Analysis
- max time kernel
108s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 18:13
Behavioral task
behavioral1
Sample
2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 787KB
- Sample260720-wt2drscv8z
- SHA256 0bd22d5ad2f8b9305f250cd798dbea6d897ddef804498df6d432deac4856c465
- MD5 067aec8f522a0950e647dcd39f776a80
- SHA1 7950d8a89b3b8b72693e096c69ab65cd36463d7e
- SHA512 4c3e13a4a7b34c7a1429d12d1a955e556dcd199189cca5e56f445cd79bc0978d92f132aee839931342ea739c230703181f2985bae25995a0acbde78e837b8d9c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXF:A3mnXoZjzyacNVOE/EKND5TvinrmXF
- TLSH T1E3057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/2500-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c40f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2500-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4168-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c3-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c86-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c414-329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e3-468.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-566.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1067.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1116.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001ac33-1220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001ac2d-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001890e-1475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018914-1518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018908-1550.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001891b-1817.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a2c-1884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018923-1999.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892b-2001.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c40f-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c3-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c86-60.dat aspack_v212_v242 behavioral2/files/0x000d00000001c414-329.dat aspack_v212_v242 behavioral2/files/0x00040000000198e3-468.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-566.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-609.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-720.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-802.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-851.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1010.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1067.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1116.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1141.dat aspack_v212_v242 behavioral2/files/0x000800000001ac33-1220.dat aspack_v212_v242 behavioral2/files/0x000800000001ac2d-1323.dat aspack_v212_v242 behavioral2/files/0x000800000001890e-1475.dat aspack_v212_v242 behavioral2/files/0x0008000000018914-1518.dat aspack_v212_v242 behavioral2/files/0x0008000000018908-1550.dat aspack_v212_v242 behavioral2/files/0x000300000001891b-1817.dat aspack_v212_v242 behavioral2/files/0x0006000000018a2c-1884.dat aspack_v212_v242 behavioral2/files/0x0008000000018923-1999.dat aspack_v212_v242 behavioral2/files/0x000800000001892b-2001.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4168 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2500 2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 4168 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_067aec8f522a0950e647dcd39f776a80_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2500
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4168
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 787KB
- SHA256 0bd22d5ad2f8b9305f250cd798dbea6d897ddef804498df6d432deac4856c465
- MD5 067aec8f522a0950e647dcd39f776a80
- SHA1 7950d8a89b3b8b72693e096c69ab65cd36463d7e
- SHA512 4c3e13a4a7b34c7a1429d12d1a955e556dcd199189cca5e56f445cd79bc0978d92f132aee839931342ea739c230703181f2985bae25995a0acbde78e837b8d9c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXF:A3mnXoZjzyacNVOE/EKND5TvinrmXF
- TLSH T1E3057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- Size 923KB
- SHA256 d0fed087feff9043e590613509cd30d0d447357f6ec5c6ec584481df4c1c9cee
- MD5 678bc1a36d682d41e319416ca6671ad3
- SHA1 93beb8871f924dcb0aad8505d24449d482d04e10
- SHA512 5b864ca3d858aa984e57f88947335346d66ac74eb07496d477b3a133b945f489830d95181a31b26e703f3c9a4359054dadb2ea730355ab746dbb38ac85d50fdf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXvmEZrZq:A3mnXoZjzyacNVOE/EKND5TvinrmXuqU
- TLSH T154157C13B6940FA5D11F827099A55562EBB37C225F6083DF23189E263F367C06E3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 816KB
- SHA256 af82f16d6fd4e3b483c5091ea2edf2013269e289349c1d710b91ff22e8ffb047
- MD5 2124c9800e0429920483afdc7b9a4a3d
- SHA1 136f34e80e8f0d52f2e4ccdb42848fc8869428eb
- SHA512 193699743d6998b07cea8fd20dfe9224721666323c3d30e2b12fb85af087c5c7a13bb7e86dd7df1310f52a9d3a85cab2d640b949bab3d7cb541bad49b3f051aa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXTP:A3mnXoZjzyacNVOE/EKND5TvinrmXTP
- TLSH T1F6058C07A6940FE9D11F817499924662E7737C225F2087DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 834KB
- SHA256 5b4d4d73793573f19efa512f3b78c1968a84f855c4a803b3a9b0f7acdccf6b54
- MD5 62849b5ea178e1de901dc3e1119c39a7
- SHA1 ae5c4ff59eef0787bac3d8c5cdd32910c55d3bd6
- SHA512 92b1f03110764518e040c5433b6f13b23fc63cfe8d3e1f1882dcbc81fefc12b237b365d5844b8bb5f716a878560d776d7e74060d2c0951f24dceaac710fe102e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXI0:A3mnXoZjzyacNVOE/EKND5TvinrmXI0
- TLSH T17F058C13A6940FE9D11F817499924662E7737C225F2087DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 879KB
- SHA256 871c347c45ee67935bd5f10c30be2733ca9f971d70e3eacb41220458af9b0df3
- MD5 8f783aa1bb993da2adf6b6f14a011343
- SHA1 0cc8bcfd783aa4e0d296ef55bc52dbe8d1b0efa5
- SHA512 615729c4fc3d294294dc169e42b68e03a54d27b8642355e8482f2bea8e3870ce3b8e4acd8e82065f7894dbf253f0cffd1e31cacee2c0cd251a3deb5098a58258
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXh:A3mnXoZjzyacNVOE/EKND5TvinrmXh
- TLSH T1E9157B03B6940FA5D11F813499914662E777BC225F2087DF2358AE2A3F727C06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 872KB
- SHA256 cfb95e0795ccc4d0f47d530c0d94798ee82b9d6648bb0733a0d379722c69a720
- MD5 b6e7d94ff5ee5c660c1f48b69bc9b2a5
- SHA1 9500999e3fafeda41218a46ad58e2ab1de222508
- SHA512 49082f6cd1fb717e73a5871323a1bdd4b4547fdcd9dae26500a4e2d88eccbd68984d765e9a2851daa94ad4829b16d4f25d069f28ea4b3f8b2260a09d3c72f262
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXkYmIjE72:A3mnXoZjzyacNVOE/EKND5TvinrmX072
- TLSH T16C157B13A6940FB5D11F813499954662EB777C225F6087CF2358AE263F327C0AE3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 840KB
- SHA256 6ab552837180cc3b7e5ec1052f83d04e9b93a5d5e12cdaa3d0bc8bada50e3824
- MD5 3cbf4fc158eae674eff6b7c4983d5e65
- SHA1 423249ac2e4e4e5de9090943b81c35f4245fa074
- SHA512 ca077981835a384d5a5e758c42d8ecc38d722db7aa017422c08d5e3081f741e12c1f6b7ff6b7440a867894e2b783bb5f1788085a03139cf4425455ec38496f7d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXOFfj:A3mnXoZjzyacNVOE/EKND5TvinrmXEfj
- TLSH T1EB058C03A6950FE5D11F817499924662E773BC225F2087DF1364AE263F727C06E3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 895KB
- SHA256 da21d96740ab2e0363eddc23c1caf1459555c30b0bd06d253988010aca8eb964
- MD5 f30c4ec4948b4e57bba89bb0a824ba94
- SHA1 6cc970d6c03480fb0b9054e26878fa084e312f05
- SHA512 967e866112c8410719878a937d7ef262c6fbfd427ccf8cfb067c32daeccd7cecc8deaff113262c9c0df96b511b5353832a85a90cf31a047ce11165834f2a98bf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXCzQl8Hok:A3mnXoZjzyacNVOE/EKND5TvinrmX5hk
- TLSH T1AB157B07A6941FE9D11F817489924A22E7737C265F2087DF1364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 a662a8859064bffabdccfbc8ca5ce65f00a1ea27f14512df86e5c541d9dd7928
- MD5 12ba1641fd500db99e3c5dd53c3ad7b0
- SHA1 d720c6a454a25d6087e71aec37701b3b7934c095
- SHA512 1253620bb01d20806d82de7af3da5a051f60399458ed2d32b6039f32d6130c9d5fbdd6260230a496994545b3e75a36ac5448fb24e7f6af5e17ff4aa5a0f91554
- SSDEEP 24576:A3mnXoZjzyacNVOE/EKND5TvinrmXB0Le5ji0hmxNrM:A3kMO56ryPji0Aj
- TLSH T197555A16F6A44BB5D02BC078C5D2969AEA733C425F3087CB13549E283F277D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 802KB
- SHA256 57939e2ca0dbd486be3acf62d44fe16f416bc829ee52b29640208ee9968ae817
- MD5 6a6d4db1399bdcdcf6b941bf901c2dc0
- SHA1 3db7d070d1647098a0c170175802a9af4df33426
- SHA512 921cf436dadc5e5023655211aa6132c7af40ce6aaa75ba6694a46e2bec9f90d4ed706bb0fabe64be0125b65ac28b68ff62b418315f187476bacda6f470dad7d4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXDa:A3mnXoZjzyacNVOE/EKND5TvinrmXDa
- TLSH T19A057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 835KB
- SHA256 70a0c6c298007d677b3dda852b8619be4dbf51bb45b5ad43c47ea681315c19af
- MD5 39ebf6de0bdc7d2476df95d7686f13a3
- SHA1 258ddbebd05a38dc47457578e4d057cff02f99ae
- SHA512 6f7548d0d23764c21851d16672198034eb73b52e0806e67bffefc7f3a4c6782136beafe243018f5608becbce7b0b8b6f2db45c8f22146257b69de817c4aec12b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXQb:A3mnXoZjzyacNVOE/EKND5TvinrmXQb
- TLSH T153057B03A6940FE9D11F817499A14662EB777C125F2087DF2358AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 811KB
- SHA256 829bd262072ed6c9fa3214bf1e93028407aef61e345539f3e6718c897b9910c6
- MD5 a1a84fa2a33d37041505696df149de17
- SHA1 055a1c1bbdc5d629ffc75d85d6f628bdc868dd07
- SHA512 f4fa5de686db3e52004b01d247e6b8141e9e171096743f98cdf6bae8ceb115bcdf1882fb8aee9c4695a5f0af11214e6847b4fd5f145d9ab0b0af94ad05845864
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXbb:A3mnXoZjzyacNVOE/EKND5TvinrmXbb
- TLSH T1EC057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 811KB
- SHA256 0d1ae0fec544c4f6f3af31b1c8817cd37a983aabd46326245d95a32b9b49cb56
- MD5 2bcd424e77fe780b119bf05878dbb216
- SHA1 5f1174d88515f9250aafcc6fe27799197e266a11
- SHA512 75dfa276d517d8e42cdc78b3b5ef03821fcb1dd79bab92a4db8734011e583c84b629eb8aba8ffc1d15228faf994b702873694c5543b0ff4052ca3d4cec6842f7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXvf:A3mnXoZjzyacNVOE/EKND5TvinrmXvf
- TLSH T1C2057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 811KB
- SHA256 355997ab650d97d8a3f71925af9f1296244cb4bc72a19f59e765aedd56329b09
- MD5 ade65c43021eac33f8989b106e433145
- SHA1 e091fffa77244eb42c980abc32fcf6d40c3addb3
- SHA512 05c875857b476d63e8040f42530aa7140e6cffc5ccac565905e3f002413a7130942f1540e1ff2fee09b21d6b959240ff02fa33db44241088d27b0c530b65085f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmX4K:A3mnXoZjzyacNVOE/EKND5TvinrmX4K
- TLSH T1E0057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 811KB
- SHA256 33469cb9da2d93eee922b898612f51931b95deb93aaa4ce17d36b009f1f65e8a
- MD5 77f33c6858a9318ae17cb092e2bf2d77
- SHA1 5cd2b081e2a6d0058167ac3c88b537cc0ddf371e
- SHA512 836161f283ebe1550306935b3c3a9f6c10cc5c5d991916b3d6e944e142315e344ea7f7eb110bdffac12278e5d1ab7764e8b7668339dedbf51b0642e35f5beec8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXlk:A3mnXoZjzyacNVOE/EKND5TvinrmXlk
- TLSH T134057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 811KB
- SHA256 fdfc7e9687a75d0204336ad4a6edb1f01369be3d494163b53b8a3697dee62d2d
- MD5 e07a0a96d437f4e0b25ed44cc2a9c977
- SHA1 803bd4b70008476a70249a6f621219c84f80dd34
- SHA512 c2d251dc86829acd65a9b634cd0469de87b147a5acbcd1a6d58726b46c5abe480214efd97c0aeec59cd05176a53f38e7375d7590f70c87280584d0ce8145701c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmX60:A3mnXoZjzyacNVOE/EKND5TvinrmX60
- TLSH T154057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 811KB
- SHA256 58666cf3c54aea961f2c2f0e8cd50643995437b6b54fc3683ee5931c0d009cb8
- MD5 1cb9ea799e6b51a1339d53b1ffc6212a
- SHA1 b0762c01b38f511f5684117ad925b3a5bcc5aae2
- SHA512 1092d73d89e0f04271ef8e3e818e3c912a34119cc9fee5573a74ec5fec1b85f93c0cead49598251938e91a61eafdd471ed307878f4e3e73cc65976ecdaeaaa3a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXp70:A3mnXoZjzyacNVOE/EKND5TvinrmXpg
- TLSH T1E3057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 811KB
- SHA256 39bf042b4ea0f6ed2695508dc2b4d77baa8c3b4f32c3dd61bd8295b9834c5b4f
- MD5 839c3ac3ea9b481513d07218128fc7e2
- SHA1 6f4946f69a4d8713062143a36636c9db8a3e78bb
- SHA512 5f3bae01f52c3ccaea5c70038cdf941c5002a609991b0086562a7cfe84b2721289a0b91a0b060b902120b9d0a7610e0fa86552c056eb7679573c547a5ad805b9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXQr:A3mnXoZjzyacNVOE/EKND5TvinrmXQr
- TLSH T12E057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 811KB
- SHA256 d97be1b1deca96ea9aac64c396c68448dcb11e757b328bfda3e385ec7c2c26fc
- MD5 83c2a52a9191f73adb6dc0571891d84a
- SHA1 ae61b9d9597d42bcb7fa54d2298c5c67af2d22a2
- SHA512 a1979cfa2006793ceee0a06b0b3014b7ffec0e0d18e1233b3b965cd2ccebbedfcc020ead4b85f406cba5cdeb3601c5a55b594b9d088cd4a849a9b5b509f08305
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXOn:A3mnXoZjzyacNVOE/EKND5TvinrmXOn
- TLSH T173057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 811KB
- SHA256 00c0419cba0c7dd31fdca3a1251e7e002466f189279c852b051bfb0ab730a476
- MD5 0a19f2061fa9ccac5370b1913924fea5
- SHA1 5f282b3a9ba7eee79fc4825fb4dc82c66795d1c9
- SHA512 2dd4d98973de391c696a926298925d6803eb7f6816ce0783bd0c48c434b6adc9027dd2acb8fe31af6f871b2c71902d482d10b249e102ed6f3fcdae542f9a492a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXEx:A3mnXoZjzyacNVOE/EKND5TvinrmXEx
- TLSH T1B9057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 811KB
- SHA256 cf2b4491ec88a17c1b95bf20e6fa26578af0f13b08d688c36d91896e8754869a
- MD5 00128e1564ea40f51cecdd6f7371e06d
- SHA1 352a81e40206463a4d63f6ecde89a82994741904
- SHA512 88e91f16ac85690bb4905334f1efa06497b31c357495bd66287d8f6ceebe21cd24958e7577a1e7cf355551de1a004c0045360d8eafeda7c8b2dd04c53f68361b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXOA:A3mnXoZjzyacNVOE/EKND5TvinrmXOA
- TLSH T15D057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 811KB
- SHA256 88748495288259f254f9e8751b514f3abe330296005449c1c46da43f31d1a420
- MD5 a1ddb87ee2963a6ff5efa9a2e1ea09d0
- SHA1 4877e40ee7f2caa22c183c42375c4a816251495e
- SHA512 6947cf0cfded7edc5635b21f40ce0df8f57c624f2f8364d848b5c5ef88fa798d7074be7cd3da2bdfaa0d508fa90de7032a9c8f47cb779a1593d57c380a113518
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXH9Q:A3mnXoZjzyacNVOE/EKND5TvinrmXH9Q
- TLSH T135057B07A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 811KB
- SHA256 2a4a828a5dbb70f5db52a946d0ec6b4778e88d1a09854e710c168a13995f0930
- MD5 0a1b633534e59a486df621dd2b82012d
- SHA1 acd668ba8c44701401d0d53f32ca6ebfa2a1f4ff
- SHA512 f4b6ecbad2c7e64bcef3ed9c9155b7ccb24c3d6fe87d676be70459107239540ad08e6a9b5843b8c8b5b90b9a64720ed9e7afb1f20639a3748c76306c579b5548
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXO4:A3mnXoZjzyacNVOE/EKND5TvinrmXO4
- TLSH T1B0057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 811KB
- SHA256 01d4ab9ef77c7a249dd6a8e682e54b492d4888140f651598e5cf5714cec57c7e
- MD5 c4c6359fdf58f3e18ebc121d2eee69a5
- SHA1 f42fe5518a4d6c07e3c824f6f5ce633087d81d9b
- SHA512 d665fed6f14c2e7d616464cd3b630f0570d53d2dbc39e49f0ed702bdf85c3be0547133aa2bd1c5f94b8e3d4f43fa5a729ad93c3dc84d2c0fdd0308b96071ce7b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXtu:A3mnXoZjzyacNVOE/EKND5TvinrmXtu
- TLSH T13D057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 811KB
- SHA256 edb74fe1b248275bf2ce8bb630c9d58ba29c0b4def37d33f99382f78be4bffc5
- MD5 633535cf011647dfab68d45187708071
- SHA1 90d1d9c0972c2708eaafc6f5d274729aeaa296b2
- SHA512 00d5bb66d99b08e54c547a7839d8a1653b8f5f279cb211f50548a9b450285b76226dbc9454d6b0b58d803c76cd318bf8cc9b9360aa334259107c585be5139586
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXgj:A3mnXoZjzyacNVOE/EKND5TvinrmXgj
- TLSH T18E057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 811KB
- SHA256 6c5a6544a1bd0f0698356ef4d0fd1dbe0158e403fcf98d96805b03b966ff783a
- MD5 3fbd308b533ace3107e2edbd1d572fec
- SHA1 9465725557fb30c709b06f7711c62150abb0de0d
- SHA512 6829dd3087e2885341c1e4da6f9857cdafd0c5bbc4526ed0b6f56737d3588a47814f9e89402c7b27ec3fa0b1b5471477d58bd71f5866c042670a7bed62b487a2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXRg:A3mnXoZjzyacNVOE/EKND5TvinrmXRg
- TLSH T19A057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 811KB
- SHA256 7e4b596421dd576894aec738afc795d4ff788ca8a2b4b82367a9729d8c87c5e1
- MD5 13d17bc449758bdab4d02dfd206368e5
- SHA1 8b7f72a1e928434eb39d687ab82b31cb18c5566f
- SHA512 c26ab7e29c32fcd03abd6d236667cbff7e83fce0a49b08a92e308a2329ae9016fb48afd1a49e6e248737b15b77596c53239b9396a1ba2d600b7cc4d08cbce670
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXII:A3mnXoZjzyacNVOE/EKND5TvinrmXII
- TLSH T197057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 811KB
- SHA256 6374cdf5e8411033a02a0a2396dae18f56013bca5c6c834edd8d6cc0dbe2c339
- MD5 9f3352ae2865b8297caa42d9b492f15d
- SHA1 1f94a14817a29f07108e16849865f21ee49201c0
- SHA512 93e22d045385326f696f861abbf926b0e493e96186122d7de96f0c74a7166a66a2153ef5d4a59a9b9bfb63596b4e90e4b719014ea6b21fb9cbd06e0cfbd8fb60
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXqo:A3mnXoZjzyacNVOE/EKND5TvinrmXqo
- TLSH T155057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 811KB
- SHA256 79736ea625bfacfbcb6ceb8e5759e558d51751c2ad471c47ec9462b6f6c49028
- MD5 a9bf3d3d8ab72be94c8a9c3ca6968522
- SHA1 367d14634d81a4efd7df245e043cbdb028ce3be3
- SHA512 be8685f413a8513f2dee67b5429c7b5f917b863fae43eb54ceb615ef79b55fee258f654f33812dafa4656074bef5b81e5e3ac6d0882e4e481703b43bde8231d5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXB+:A3mnXoZjzyacNVOE/EKND5TvinrmXB+
- TLSH T15F057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 811KB
- SHA256 b78e3ba2ae5a9112f50979578952c37935e4c38482e3689d6807866e775d63ce
- MD5 6bf782cfd9879a1ff0af3ee5418633a9
- SHA1 8b289267672a7a92a1a81dc68adb9e5a18110f3b
- SHA512 2bcbeeadb9f382331c90a3dfdec48e17b370431ec493538202aea2c0c5787f160727780f540ffb78294428f8cc889dd29056809b5176b6f7a71d9fb0e376b8ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXPQ:A3mnXoZjzyacNVOE/EKND5TvinrmXPQ
- TLSH T160057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 811KB
- SHA256 5ab1e5591cfddcdf9263c87d06a4a5de8028ded15363b364fdbe36b0a6257496
- MD5 908d79e9e6cfb71fab5a6307e1538c66
- SHA1 074683f091b535d147ba547284607eba5340db67
- SHA512 9288cd4e144321147207cacd95ba011ac60bce5f0d56f02ea3bb0dc525e857c135624935ece17ce2628f13e8aef5d1a007a4d56e177feb5ec4bedb4a85a0d0e5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXUX:A3mnXoZjzyacNVOE/EKND5TvinrmXUX
- TLSH T14B057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 811KB
- SHA256 b22cdbb609778d3a9523f5e85380119ccc95ad99bcceb810253a1c935604b26c
- MD5 5dd14dc6ed0fcf601302c705ca64f000
- SHA1 0e6a9332c83edc60433f1ddc1b7aedbf12c39b67
- SHA512 ee685457252e91b423ffb203d5c4579153c13d82d47aeb7cb5e9ab4c92a82c2c9bfebfc17beefa8148a8d5816766c241604cc4fc8ace08bcb1c1084c951b7e3a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXyL:A3mnXoZjzyacNVOE/EKND5TvinrmXyL
- TLSH T191057B07A6940FE9D11F817499924662E7737C125F2087DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 811KB
- SHA256 9a63c7b25291f3b65ee2eb432f01a6104bd6b6234e86c0c8499284d66624300d
- MD5 a7b4b6e887a0fbf98a7ab538ad388abc
- SHA1 677136ad6e8fb16441bb50e0e51b06ab95b5feb5
- SHA512 d617505e37dbbf5102b5108af628fec3c5903423237a73dafd183f764366944894e3cdc1895e6d921091402d02f81fd2afee8cb75274e9d5ad6181a50b481ec1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXWFC:A3mnXoZjzyacNVOE/EKND5TvinrmXWM
- TLSH T104057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 811KB
- SHA256 04d8e4068daaa4a195d7d141dea78ece9874208cc453c109ece723591176b01a
- MD5 34847fa99976d22152f71e83c910c256
- SHA1 dc486b9d289d31c844e6e7f94e96c77a1ee364dd
- SHA512 bb4be54c126791c259647aeee50ffc8d3188ca86eaf5b4f7dc71176b3801863bde1ff0268ee7702d23044812bdbef694412638ea8e8bcaf74afaed26bbc3c7d0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXfh:A3mnXoZjzyacNVOE/EKND5TvinrmXfh
- TLSH T172057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
- Size 849KB
- SHA256 bdd577c4c3497cd77546b2981b06323df385e1fbc70bcb477043ae404d17c4f8
- MD5 3fc5c6302e5fd3ee4ab2976d67a85be8
- SHA1 23ea4080d3aaf9eef74c08bb662708256ad51fa4
- SHA512 a3ca5e18c35c5900240aba945e2518f51f45e20763d958fa6c308f8072a31a2855564183a43d357eb9b191604409987a08c66682ae58ff0a4025d32d081fc570
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXn6:A3mnXoZjzyacNVOE/EKND5TvinrmX6
- TLSH T1BB054913A6940FA4D11F913095994622E773BC1A1F2083DB177CAE253F36BB07A3D66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 867KB
- SHA256 392c9dabab14db3c8b4e5de30a627f445801f1524e058aacae556e884a99005d
- MD5 106f48abe92853a944830c2f729f4f86
- SHA1 01d4df4416fd9745118c367e8b2747d6b98dc08e
- SHA512 598eccc12fff6eab77e061c2e967c9776b2826106b493f23f4b75b22f3395da0602b4dbc98e9398fbeee25e78bcdf7009dc1f8076ebfe3d70dfdd9d2cd775faa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/E0dND3JeU7vinrmXRF:A3mnXoZjzyacNVOE/EKND5TvinrmXRF
- TLSH T1C6154902A6950FA5D65F8130CD964662E7377D920F2087EF1368BF253F327C06A3A667
- MD5 SHA1 SHA512 SSDEEP TLSH