8e87e13648ce1e49fbaecec9bf824819352dfe9a7bf68e88c49c32c734fbaa017ce8ce4830ba54be6795
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3ww:A3mnXoZjzyacNVOI/7SUAw
- TLSH T123153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 de4acf898fb609e9dac552a9db37fd5ed9c30f70aa2e2b4f996ebabb60cee2d8
- MD5 f20e2df5a155b3f9c890437818656a79
- SHA1 e4b03e4a4cb3ef315ed30a8953730573b56b3024
- SHA512 11a6513480b5c7e4da7bdde230cb50bd61eaba0f748d0aeeb87540e1070059797ef933c8f73feb52ca9bda2d1af2c39bb0c346c7bbb4a80afdb79c6fa5fff9a9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3PT:A3mnXoZjzyacNVOI/7SUfT
- TLSH T1DA153706D69400E9D01E8174CB964A12FB777C6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 ba75471045b75eb236b43e76cdabd4cfa946947c57e62e815bfc15186d462cf7
- MD5 8c063889bf9d609514f238696b02ebba
- SHA1 99828ea3b3f00146dd741e24341202d38ab11c7d
- SHA512 7140fc4fde77f98fcadce9cdc8e01308a8a3d8455d29fc0a5d7b117c40ee4daf77bde34bb09a33f70fe357da7acaf624918ecc4095ca6cc7403ed3da02ee6c27
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3Ju:A3mnXoZjzyacNVOI/7SUZu
- TLSH T188153706D69400E9D01E8174CB964A12FB777C6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 79d815621632591f17eba952771214a10bd45a47938376fe34a04501ef1ae926
- MD5 9e776b63d2d9e1924cb92fc4c4577002
- SHA1 ae1bc184946e2e7252c00e5b58475c955868f24f
- SHA512 dbea3462a28f370335094c44a6cc576b2956af50cd28828c61856995a70d3bc964b149e62d71805ddd6223f3f45c50bd4100bf74952dcbc52cb5eefee979bd10
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3Bb:A3mnXoZjzyacNVOI/7SURb
- TLSH T118153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 be2fa7f767deeaa62b7096c465a4569e6d69e64e0a5460f122e5c64fc4481418
- MD5 4249990ddaf1d717b72d3ec686ef3738
- SHA1 76d8cdc40476fc37cc6312610657fd2070393d51
- SHA512 4a372eff7277a8ef35a910f2309ac0df30abf7169e3be04007b195972b2ddbc359ff8597da39c2b1c23c3530bddfd16497c2483301bd06480808481b14fa1323
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3Jf:A3mnXoZjzyacNVOI/7SUZf
- TLSH T1B0153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 41b22e92f76f011c4aed9e67a19524e4b269077af0c563e43c61b05d5fbdf8e2
- MD5 7bae7eca4f4b0b03f295c1c7758b167b
- SHA1 1a335ebd6b61dd0259113117cfa309d516064b77
- SHA512 ea9ea5e06658136cb53a350167f944fb99751c248ebc2041d3d6d98d539c54159eb29bbf313033544d3aea27b9006f4a0968eff878bdf611c07783f585fd3abc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3yK:A3mnXoZjzyacNVOI/7SUiK
- TLSH T1AD153706D69400E9D01E8174CB964A12FB777C6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 b0a3aa035c949ab3e4990fc969031b338be4b5f4b681a73eeb033c5e5ce1b02a
- MD5 d00ad84fd3d6ab8f7bad37d455a93187
- SHA1 e31073b0a401194dcb9257366225f6d941a541df
- SHA512 2f07d44fb6f69d50b5c434b9fb144ebe13f267a64fac6f1963c4cf22d0782948718ab13c6021264323bc810b8dfb68fa18d7fc51c001daa251558f64431e707d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3Xk:A3mnXoZjzyacNVOI/7SUHk
- TLSH T1BB153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 5084c575263b9585bbb030b0c578a866b628d620a5743c895638d6c6552eee37
- MD5 b5cec988973ce5a1902c3116e2d71386
- SHA1 0f4627ff777ec48bdc05f7bcd4a6efa638af0b05
- SHA512 765be9506a87a53e34ff135736138b102c29509748c83a556a0142507d29a531c7d9f817078fd49e7b2f91ddcd5b07003b612a193fdca0b498df8d027f8c4447
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3g0:A3mnXoZjzyacNVOI/7SUw0
- TLSH T1BB153706E69400E9D01E8174CB964A12F7777C6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 5a60a6b4798e54f1db8a17d7d5c9c7298b8615dff0d5f8e9683a6a95bc515d6f
- MD5 531c2e15511db1d2b0349b9e868b6e7f
- SHA1 1de8203a74df095ae4dc36d664d85c89c81450d9
- SHA512 0a832d6fe7098f3bf6758c9068884a4d0adfff2fd3bb8660bbeede25e7a9bbbb6910565da109a914b03a661ae16293575fc297af3c449eeb0f2c85f95c044b22
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3770:A3mnXoZjzyacNVOI/7SULg
- TLSH T111153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726D06EFA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 3b7356727d1d75666c5a0ba6ff852406f24ffa46d8bf8df30e52ea276f0ec30b
- MD5 6e2436be83c000906cb60e067ddf73cc
- SHA1 f0ae30b93f760be4737123aeac567f3696ad5fb7
- SHA512 97217686f3df67f830f7cc97a21a1269afb3f6ec343deb761f3c22dbe88e81f19aacb71e9daac89bc6b6ed2e88455308efe36a33ff703d0e7230c4b0ea504122
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf32r:A3mnXoZjzyacNVOI/7SUGr
- TLSH T119153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 6b6ab8fadf377bc2f0c1b1f0ccb438e50742b4404052f99888562b2bba892d1b
- MD5 c48030b2343701702bd8dae7ad8ee64b
- SHA1 1164602d7316a2b13f3db482b804a675a3e2dff6
- SHA512 b45990b779a38274df58f68543dc084b358209274dc3b81305a90b2ecf9fe347596d2966c90915537a911ed16dd58c3693b3b722bd0f756d9fdd536bd236b30f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3cn:A3mnXoZjzyacNVOI/7SUsn
- TLSH T152153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 25c8bfd5056cca75733be59ac27dbd51de6cfa32fd14642f27d702746cfc9bae
- MD5 5cfff40f31cf892ba78caacbaed1dbcb
- SHA1 c152322422b8bd2bb3bf6b925a059aa022eb3cd6
- SHA512 0bbddee3c49d4e3cf2f73e65e5073f62c7e40a908675c20b403683807db18612cdefe75b186feb8d62682bdf4cfa2d52f643737d16043c35862cf669c34bfb9e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3ax:A3mnXoZjzyacNVOI/7SUKx
- TLSH T149153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 ae9cfee661e3a0495966ddbd898adada4220adb56a1a733ff630911eb4b272c3
- MD5 7bca6989bc11a4a012be15e4c61a56d0
- SHA1 75452a2c98ff0c61943a991262891fbfd84e7810
- SHA512 f0cbdd907184f709a0540bf107750e76898123daba3aaeedfb8e9f9ac957dc54d6a2dcdeb2b2bf984495227daf384be8d4bca39f417bb8b6bdb225e4c42546d9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3cA:A3mnXoZjzyacNVOI/7SUMA
- TLSH T15E153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 608c5568d4324fc2a1e1c9c65fe98d919a10b06182d027615c6b259005f33776
- MD5 aa0c1ad7f4b4c9103b97c04e4f5d9a2f
- SHA1 bf20ba387926c42557b6369a2a42ecd33dd9cb80
- SHA512 50cf0d472f6e3e61419fc863d1ace9b079b3fdf4b5d1fb1929dd17c57f1d2367db9d752e5bb47abfc026392cdb87f799ac04c7f0075d9c38db517b08ff0c504a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3F9Q:A3mnXoZjzyacNVOI/7SUV9Q
- TLSH T157153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 63d2c18ee92a187e9a687e9cdcaf8ee55306119086bf73da2fa9247b7cf411a9
- MD5 308866955658a6fe15065a9568ee12b1
- SHA1 4c51fe38de89f7e6bbd6ab3e976fd5f573b5c2f6
- SHA512 b7d348872a7433996aa9b808b9db47915edf0f707d3fdd25550e05cd45c17d77546272f4bc6e828190e51c00bfd666f2d451cd13c02e64fe316a86d231825da5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3w4:A3mnXoZjzyacNVOI/7SUg4
- TLSH T1EB153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 f968e6a71cb8ef7858d0a3a49d08aa28ee9d1ebee4ea8b2acf9cd08a84f6af00
- MD5 91aa206bde1675aa583bcf3fe3978a62
- SHA1 03f6c427e9a0b87658bc90b656da6eda44d9ea99
- SHA512 ac0b9953f218e1c349dce3572bb19dc0b1183873cd274660f5fecc497e8777c8b26ca91e7eea2077f6a7acdc20c3363c759e3be02c369a76a3667c0b9f33983a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3zu:A3mnXoZjzyacNVOI/7SUDu
- TLSH T1D8153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 b43b0d6e9bfded60e05e0b6cffc11c1d50dcac10f0d8dd689e2ab0dce0704af8
- MD5 d24d2e61d579610dbfaf537cc6794e0b
- SHA1 dda1017e23b992d17f920b63f52df38ba71ba49f
- SHA512 71ff5bb2a6281ab819d77c8eb7e67527f06599fc0ec99717ce0477977becbc9042beadd51d7a6d8751385f54dcbed5184de629a7560d2863c04cad77facf26b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3uj:A3mnXoZjzyacNVOI/7SUej
- TLSH T1BC153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 d29a7a80b009b801983b2ab6c1ed62b4a963da32bc6f22a1829edf1ffe1f73dc
- MD5 4f6caac1a1ff51ec8c0c22e12c66fe8a
- SHA1 6ffa22ba2f963600604d46a97496382d67f314a0
- SHA512 598bb5b4be14530e3b33334ba92de5f6fa0e74cd985553a1655634f2593593ceedc1cbe805f6301e7beee2de7f140342c508ec8c52308c0a63eeec8d50231259
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3bg:A3mnXoZjzyacNVOI/7SUrg
- TLSH T194153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 0dd94545ab58b1bdd3312d159f9eed0156627984695e83e9b7c53c2373c532e6
- MD5 2a055065d567e57ecf3f3feb431821ea
- SHA1 f04fdcf4ec35237740120d2d1f1df404f36e8388
- SHA512 8b206daa174673f8268e26e74b6d8194fd73904113664eaa989450cc71f098459d1615cd07ee123cb3bfe88f8629b5dfa082409fee72a1a7fd316d30a213c912
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3GI:A3mnXoZjzyacNVOI/7SU2I
- TLSH T136153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 ca3f69941dabfdd397bac5fcbc07a3bbbf1e1cfe607d4b0d3ad4bcbb13bc3b62
- MD5 0c71cfd84f58b90de7c417da52701252
- SHA1 cfbd55f45e8de220869b054ccf7f094eabfb0f2d
- SHA512 9bce1215d4536f670db1b6553de72b669a6aa19a79826b88b8dca12138636e4027a08ff95aca5b5719733cf8f8649daf9a32de8d47fac5349f99b704ee185899
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf30o:A3mnXoZjzyacNVOI/7SUko
- TLSH T192153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 70f9d6f5c0a915ffcf1b72afb9a1f3ab7d6c7d01fc3a06a0e9ab1875ce6ee637
- MD5 d069403cdc3a68cd5f78dfba7f92883b
- SHA1 759cade6b19976dcd9887647e927df6c00cd1ddc
- SHA512 91f4e48c8fcc5674d48f056c79e834d090041b7ce4062901371d823313413aa1b8fbc5fc9462fcb745453b1d1f48465ee02162345ad85303a64686be8d698798
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3X+:A3mnXoZjzyacNVOI/7SUH+
- TLSH T1DF153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 95a074911898dc86ce506cfc33fbb373664d761bdb031325434bfc5d522a7e6c
- MD5 e1dc7d118941d7818ffebed4d5f849fb
- SHA1 7ad9d75b11cb2ef10bbebf0e624df5253b384db5
- SHA512 07f51d8e6813207de41ad412e83ec88d86be3fb739a6078a92d34df908d020e94c2a0efa138cfce72d764491fe2fc3200f7239dd105f4a7e0bd323219040eb20
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3tQ:A3mnXoZjzyacNVOI/7SUdQ
- TLSH T171153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 821ad8f86e79b2c0f1672557d184bff4b9711239f5f1b3629b7d0a88212dc904
- MD5 695cb9bad00c1daa622dcca48f1f3219
- SHA1 d85fe3f9cbecb8baac456c88edec10bcf05e2c7b
- SHA512 af9ec3b2cd803762682a596911170a04511f894096faeb51e937001d345a3931f327c53e966a59ddf6ed4a1901f572432c6fa07ad0d1af242499ea1384dcced2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3iX:A3mnXoZjzyacNVOI/7SUSX
- TLSH T1BB153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 82ec8e8911971161e10eda42bac26ddce7b8489d7442c949f30a847bcf3c8999
- MD5 4937ce1b3659698f625dd8f63cf4cde9
- SHA1 f875021122572bbe3201afbf9bb7c71ad9302dbf
- SHA512 b697e2a36456f79bba81c9b10ae8e912c2baee770d349eb8dfa658f0b2e28f37ddcc64f23e068686bf70dbdac0ecebe6147dc8a2dcd18adcc12ed964964f42d0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3EL:A3mnXoZjzyacNVOI/7SUUL
- TLSH T17B153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 a7b5f2472413c0d4fb76684f23093cc3c32934cd9ae20abbc5c612751436b4a9
- MD5 416234d584d1cb64369969a1307643ca
- SHA1 a82f5c714d37b544499f87b91286919b6f74a15b
- SHA512 e61e91df7468a0a3e59b64884c731ea2bb33d867c2b52bebabdbf46618dce9bebbcfc50036eaca0ed95e7d79b904c58ef8441e0b8ca24b9f1e7a127a1148d739
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3gFC:A3mnXoZjzyacNVOI/7SUwM
- TLSH T1CD153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 ad55bdc2e57c306732e3bb3fa8ea483a065194bb9a51bcd8c7efb84af920088e
- MD5 eeaad6fa8e898907f631511b046d7cf3
- SHA1 d2b0e817d89476f134c0630b2e0bbdedfdaf1c39
- SHA512 cc898f333a31b097e0c7c6f998188899dc7303de1fc28d7296411c214fef4feffa3e1c1e8ec1baaba14671b0ac81b32280c37f14450c45a7854f6b6b9e5b7ce3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf3Bh:A3mnXoZjzyacNVOI/7SUxh
- TLSH T1B9153706D69400E9D01E8174CB964A12F777BC6257E092CB23D4E63E2F726C06EFA767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$
- Size 926KB
- SHA256 28159b532a234dd77bf2ecdfa1700f76e880bea04b70ab52988fea3b25c47bc2
- MD5 5d74bb4183f9cb85cfd3de06848ed1b4
- SHA1 e673de53f3e061686c99fa8122a77e1e4fdb1f11
- SHA512 8a2866fc8c4863d7e04dac8dc6af818761d5bb1ee22da7d209c5bbc81a5dd7728b7bdeda47369eccb22a8c4d101a5ddf21dc452f163e639e9f76c5f01d7b47b8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7DXsf3BXsf30qnkraG:A3mnXoZjzyacNVOI/7SUEj
- TLSH T1BA153706D29400E9D01E8174CB964A12F777BC6257E092DB13E4E63E2F726D0AEFA753
- MD5 SHA1 SHA512 SSDEEP TLSH