Analysis
- max time kernel
109s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 01:08
Behavioral task
behavioral1
Sample
2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 845KB
- Sample260730-bharfshh39
- SHA256 2a4fee3c89006276836a4ab9c4cc351799a1088c6971c15fbcb72d2868195fe8
- MD5 db7c1792a3b69cd8331763f1656273b0
- SHA1 861ce25b6f79a868aff8f4e4f81141e4ee2ef251
- SHA512 bb411cf07d35c7fe63e5c2b735ab3dafcdfa505db00673b6faaefe97f6d61b68ad4e124a588fd15cdc4e01ce46f3658a3c0300dcfd26826cef860ee7b99054a6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0a:A3mnXoZjzyacNVOE/ZxUi9zyk2tN
- TLSH T1F905AE13E7A114F9E116823499D50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/2960-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c54d-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2960-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3336-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb5-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001babc-243.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000019903-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-561.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-610.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-745.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-978.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1101.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1401.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c54d-6.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb5-59.dat aspack_v212_v242 behavioral2/files/0x000400000001babc-243.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-263.dat aspack_v212_v242 behavioral2/files/0x0005000000019903-445.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-494.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-561.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-610.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-629.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-720.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-745.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-794.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-856.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-876.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-889.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-896.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-909.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-928.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-953.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-978.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1022.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1052.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1101.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1140.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1171.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1178.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1294.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1331.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1344.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1370.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1383.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1401.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3336 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2960 2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 3336 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_db7c1792a3b69cd8331763f1656273b0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2960
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 845KB
- SHA256 2a4fee3c89006276836a4ab9c4cc351799a1088c6971c15fbcb72d2868195fe8
- MD5 db7c1792a3b69cd8331763f1656273b0
- SHA1 861ce25b6f79a868aff8f4e4f81141e4ee2ef251
- SHA512 bb411cf07d35c7fe63e5c2b735ab3dafcdfa505db00673b6faaefe97f6d61b68ad4e124a588fd15cdc4e01ce46f3658a3c0300dcfd26826cef860ee7b99054a6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0a:A3mnXoZjzyacNVOE/ZxUi9zyk2tN
- TLSH T1F905AE13E7A114F9E116823499D50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 026cbb8740e51b5fe83753cc53625f613f42d577a013a6c4104f1ffe5f68f1c4
- MD5 9c280362230adaa20e9e31e49bd1a7da
- SHA1 236db6f79266782ba9075b70f380fee0b975869c
- SHA512 3046f7e425dee88a47d4ad566c4f9fae69600b6ddd6657d29819f22e2fbba81c5ef02154906f797b3fcb20720db259fc29e282380d6f73ebc0c87772d6563f25
- SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUi9zyk2tZ0Le5ji0hmxNrM:A3kMK8Pji0Aj
- TLSH T182656B17F6B442B5D023C1B9C9D29A5AEB7134521B308ACF1399C3282F67BD19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 893KB
- SHA256 5076d2dee3a200bd76a3596f5496bfae45b220295692049d75315157b55f43b7
- MD5 bb94f4986260b2c53718defe55964b3c
- SHA1 4d8c6da44393cc71223df8d967be53e0e99dca89
- SHA512 d32d2cf48d9b4b14c79d896ea6f57db599709539895e22d666f5d64cece46f851b6db16d3fb65477675644430c51269f8a23320a3caedc92470fff88e0d8c643
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0vb:A3mnXoZjzyacNVOE/ZxUi9zyk2tIb
- TLSH T16C15AE13E7A114F9E51A823099E54A12FB75BC671B60C6DF236882252F637C06F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 869KB
- SHA256 b9b075ea6020d29e1c25f3d6cc9979e706baf7049d0388997728bc93ae8df967
- MD5 474c332ddbbb32583a2ca6e0ccbf4121
- SHA1 8205492c64f1cae6b83b46ae062be30f2363c820
- SHA512 97b183bb7c818a7fda0b1ab3ee24916ff3d4a1c94396446386ed6b2f7a942a0a0f1d2b13d6a062567fc1348c0d6dbb71448960318b8adc184ab121d1e5d55ace
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0d6:A3mnXoZjzyacNVOE/ZxUi9zyk2tK6
- TLSH T11115AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 869KB
- SHA256 d92e0b9e3bb8e3ab50a204472506d6af9f1c00a03a9df80b90be78ba8239470d
- MD5 733fc27ad13e7a8faca4aad87cc9c941
- SHA1 f2663aac50de7f599486df12d79534cbff758f9f
- SHA512 3d39d7b1c721bd675d427a0ded59a3666b9268e8964ccd4a09f00af1a4237cff196acf3f7bdd2496e6081f30490f0af90e6aee1f50b14fc6c3112d4161598d44
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0jo:A3mnXoZjzyacNVOE/ZxUi9zyk2tyo
- TLSH T1DD15AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 869KB
- SHA256 f45e4b3443e98150eef521405de58339484a89dcd446157787f1b1571bd7137b
- MD5 f61fef700f731106aca015431152e91f
- SHA1 33672683ee4dd422f65cfbac03d5efc429c2ab32
- SHA512 30b946993f0b66323ebd64ad52e26f05ff804c4002a324530f0dac59e6721b74a3717801aa99b5c1efa6f9c05dfd7314c6ca4aa6fac10303de219c546a909739
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0Xu:A3mnXoZjzyacNVOE/ZxUi9zyk2tmu
- TLSH T1C115AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 869KB
- SHA256 461b1e15e60b40d2d06a9c018e8699851fd45c3db7b84b269a97ba38cad80018
- MD5 0f65ad11ed2e61285b0681247aedc26b
- SHA1 f18f2e2220ff936c1d20ba87c74352636843b64b
- SHA512 4d944098409e86e1732713bd89dc52359285200f04c49e7d518b9bfa462317accf19555c5090ac441f4642fd6e95ea91d37331bfd5b9715bd70bcd2b6d49b48f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0l9:A3mnXoZjzyacNVOE/ZxUi9zyk2ta9
- TLSH T14515AE13E7A114F9E116823499E60A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 869KB
- SHA256 1fcaa2554441f0d0a7e7a475bb5f0b91281a251df1ef9b5a3c96df62154492e1
- MD5 0898a2156825caf75cb4513e4e4ce289
- SHA1 9cfd4789d4cb01eee6e06c90ca8f235db0e0b314
- SHA512 c933d272cf9f7521cbc743cfbbbb7e599afa66659ff096a37ff4a4005ab404c9f1b0db8a12edbf7ef5786a456cda7d0bae93269cc5abbf51c6aa84ecad28da80
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0Bc:A3mnXoZjzyacNVOE/ZxUi9zyk2tac
- TLSH T15515AE13E7A114F9E11A823499E50A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 869KB
- SHA256 cf645464fafa545547dd94f6f64b9a958cb0bb1d49be73984aaa4763d6604286
- MD5 1d4bab94e0fe26fc1e5e3499ca9a2ef5
- SHA1 aaa325100839f3facd315cd296c7f776a13e283d
- SHA512 bb6dad119414ab99c16b730c4652fbf916cd35f7e232c96f91a52ec03ee45de8d86e8c4ca372900f2aa63e72bfb809dde2b018394de80afb86fb8573485f04c2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0qp:A3mnXoZjzyacNVOE/ZxUi9zyk2tTp
- TLSH T17B15AE13E7A114F9E116823499D60A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 869KB
- SHA256 607e4cdc6beaeaa80d077cba71c446107bfb564ca03f2e7feb0e442077ba2ee3
- MD5 748bb9e2b81ffcf3edb4ada187c0e2a3
- SHA1 5f2be2502f321cd79841bd98e21798354323c3a1
- SHA512 ee5b4a320bbf115dc8f4aaa6612749c0327377d57c5857f11222b0574b579a9a3f7f88b5044bd6727e1d8587bf66eaf6c3dc243a1f166456da13a2258cc43abd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0N0a:A3mnXoZjzyacNVOE/ZxUi9zyk2t0N
- TLSH T1AD15AE13E7A114F9E116823499D50A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 869KB
- SHA256 f429974f5f6dc60bc6f62db38c92f1e578484d81e4ee4a3dbbe0c459168fd1b9
- MD5 39615bcf0bda7e2790a19bcaf6fae17b
- SHA1 dc97b9a62e97e0796122e5ead7d6b2a742b7ac41
- SHA512 bcb3c13fb13ef88ae87f71b1231993abf0c3d93a16f95b0ce4562b77877904f1abae24463de2cfeb49b8e5f4792d7acd42e98b81405ea8c9904b181dcb4adb53
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0/F:A3mnXoZjzyacNVOE/ZxUi9zyk2tcF
- TLSH T13915AE13E7A114F9E116823499D60A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 869KB
- SHA256 0f9c51d95a6ac31f35e6fe5dc8df0c7722b0437909c425bf7c342bb42fdab354
- MD5 acea02e3424b34015cf982227bc090c2
- SHA1 416cb2a9a60021da3e1925a4dce08b8166ce697e
- SHA512 66a093ff65a004ad7b9fb556209febd40fd0cf14e8bb5376dee97a278ebb060dbb75794b272c0461039b867b31631b7a82cac3fc1e9f55ad0dc1914c35fc8a74
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0gC:A3mnXoZjzyacNVOE/ZxUi9zyk2tJC
- TLSH T1B415AE13E7A114F9E116823499D60A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 869KB
- SHA256 7276892a17603dc51f86deccf11ba4a02ebc1d3f291ed1c9dfbfacfdb82b66f4
- MD5 e989eaf40ca09c9a6297a8e4a5df66ad
- SHA1 64af2cb54ed49d8a814070b937f1593826469da6
- SHA512 8addb02ae28e8bbc28238f7538df2e34a02583750721b2aae03f4ee72605dce788a896d414708f75a86d9329b545aa50667c17050b14459d94c5bc40d714a9c7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0zw:A3mnXoZjzyacNVOE/ZxUi9zyk2tqw
- TLSH T12615AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 869KB
- SHA256 3ce5b73c88ae5a9911ce0b1e028a9bb17a6f7f32105ce3fec4dc2fb7d9fd278f
- MD5 df09d2afdd1da52460b48fd4381a8421
- SHA1 020a1131a1393bd02032dc965c72e2f61c356441
- SHA512 adebe91f5a8b341d22272573e5478a45952d0a35cc202d88d7c7cf0197ae1f6f1d9759238bd0b4a169e47ffd7e5b5f917fe806545f648ef2f17e60aefb12b9d9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t06T:A3mnXoZjzyacNVOE/ZxUi9zyk2txT
- TLSH T15E15AE13EBA114F9E116823499D50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 869KB
- SHA256 70c73818431c4b78bf2d5b84d3b3723831cbe7ef3fcb0464b8eb76542147da7e
- MD5 f45aa943642ac832b9afc98f7a713167
- SHA1 7b03f662733c03c46b08599df4496a077e70791a
- SHA512 05a86b19acae47b24c6bad216a6b3e60f864a42454778fb07abd129d17874beacd19acedb5c61f7604d225fd55569c97cf0d95abbf073e12ca2097b1b0a17d2f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0au:A3mnXoZjzyacNVOE/ZxUi9zyk2tfu
- TLSH T16615AE13E7A114F9E116823499D60A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 869KB
- SHA256 d4ea4a60bf2a8e10ca3c234d2298a03849659ed0e41c59b936543eda91af967e
- MD5 ce267a1d04dc901bf0269be25b65abdd
- SHA1 63e2e925841091eda036191997646b8003c2ddd5
- SHA512 72bc0d3d28178635cd6706ae0920ec0029daf71678ade5ba8498f553590688d4fa36170b2c21151b87070a6247b15d838446812c426fc6dd57ef70f9ddb68534
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0kb:A3mnXoZjzyacNVOE/ZxUi9zyk2tDb
- TLSH T1D615AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 869KB
- SHA256 70e6b0cc5139a1183fec8417b735cfe2bacbeea235b2e397338b251c4b64ed85
- MD5 8d42b397e4af245ffe2e68aaeee466d7
- SHA1 720869e2ee82e54006cab080ff2db8d33781611f
- SHA512 406e085c42a7eed1d1f28aefa9c65af263d31c19ede8f2ed470c978769dcc9329b6a3375eea6e1084e2871783cdb0b97abff33a29cf1ee5771262af4d6372d9a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0qf:A3mnXoZjzyacNVOE/ZxUi9zyk2tXf
- TLSH T1F315AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 869KB
- SHA256 f27e9df1fb38ebd428a8d4c2d7b1d552a7089edd1f7b6e31762a23db6c56ac50
- MD5 6f32625c12efdbef014f351b33f2a5ec
- SHA1 5344b7c13656eb17f81ae2ec7c4498266706e4d6
- SHA512 1dcc5fe7558d0bce6c79ea87a740c9eec6532deb142a0b0a0ab0ea5bda616384d27295f4d42ab828b371b4c39b0b05dbaac46a2c8b7154692c3a760905430b50
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t03K:A3mnXoZjzyacNVOE/ZxUi9zyk2tgK
- TLSH T17315AE13E7A114F9E11A823499D50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 869KB
- SHA256 ca63424fcf1efa91a2178d91233990066c4283117add995001900ab51b750552
- MD5 5d6ea48abd8e89651e2569a1369ba72c
- SHA1 2baff8f365780d75632be5e1ee30b4a381f400d5
- SHA512 8f03111f454cb2249b8b75923579f4e29b3eca3219c6b12842c8e06b19edffa033f3fa9b448eb5dc727b051304ebeaad8b6d9d2bb7f311dc69631a103379d246
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0Ak:A3mnXoZjzyacNVOE/ZxUi9zyk2tdk
- TLSH T19115AE13E7A114F9E116823499D60A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 869KB
- SHA256 549918526de5e907cdbf5a7cbc4a7833992da37dfe2c621849c63d8483429884
- MD5 7292888990e98aad6b26cde4992bfa72
- SHA1 26371d2d4a8a741281eb9efc4b07fcdbee2aac5f
- SHA512 c8d55129688ef06d41222240c018fdf23c1cb4e3de74abf7f4ecdd497cd015d85553d81618ece7b6a0b4f718e790303f3cc0baeda65f990dcc27a390a940bafa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0x0:A3mnXoZjzyacNVOE/ZxUi9zyk2tC0
- TLSH T1AE15AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 869KB
- SHA256 6cfdac0d22647e00327b895fdf9b56fcb36bfe2f133d74f152702266b03842d1
- MD5 e87a4d723841c1f3e3f72cc7465e3d75
- SHA1 2ad72d1a628ed90420c3e9180063da9cf2c275bd
- SHA512 f47cb6845e543a52043dbbb2dbc6f17305f5e861917dfd7c5bbbcf350e173b52d7dd467e0fe4af2b375cb1ac3497722ae82f34ec2fd182eb0326e780667cf63f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0k70:A3mnXoZjzyacNVOE/ZxUi9zyk2tRg
- TLSH T15615AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 869KB
- SHA256 ba416e797747a550efe1fb486f940e75828a4316fe615718befd75955d95a51b
- MD5 e3a82b181cc1ae01604896bd0c62359e
- SHA1 e6c8f224f0b0cea86d0f928f8916ef09fcbd32c2
- SHA512 9b87b715847185aa7aafeb9c7b628050db826844404a6eeba79585b935ea3aebc5b4440c79f427440d6e9418ef911da7dbad7de2517a2d00c13f0b6b44c83d37
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0Br:A3mnXoZjzyacNVOE/ZxUi9zyk2t4r
- TLSH T1E015AE13E7A114F9E116823499E60A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 869KB
- SHA256 78c9dd7b2e850d5996f99754710a2c4f1f395fc848753b8dbff0b702e4857708
- MD5 01923c2617085459bafee811ab26e6aa
- SHA1 be9f2c3d8ee25a5c1707aba8ef9a7280ca29e735
- SHA512 fa6bb731f4a32a6eb73e294af69df509832b417164bcb78a8e0c82e3f3606b76dcd67e6e58c57814caed0349a3d2e77e198533e4996e1164f789178a0a46a074
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0Dn:A3mnXoZjzyacNVOE/ZxUi9zyk2tWn
- TLSH T12C15AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 869KB
- SHA256 6f609315e0f346561089dd6248b72eb743ae072dd7be1d60c16fe2928fc1d176
- MD5 7c9458a2f12ba68c1d923f929245a882
- SHA1 4c2f986cec25175a81971eba6477381d27047ec1
- SHA512 f52a3c8d905f37728b4b2b24c7b0a2112d4bc6b0a06ea7ce027185843a7e025bd246ae85eb97370d1ef8d4db28284d9ebdf81f2f1528c8fb6d8f38c9263c8ada
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0fx:A3mnXoZjzyacNVOE/ZxUi9zyk2t8x
- TLSH T17D15AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 869KB
- SHA256 5e3b1d8c3323d7e2ebd8d1dfba2fe2535c72fb1ea0f5fb1f86d5b79d3aab2ae7
- MD5 a5de29d7e4e609a0bf2944f744d6c7fa
- SHA1 710dce05f149021edf8d3b3933476a6c02a5af24
- SHA512 66566e4cde734312d6fd492efbfed91656fdf5ac3b17441f628271c08e611cdee7e88b545492d7bb7de589a543f1204da06951f4efb3d4d044b0872c2392cbd4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0FA:A3mnXoZjzyacNVOE/ZxUi9zyk2t2A
- TLSH T1D915AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 869KB
- SHA256 fff9d8cdad8088e1df7a77fc5a17366a8ff8a8dbdb784847a392677f00fbe79d
- MD5 e788d5b668d2c33f8b3e6638cc350f97
- SHA1 fd358b3bd9d4e268c44477967ec3c9b26f454c91
- SHA512 aef128f6c5d7283899a0d59e2f4eb3c38aaefcecc5591378a1f69ba05ea16a47c96dd6a4ed0f33b1dadc48eea6de141002dde0e1fe978715e14a4362915059f8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0+9Q:A3mnXoZjzyacNVOE/ZxUi9zyk2tv9Q
- TLSH T10F15AE13E7A114F9E116823499D60A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 869KB
- SHA256 44383993e73479ea99e7f61ebe3d608048d224b94d34eaaff367574a605263f2
- MD5 41b4380d0793b976be1ba7bd1cee16e7
- SHA1 58789c421f7911ae571cdd4b407631d4caae8ba6
- SHA512 0f7d29c4fcccb6cc9dd41b8cba873916d5d6ff7b895058846ddc649f1a37937bf22823baa1539105a5923418608426e2eb9b72619a56dea37b7f1db2ffe1ca34
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0r4:A3mnXoZjzyacNVOE/ZxUi9zyk2tG4
- TLSH T12215AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 869KB
- SHA256 3f8f4c55cd11d431c765c148cdc459fda959f11a5dbc62c336b6818931658108
- MD5 f11526a46a18081ad13a0edf41fc3d57
- SHA1 38c4a3e88e13caae9381f31815e4c393d6b05962
- SHA512 c5918541ba29d6aa5843f3c854e9a60987244e04d109e18d9d9b027dfe9595d1583149071d79f658df62ea8232dd0532211fd370339baf6269a0097fd0439c91
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0iu:A3mnXoZjzyacNVOE/ZxUi9zyk2tVu
- TLSH T1EC15AE13E7A114F9E116823499D60A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 869KB
- SHA256 5f46a86f0086749212cb801ef14a5febcd496d037f88b6c9279bc6171dca52cb
- MD5 b235a8bf48aa97c09d316e92aeceb7e1
- SHA1 662730519beecb66c8703c673223e64b255e31ab
- SHA512 5528b0b77f51a96f478e2d011321e8b80c1b6bc5685ab321993ca669e3e90b5dbbb8c95bfff19b90ab72656bc1b70a5b025928fc167b9894081266eda7cc74e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0zj:A3mnXoZjzyacNVOE/ZxUi9zyk2tIj
- TLSH T18715AE13E7A114F9E116823499E60A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 869KB
- SHA256 cbeb18030749b550692693f84f38ebaf831349d992379d8f7addb8bb1e73af3b
- MD5 db59a6febd4fd7e63862099faa4d1b4f
- SHA1 bcf1234ea95a43bffb039843564584fd127e137f
- SHA512 642b17b6fd36db8f44580a0a5ba1679a958013b454229a1d1f707b4719e5eecbd9f718e3b0302aa986977c4b96c63399741f983f5637cd771a2f6cdb0e6d81be
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0+g:A3mnXoZjzyacNVOE/ZxUi9zyk2t5g
- TLSH T1D615AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 869KB
- SHA256 7a24cbfc13254f27c0bd7cc5c6c180e904c16e3ec2fd39e0af88d68a47e170f7
- MD5 21bc88e749a76be12496eb2d77bc02ea
- SHA1 178d2fb835e3000491e106dbe7f0be53730dfe48
- SHA512 b5e7b52b31b896333dd3f98265f1ecaddbe31ddbbfcddec6dbc0e551534e601bdb05d93962400116b1998b97535d283f26a6df14cd5309b0f35c2c80b14d7796
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0xI:A3mnXoZjzyacNVOE/ZxUi9zyk2tgI
- TLSH T19E15AE13E7A114F9E116823499E60A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 869KB
- SHA256 585bafd8eb251773d62a400e890b4a1b6e56e90cc76ba8640d0156b31fe0dcbf
- MD5 6602bbcda15996d91f712504d8afb8d7
- SHA1 2fdf68f3434f28fc9d0593d24ec19c4c74210545
- SHA512 9fb70884ccc36990fe8b66130b8909834cdf31534fa991b913b584638db5e9919f5bf1316b1efd05e0305b1be4d62b0a702a6f4dc8a1aa23088be2431accfae5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0zo:A3mnXoZjzyacNVOE/ZxUi9zyk2tio
- TLSH T1A615AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 869KB
- SHA256 662523964136274b92e0b55af5c661ebf62308d3ba3de7f362ff189728bfb241
- MD5 3c3e883861493f8c35fcbdcc5f968a33
- SHA1 ab21ebf7f41d4f262e97fc0cdcacb14fe3264b51
- SHA512 fd564939d5cbeec6c9016779380dc407f71b4253aa19d0fef577f4c8d4b393c04dec219141cef3e5f98c607aad5fff89cb779f663a2f0e7be6edb4d3bf7bbec6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t04+:A3mnXoZjzyacNVOE/ZxUi9zyk2tZ+
- TLSH T10D15AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 869KB
- SHA256 eacefb7e46a476435c67c90128dd1af617437a8e1d8f72f30f0622c847bca9ec
- MD5 1c3f6edc458c55f6bca7269173c666de
- SHA1 4381aab6a2ccf7d9da713026b77dd666c0841ac8
- SHA512 b32702655af415bcd91b1226cb2f802d3264a3665abb9cba0b95b100f86014c1e013d8ed6c37b94e31306f945222335504f087587e6a0704dede9fc48477bb5b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0QQ:A3mnXoZjzyacNVOE/ZxUi9zyk2tHQ
- TLSH T18B15AE17E7A114F9E116823099E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 869KB
- SHA256 d4f8e9971e04148df9ad5ad47587efc2951d626e15bdfd13e2371ea4bbed5e93
- MD5 12ba350073a414dfbc2dbf535a883862
- SHA1 bc8d3cf10083a10e90adfd560e4c44c918a05f58
- SHA512 0676eac2f73c2b5afaeba5614704377a537fec4d81aa3e40977a648d6550d2fa950aa70b70721b7ad02f74a7a5dd810bda084084547a04feef44c82ab1c867b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t05X:A3mnXoZjzyacNVOE/ZxUi9zyk2tcX
- TLSH T12615AE13EBA114F9E11A823499D50A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 869KB
- SHA256 d1d7c05baa0b29f7048992a81eee3acc9fe79d5a41eb2ca08a3a3df578920afe
- MD5 d29f3ffcb8748d6f71984288eaf7c828
- SHA1 e5d404f1aea19e54760ad6d4bcb57ed804ba9ac7
- SHA512 736aac7392a5eadf087a5a57b9dd470bc8d8bbd7bb58ca5e80749eddcde9abe3209e76bd32e4bc3751ba7b38386de174c032a1e37a24380c7a4cdd4bd0585379
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0TL:A3mnXoZjzyacNVOE/ZxUi9zyk2taL
- TLSH T1A115AE13E7A114F9E116823499E60A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 869KB
- SHA256 4ab8250c3963095f660409ee95e0a3eab53af8379e503a1cb970ba4790aade35
- MD5 298fca2c709f4d76d8d9a7962e1c559d
- SHA1 babb268e5140253a976a4a75726263556d2bea17
- SHA512 5b043249184d6575b7d56bb6a4f8e37b432a2eb2cfc5bbfe7c36dde78c80786231c4150784c8809c077dcdc8d8bedde2685cccb8d8cb166d8ad301c3b53a568d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t05FC:A3mnXoZjzyacNVOE/ZxUi9zyk2t+M
- TLSH T1B315AE13E7A114F9E116823499E50A22FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 869KB
- SHA256 2c6c941d1d64c75ae8100b6dc89bde3476c6a84a9b802c0c4e62f85418bd262c
- MD5 2b9b8abc35b9c7b4f4e7e7f7825887fe
- SHA1 dfa361b105686e635675e22211dd7c53b75bbb06
- SHA512 d9b61330f356c1a06f1c68488c89ca7e2db7d39e6823509c4ac78f876e8a32ac42a74c6fd60dcbd71d6eab098ca5fb37ceda2a2884c3307703af1711d3bd5c45
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUikyPz5L8k2t0Ch:A3mnXoZjzyacNVOE/ZxUi9zyk2tnh
- TLSH T10515AE13E7A114F9E116823499E60A12FB75BC675B60C6DF236882252F627C07F3E7B4
- MD5 SHA1 SHA512 SSDEEP TLSH