Analysis
- max time kernel
113s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 00:26
Behavioral task
behavioral1
Sample
2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 636KB
- Sample260729-arablsdk3v
- SHA256 d59e067c1f8ecc429b3a10a7bb48ee4c1f88bd7224c4828886009cfb76b910f5
- MD5 c26c6f136e0b8ba6fd48917f3963d8fe
- SHA1 28dfc7080f4a49fbce499d38aca4e8a1baefe4d0
- SHA512 dc7c9bcbe8abd460436054f3b6bb4cb8b25704340bd90d603a2617104a8b0174b14dc3b4e7e2d2bedb6bc9513d04be7921a63d405076399f91f64366fe6bf036
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48T:A3ZUnXoZ+yPz5L8acNVOE/ZxUChT
- TLSH T1A8D4AE13EA9114F9E10A817099D54A22FB75BC675B60D2DF6368C2212F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 31 IoCs
resource yara_rule behavioral2/memory/3664-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c58a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3664-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3356-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b316-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb35-138.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bb5-618.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b96-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019b27-723.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd3-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000019b0f-786.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b08-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b50-842.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b54-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b31-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b86-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b5d-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b91-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b2e-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b6f-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b8c-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b72-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b58-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a357-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac36-1219.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ac35-1335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ac2f-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893c-1515.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1528.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b72b-1807.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c58a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b316-41.dat aspack_v212_v242 behavioral2/files/0x000300000001bb35-138.dat aspack_v212_v242 behavioral2/files/0x0003000000019bb5-618.dat aspack_v212_v242 behavioral2/files/0x0003000000019b96-625.dat aspack_v212_v242 behavioral2/files/0x0004000000019b27-723.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd3-743.dat aspack_v212_v242 behavioral2/files/0x0005000000019b0f-786.dat aspack_v212_v242 behavioral2/files/0x0003000000019b08-799.dat aspack_v212_v242 behavioral2/files/0x0003000000019b50-842.dat aspack_v212_v242 behavioral2/files/0x0003000000019b54-855.dat aspack_v212_v242 behavioral2/files/0x0003000000019b31-874.dat aspack_v212_v242 behavioral2/files/0x0003000000019b86-887.dat aspack_v212_v242 behavioral2/files/0x0003000000019b5d-894.dat aspack_v212_v242 behavioral2/files/0x0003000000019b91-901.dat aspack_v212_v242 behavioral2/files/0x0003000000019b2e-909.dat aspack_v212_v242 behavioral2/files/0x0003000000019b6f-929.dat aspack_v212_v242 behavioral2/files/0x0003000000019b8c-936.dat aspack_v212_v242 behavioral2/files/0x0003000000019b72-955.dat aspack_v212_v242 behavioral2/files/0x0003000000019b58-1004.dat aspack_v212_v242 behavioral2/files/0x000300000001a357-1089.dat aspack_v212_v242 behavioral2/files/0x000300000001ac36-1219.dat aspack_v212_v242 behavioral2/files/0x000400000001ac35-1335.dat aspack_v212_v242 behavioral2/files/0x000400000001ac2f-1373.dat aspack_v212_v242 behavioral2/files/0x000800000001893c-1515.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1528.dat aspack_v212_v242 behavioral2/files/0x000200000001b72b-1807.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3356 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3664 2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 3356 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_c26c6f136e0b8ba6fd48917f3963d8fe_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3664
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 636KB
- SHA256 d59e067c1f8ecc429b3a10a7bb48ee4c1f88bd7224c4828886009cfb76b910f5
- MD5 c26c6f136e0b8ba6fd48917f3963d8fe
- SHA1 28dfc7080f4a49fbce499d38aca4e8a1baefe4d0
- SHA512 dc7c9bcbe8abd460436054f3b6bb4cb8b25704340bd90d603a2617104a8b0174b14dc3b4e7e2d2bedb6bc9513d04be7921a63d405076399f91f64366fe6bf036
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48T:A3ZUnXoZ+yPz5L8acNVOE/ZxUChT
- TLSH T1A8D4AE13EA9114F9E10A817099D54A22FB75BC675B60D2DF6368C2212F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 689KB
- SHA256 6f2fdce7ca1b1bff664f098bbd15a9a51f6b12327b609cda06045dd05a3433c9
- MD5 e3bf42b9e7cbcd9587f9e1e8f71a81f6
- SHA1 3484849b2660a9e8945a5e87c0e4d6737360db56
- SHA512 6ac50a5883d41527f21978239807434d8e3877c50510dfca8194f506557491fd09187f9ae3f667f1117d3ca4d609340818b273d0e1b15864a36c121b6b67bc0e
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48UFQw9J:A3ZUnXoZ+yPz5L8acNVOE/ZxUChUFfj
- TLSH T1ADE4AE13EB9104F5E506C17099E54A22FB75BC626B6092DF6328C2252F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 744KB
- SHA256 b3f7ebca882195b0fbdbf4b4933d2e6e2e2111c1f23c819ad5a64e3f5bd0dd04
- MD5 5c9f338ab35b77831139440c7cef6cd7
- SHA1 28b4dfa74e537b245bb1de94fc2c5e682ca46229
- SHA512 57eec45a00dc1275b48d94e83ec4d115b2d678c8855ecbda210f5802f63ae3a6c28a660531a407d448d6e60c8ebc5f4acae8c34120e90b04d65265edf98ba27b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUChMzQl8Hok:A3mnXoZjzyacNVOE/ZxUCh/hk
- TLSH T138F4AE13EBA114F9E116817099E54A22FB75BC661B60C7DF236882252F637C06F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe
- Size 751KB
- SHA256 ac39267a4d0740deecad9548ceb976d0cc858f884cbead12add023e5ba42239e
- MD5 ec86e7179d7c711495e9a7d444774ecf
- SHA1 47fb711f1b0972225b0752cacebc711331ee31d4
- SHA512 f024a7b1b1971d9c97279cba05b254708b0d9835f99cc5124d89e29f275fbfdf26652b4eec6953722bc62fd12b76f07d4ba1336c383d73121c32555765901e20
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUChhnRpAr4svndNIaUnE:A3mnXoZjzyacNVOE/ZxUChhTjE
- TLSH T135F4AE13E7A514F9E116827099D54A22FB75BC621760D7EF236882252F227C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.2MB
- SHA256 3bed607b67859be7ec5ebec8e4dabe51b3dc46ad3574acd837bf87a74dfc5961
- MD5 66337e11f37694ae47d888d4ebe4478b
- SHA1 a9034df09bd965d22a0261eb42e177c72f746c98
- SHA512 f20d09177a0659e47e3460867a17d4b58a0b5f21a4d2719d38d66854d59ac0997d19ee16604c779a40fe7b30a1e38de9ed9dbddfee2749bfd5d70670cda38484
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUChP0Le5ji0hmxNrM:A3kMAPji0Aj
- TLSH T1F7457C17F6B442B5D033C0B9C9D2969AFA7134821B3086CB5359C7283F67BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 651KB
- SHA256 00a27f11fede4eeeb212eceb74d15f9f6fe8cb04710a21cd287c270554224239
- MD5 0c54397df4645786dcfd48811220eded
- SHA1 9caf90e6ae42d72b2f9c1194b9a1fa3387aaa030
- SHA512 abc7cebf1b5ffe9dc60338393bcb134e857390a1d99b9b90e3d8cd2714a3b4724ad0d187245fd32d29e10b18b336538224e82389fe54d46e57b1ed57358487ce
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48Ra7:A3ZUnXoZ+yPz5L8acNVOE/ZxUChRa
- TLSH T1DCE4AE13EB9104F9E50A817099E54A22FB75BC665B60D2DF2368C2152F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 780KB
- SHA256 fe3467f0d15dbbbf1acf683acb2ecc57fcdfef172a9329287a4796c28cb8a106
- MD5 ecf9953a3ff465f2ccde6ab44e58fdda
- SHA1 fd4deb1b7a16bd0180629849a99f20ecbc5cf84a
- SHA512 812c3d571a92a4895b9ba3c47df8e2b1fd9d98eaf68a2469ad36e8d23802a9a705cd5e73c4f1dad80eb68572cdd8cce94e86aaefbc6c4a86ae715f885cff80e6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUChhXsf3z:A3mnXoZjzyacNVOE/ZxUChkD
- TLSH T191055907D69400E9D01E8170DB964A12FB777C6257E092DB23D8D23D2F727806EEA7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 660KB
- SHA256 a3ba9e76b19e8baaee2e1dd52eeefa458c42f6d4ad47407ad8fd588532b04978
- MD5 237b01ac74883eef1f93b0e89f164155
- SHA1 bb099ef573240499904eba6665a2669d14bca70f
- SHA512 d95f2da347de266d69d36123dd587a8239fb6b7d77422e7f8bf3ee9b049aef93ccde67e19ba91092aa39614ab05540d0b3f1edd5a6f54e64d9b476068f178785
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48DEM:A3ZUnXoZ+yPz5L8acNVOE/ZxUChIM
- TLSH T1A0E49E13EAA104F9E50A817099D54622FB75BD676B60C2DF6368C2112F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
- Size 921KB
- SHA256 1dc25b3e94e63766e5dbd125c4e1dca8cc64ee131884176a231346e46c636bff
- MD5 0c5427bde38050128db3bb5aaed2d1db
- SHA1 43cde99c66e31055e7ccd4a6e56b73179a77601d
- SHA512 a283d5c51be66d91e938fcb0dbb35a2febc4271e2e4a051f691a6564ee03809d430e738a5ccfc3580acdf1be2ecc594a489078a16d1e54c0b758172eccd6840d
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUChwTWaLl3z0zDD:A3kM9T1Llje
- TLSH T1E715BF17E79018F9E8178134D9D54A12EBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
- Size 660KB
- SHA256 b06d4a98d3e6eef2d5b55801fa895233dcc7e3380286d61e10d543cf304273f1
- MD5 3913d703a54eec192be825383d0c2cfa
- SHA1 5e1a488867ecbf24c84a4663c5a73c94026d0d3b
- SHA512 0231bfe5c892db839724a4e0859e95dd8f6efd9be689039c7a428aa5a08f124793e5a5d11435b6c6d628201577963abbed05cd3cd9bc4393ab5d8a6dfd4a4db5
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48+iY:A3ZUnXoZ+yPz5L8acNVOE/ZxUChPY
- TLSH T165E49E13EAA104F9E50A817099D54622FB75BD676B6092DF2368C2112F627C07F3E7F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
- Size 785KB
- SHA256 71643c8c4c07dec8d2f67f7e26c435fb4dd25838291691985fb89183b0d9776f
- MD5 9675243e76e13ca15e690c3fb4656aa9
- SHA1 3b88ffb4dd5ee09baea96939c5f3e9c937246706
- SHA512 2598207566e5b9a02aa6f396b8b6a614f487bce87742a7c05cfbebe466f87c57302f38dc58073dd8b4dc55a967d42c829542cf01e3fc7890d8c9016707ba24e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUChgnc3/BHdBdnJ:A3mnXoZjzyacNVOE/ZxUCh3HdfnJ
- TLSH T142059E03E7A104E9E426C63499D14612FB75BD621B60DBDF236882152F727D0BF3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 660KB
- SHA256 82774247643790bb54e06c454ef14a70ec07c6da80ef7292ff42f63fe1219eb3
- MD5 82da6553e06aaa2a3a0b062eebe43975
- SHA1 43e4de9bbde88a04c97a80e1d79506a4ec1e01f8
- SHA512 ea922543e8222e3c72ee5bc66fb0e149545cef9564b96fe090e8cabce65327de914ec53be6e0f4f5ca02c2cf35254a1f72eaf92fad719d964702d1904783a16a
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48hJQ:A3ZUnXoZ+yPz5L8acNVOE/ZxUChLQ
- TLSH T11AE49E13EA9104F9E50A8170A9D54622FB75BD676B60C2DF2368C2112F627C07F7E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 660KB
- SHA256 0ef2278a6c268b23b30bbff80fc6f1e8ad3e2e703149c90a2738719d146d2647
- MD5 7b72bf8faf024c7cf9e8b3d102b59305
- SHA1 32745e864982967d3a0f4ed03a60bee9c37c4dee
- SHA512 233a7773e9b017b9ee64ee87fc8a010587097518077bee72149ca8a5feadde137a494fe331958cbbb3ef555800195e3150c0af719f6022644ce8a27fd918d21d
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48O4t:A3ZUnXoZ+yPz5L8acNVOE/ZxUChVt
- TLSH T194E49E13DAA104F9E50A817099D54622FB75BD676B6082DF236CC2112F627C07F7E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 660KB
- SHA256 d3b5b32dbd3caa1a95ff4ef2f48c4b4a852757460e6562a760e398abccca9561
- MD5 da58da2558cc5d4ae0a7264184bb9af6
- SHA1 8a4eb417d713ea73e6fb9718ab4a1331698e5d51
- SHA512 5757e771d4c67eb13ebee17254fab14b09d5fd4d497d6eb5f05794a5fe64a733a5e6085ffc634bc922f557e1d26c9a7582b289204f82b944d85b6608076c6451
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48ahQ:A3ZUnXoZ+yPz5L8acNVOE/ZxUChQQ
- TLSH T15EE49E13DAA104F9E50A8170A9D54622FB75BD676B60C2DF2368C2112F627C07F7E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 660KB
- SHA256 582dad256a35012b531ddef18748f55b040c9a8bfb3933dfeabba6d8a3252320
- MD5 63a10e5f3a6ef19c9d93d84a42b05f03
- SHA1 01b0c98e983df30440bc1e0b4e9819cfe2d49b4b
- SHA512 d3e29f989b468c738aac36e30997a374d1206c30e9e2356ad7977be254a1305c190de59178287410b9e31875bb092e94616befaf1007000f773e3f91a3885d91
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48uiV:A3ZUnXoZ+yPz5L8acNVOE/ZxUChBV
- TLSH T16AE49E13EAA104F9E50A817099D54622FB75BD676B60C2DF6368C2112F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
- Size 660KB
- SHA256 cf3d1f66b64055af99d76f5bf7a96508a1e921db6074b2feb9c34b88d84780c0
- MD5 18d43ce59eee05468629b9281caa7620
- SHA1 d1af1c498f0f72e07b82e0bcb416028e6dc0ab5b
- SHA512 f31a7ec9d131c904d4ab55c713e853b9323384a624ddc30f40a2c7b1a94513e7920f7f7e51f881cbb7f8ab79fa7b1dbe795fcf83849648ef8d2e253744bacfb9
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I481c9O:A3ZUnXoZ+yPz5L8acNVOE/ZxUChu9O
- TLSH T124E4AE13EA9104F9E50A817099D54A22FB75BD676760D2DF6328C2112F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 660KB
- SHA256 c59deed9f12a5b70bed53d39bb64f36a749672ab15e2e8374adf8819d5d5fae3
- MD5 e4bd7557caa2270ad3379d2bcb01c98e
- SHA1 63102495bb6664d657bb9c8d35b7eb416401f117
- SHA512 ff2948a7479e145e775011b69d10625cf5561fcc5bddb9a815797a5a9b61c84cd9ed193383a07e9be1d5e6cf692e61219b628e49de0b2f0ab46b6c66b78a7b6e
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48/R5/:A3ZUnXoZ+yPz5L8acNVOE/ZxUChp5/
- TLSH T1CCE49E13EAA104F9E50A817099D54622FB75BD676B6092DF236CC2112F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 660KB
- SHA256 cd39438b926fcc6a28716a9be65bedc65fce4ee6c8a81856ef1478c6cb31aa92
- MD5 108df039247bd43448e138bb415d0e61
- SHA1 8db857e3dfe08b5013bcba3cadb175fcd7d6f7ca
- SHA512 0a8585e8add6908840bb0fb79cc0baabc90f33bd29f859f08e67ca8353555c6a2bcd3452f980fca0446f7dd90e3b73dba2bcdca4a49257fba3539d42e17ec4d9
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48EAT:A3ZUnXoZ+yPz5L8acNVOE/ZxUChhT
- TLSH T1DFE49E13EAA104F9E50A817099D54622FB75BD676B6082DF236CC2112F627C07F7E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
- Size 660KB
- SHA256 9dce4ee86ec30304356adae07920224a45296d6d1c559e5f9b6820d224a756c3
- MD5 4c528ca4d2582b78950d5e4c721e9756
- SHA1 37d0ff809b138fbd534b9fab08ee87ccbb333ccf
- SHA512 7f3a5c23ba4042e5dd5aaf26317814c5c1f176655998a219ed9977597f2f81e723a6c8b1164cc4bd732727b8db5462728435e70c52f747463e2a58809ec162af
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48Dztm:A3ZUnXoZ+yPz5L8acNVOE/ZxUChHs
- TLSH T1F6E4AE13EAA104F9E50A817099D54622FB75BC676B6082DF636CC2112F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 660KB
- SHA256 43f1e06c8a328cbdfdeba45947eb59ca5cd4320e382e3e23d01e40241ac87545
- MD5 9940236550f99baf0f895a2f735483e4
- SHA1 1a594518d697175473386a502dfd6b40d5309feb
- SHA512 53498dd44ee31d2e248d96e9eea4f96c47e43b5f4084b69a18d4ead84e3387dd7c8611f3c56d66fdd0cae1b5103b98bb0d3153a51aa2958de1568cddac5aaaa8
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48wxC:A3ZUnXoZ+yPz5L8acNVOE/ZxUChyC
- TLSH T1FDE49E13EAA104F9E50A817099D54622FB75BD676B6082DF236CC2112F627C07F7E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 660KB
- SHA256 1b113350c44c8261cf91606614393ae80e2f80c5c183aecef2ae9c21c7e6fb66
- MD5 692b13c11451e962a4ce0cec24a70c1c
- SHA1 dd2c46339f213507f2fb06f137dd882a0fe161c5
- SHA512 4a6677af322f24e8ba0f53f08254488292e7c37f21c3ddab8636ee1b0cd578ecdb12094f7676f76158cabb6808fb90adb8a721c8cb109d6d516eec53c0582a78
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I487cI:A3ZUnXoZ+yPz5L8acNVOE/ZxUChwI
- TLSH T1D3E49E13EAA104F9E50A817099D54622FB75BD676B6082DF236CC2112F627C07F7E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
- Size 734KB
- SHA256 677aa0c348fb67944f2224d639c721da86d13c069311dd0c41edf2b8c1bf0171
- MD5 5741924e0cd4983fc1acdd333a07213f
- SHA1 8ddc00222819e38b17dc4303f44e2e24b50bddbd
- SHA512 703c22c4f19abdd9014256ccc52238265c110ed6f885f4c01924507c7c5c0a168ae720a66f7a4bb4818d559f698e4d317043b20a026836884f435c63ae0c3a1d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUChMQYfgHaps:A3mnXoZjzyacNVOE/ZxUChaf2aps
- TLSH T1A2F49F03E7E104E9E026C67499E54622EB75BC621B60DBDF235882151F62BD07F3EBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 660KB
- SHA256 fe4c30a05e609d8f5121107d173cf3d38a0a681a1ad14a9c402c550d7cf6cf91
- MD5 05b590b36f4952a9abafcb1efb2309b5
- SHA1 46149487086a9707cb468be69e3fff6782c7faec
- SHA512 ea544a9db90568bae89bed6b9b2f34f492396543ddf406284d2b6f1b55cdb691049cbe619eb442a0a16022af6a3d07a96e817b01f861f899c3706fd6b111410c
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48ZDv:A3ZUnXoZ+yPz5L8acNVOE/ZxUChhv
- TLSH T10FE49E13EA9104F9E50A817099D54A22FB75BD676B60C2DF6368C2112F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
- Size 856KB
- SHA256 feac1dd4bd631bba22d3a98033967c0867ea280266743d6c4eead4d04175efcf
- MD5 da7a9576f68609806fd7a79f762ddf54
- SHA1 51f837e39024c14c2166a8c4eb4236b556bfa4cc
- SHA512 3ff9fad24652b115421406ead90031f064e80667c09f419cdd6cc9f97dfe6a8e15197099d3e8a322a05fab17df16a7a5027fe9f17f41dc272051ccc337a52f15
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUChcQ0dWCXSyCq7Iw9:A3mnXoZjzyacNVOE/ZxUChtjCXF7Iw9
- TLSH T11C15AE13EBA104F5D51A817499D64626EBB5BC26176083DF6398C2212F237C07F7E7E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE
- Size 863KB
- SHA256 8d0c5b75d5a0d726e8c3fef6585caedd3bc9778cca312091a621a646273224d0
- MD5 4b63d05880eb793d593b471ff0958a7c
- SHA1 98bedadf6b5499bbd1b8168b068386d6f395ecb6
- SHA512 bd548f8e3457f7b15f2fcbc07cfe0b808549605713abe33be0869b526a83302cfe8c0d4a4f200fa9ccfddb378e77487d99885e0f05a756bf3ce6a31214096fdc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUChgCrJolMmX:A3mnXoZjzyacNVOE/ZxUChgWolMk
- TLSH T1CB157C03AA9000B5D00589309A95962EE7747856D7538EDF23589EDEFFE2BC06F393B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 691KB
- SHA256 b1322b314b08ec957a1bdac4a8ca4cea80710fe5a2efacc3ce4d688837262c42
- MD5 48e31c26d818fcf7708746857c97ae3f
- SHA1 79b2eb86596020c76aab740a7d31db4ad1d70ff8
- SHA512 ede8224b975ccd0e7b216dd61200d6240edb9e3e1ffd9d2bb26c55e0fa0fa6981f2fbe36e05993636ec1f8f50c227dcdd3c297e64b69951b162ad8a9311da7d6
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48B2CBnTJ:A3ZUnXoZ+yPz5L8acNVOE/ZxUChB2+
- TLSH T126E4BF13EAA114E9D406C1709AD54A22FB75BC671B60D2DF6368C2252F627C07F3E7B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 698KB
- SHA256 d47e288b170fda55f3cd6f02661d69e7eb61fbc0676866dd732542d586ba13e7
- MD5 98c9dd1736810dc9081f084753de19fc
- SHA1 5a5e5a92cc4db068858a87375e6ad9cd36df0600
- SHA512 b1cf26baba3c50185a4886f1f8db5155270807903714315ab8a9d474b9e5b26520c3e45b8dd724951217b9c792a5514063447ec4494a63bdd65ff1fd17fd0ae9
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I481F4:A3ZUnXoZ+yPz5L8acNVOE/ZxUCh16
- TLSH T186E45B23EA9408A5D5069130959D4612EB75F85E1B6082DF277CCF212F26BF07B3DBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 716KB
- SHA256 ed968c536b375d171ef7f46cf8bead6be1ff599b43e5fc274c58a09dcedd1af0
- MD5 39497d28b35330b7f824d35713a968a4
- SHA1 ae3acb5715c4bffba25b2607878197c90487f08c
- SHA512 faa0bc0486734948a1c5702b48d038271b571a26e2df4123d2351aa662a630a5bc20504d1f73077752bdf4461ffb675e899ba4ad6fc1d18908c2987d40ae1858
- SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJnoe4x9I48qsFLZL:A3ZUnXoZ+yPz5L8acNVOE/ZxUChLF
- TLSH T1F4F48D03D6D104E5D6468130DD9A4A22FB75BE921B6086FF2368B7256F327C07F3A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH