Analysis
- max time kernel
91s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 13:32
Behavioral task
behavioral1
Sample
2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 925KB
- Sample260730-qs6dfasyew
- SHA256 182a97be07219a07b1ab1de4f06b60bea44f008663664624e72bc8a97d05476b
- MD5 aa1094883dd3133657690db06fcfc409
- SHA1 bea0ebac1b43e85b67c4d9611a9e2aaddde66a29
- SHA512 8e334fe9dc1fce4910b7bcb08ffd7e04fe6084224e4766ac7d98bcd01bdcb29d83029507e8d76fc9c544ca5e4054cac846922853a7e86fd659f4334d9b15ac48
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8TD3JeU7vinrmC:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmC
- TLSH T153156B07A6951FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral1/memory/3480-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245bd-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2768-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3480-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2768-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b6a-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215f6-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ad-275.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235ac-444.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202ab-493.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b2-512.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000202af-597.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b4-628.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-683.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202b6-727.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202bc-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c0-790.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c4-797.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202c2-846.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c6-859.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c8-884.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cd-897.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020307-904.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020305-923.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020309-937.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030d-956.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002030b-1012.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000203eb-1049.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1068.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021266-1093.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1130.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021269-1143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126b-1174.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126a-1187.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126c-1188.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126d-1250.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021271-1330.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126f-1349.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-1374.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e6b2-1457.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001e6bd-1494.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001700000001e6a8-1555.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023060-1905.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245bd-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022b6a-42.dat aspack_v212_v242 behavioral1/files/0x00020000000215f6-61.dat aspack_v212_v242 behavioral1/files/0x00030000000202ad-275.dat aspack_v212_v242 behavioral1/files/0x00020000000235ac-444.dat aspack_v212_v242 behavioral1/files/0x00040000000202ab-493.dat aspack_v212_v242 behavioral1/files/0x00030000000202b2-512.dat aspack_v212_v242 behavioral1/files/0x00050000000202af-597.dat aspack_v212_v242 behavioral1/files/0x00030000000202b4-628.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-683.dat aspack_v212_v242 behavioral1/files/0x00040000000202b6-727.dat aspack_v212_v242 behavioral1/files/0x00030000000202bc-747.dat aspack_v212_v242 behavioral1/files/0x00030000000202c0-790.dat aspack_v212_v242 behavioral1/files/0x00030000000202c4-797.dat aspack_v212_v242 behavioral1/files/0x00040000000202c2-846.dat aspack_v212_v242 behavioral1/files/0x00030000000202c6-859.dat aspack_v212_v242 behavioral1/files/0x00030000000202c8-884.dat aspack_v212_v242 behavioral1/files/0x00030000000202cd-897.dat aspack_v212_v242 behavioral1/files/0x0003000000020307-904.dat aspack_v212_v242 behavioral1/files/0x0004000000020305-923.dat aspack_v212_v242 behavioral1/files/0x0003000000020309-937.dat aspack_v212_v242 behavioral1/files/0x000300000002030d-956.dat aspack_v212_v242 behavioral1/files/0x000400000002030b-1012.dat aspack_v212_v242 behavioral1/files/0x00060000000203eb-1049.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-1068.dat aspack_v212_v242 behavioral1/files/0x0003000000021266-1093.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-1130.dat aspack_v212_v242 behavioral1/files/0x0002000000021269-1143.dat aspack_v212_v242 behavioral1/files/0x000200000002126b-1174.dat aspack_v212_v242 behavioral1/files/0x000300000002126a-1187.dat aspack_v212_v242 behavioral1/files/0x000200000002126c-1188.dat aspack_v212_v242 behavioral1/files/0x000200000002126d-1250.dat aspack_v212_v242 behavioral1/files/0x0002000000021271-1330.dat aspack_v212_v242 behavioral1/files/0x000300000002126f-1349.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-1374.dat aspack_v212_v242 behavioral1/files/0x000500000001e6b2-1457.dat aspack_v212_v242 behavioral1/files/0x000400000001e6bd-1494.dat aspack_v212_v242 behavioral1/files/0x001700000001e6a8-1555.dat aspack_v212_v242 behavioral1/files/0x0002000000023060-1905.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2768 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3480 2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 2768 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_aa1094883dd3133657690db06fcfc409_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3480
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 925KB
- SHA256 182a97be07219a07b1ab1de4f06b60bea44f008663664624e72bc8a97d05476b
- MD5 aa1094883dd3133657690db06fcfc409
- SHA1 bea0ebac1b43e85b67c4d9611a9e2aaddde66a29
- SHA512 8e334fe9dc1fce4910b7bcb08ffd7e04fe6084224e4766ac7d98bcd01bdcb29d83029507e8d76fc9c544ca5e4054cac846922853a7e86fd659f4334d9b15ac48
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8TD3JeU7vinrmC:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmC
- TLSH T153156B07A6951FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 954KB
- SHA256 68128b67064bee9d975d22ec3b38e45cd484d64d802ea4a002b55e0995a71643
- MD5 65ea1a4419dd85230990933a9c6528cc
- SHA1 43719afba65726a9a302599f03d78360c8375235
- SHA512 9e1c54de4b87f21fc36af534b9ec7eb8893b373f33913293fe98ba0b507fbba5f88593d5791aee613205f7e58c1df11a1e5b12ae68abdba45443ded291420c27
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmUP:A3kMva56rB
- TLSH T130257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 972KB
- SHA256 158bb1b3f8b0cc7ff7a527268e64f7127d65a0d1f5f20209b1be54192f061869
- MD5 296a4b1f7d9c424d41b51249e02fcf85
- SHA1 d6a74e1f47e7715f92f33dc6155aca5599759ad2
- SHA512 2c2aef56978f97520f762fc94c0ee1a5c4089329b53ac2da9a62bd8944068ba43492f4418fb87959e1286f8f5fc2b79736b879f5ba7d8646ad0bcdc05a98db0f
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmz0:A3kMva56re0
- TLSH T1E9257C07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.4MB
- SHA256 a58543fcbd7c90644043b852a71f9b9e2b91656c9d9afa3509400721f2eac648
- MD5 2fbdd02cc266a0fd9cf6aed4f10b4971
- SHA1 2fc36f3e75a910165e9e1fbd8251e879ef7aecb2
- SHA512 a1a841b3480cec22e96ce8e427886b2d7ac3a1d1ea0d6e8d45bc40f2ee9fe65957e107a6ef14ccdf9425c2a7d7fa06e114640642c188773a42c606a2dd5931f4
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmO3Td9CHKy7GZO:A3kMva56rXTd9CHKyao
- TLSH T13B655B12A3941AE8E17F823489A24512E7777C665F208BDF13646E253F337D09E39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{1D3AEF70-1DB8-49F2-839D-DA72081B59A0}\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.0MB
- SHA256 0595d002ea7fbc07098afc1955eee7e77df080cf98ed38f07df6232e74052ee1
- MD5 24f24e31d013233676090e9f10e35e41
- SHA1 4ae10231a11d14d217b85468dea3ec295b4f09ed
- SHA512 144b6a3ebd4a1480af0a5612989cc940500c75d0d0ad623c96f6d94eb383f3fb4822333d832784ff3d1ce23d3b78d163d1bd8658700cf56446ccc855e2285a98
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmcbBPzBAU:A3kMva56r9BPVAU
- TLSH T132257C07A6940FE9D12F813489914A62E7777C225F2087DF2354AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 a1c9619b469dc21d9a3465371b95e04f78e166a1424d10342e0af7c6f95cdc95
- MD5 edc79d546f4af9def73f24a4ddf4e9e7
- SHA1 75cc992ba71de2bb3a732965e40850cf2b5d5b69
- SHA512 a9559960c8c944fef8ec8046718b9893f0216c7130bb05bf647102f7b57946af9e59430e778f427eb459d12d24fec096beaf2f055b2f7014f0b8c1d92f07a526
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmC0Le5ji0hmxNrM:A3kMva56rTPji0Aj
- TLSH T1FB655916F6A44BA5D02BC078C9D2565AEB733C521F308BCB13549E293F277D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 940KB
- SHA256 26a80385b60b6a657c07f15c0bfc758e1b4413613af87aa9ea9171deb43ba137
- MD5 f18d572bbd722adda2fa8497b1712f73
- SHA1 42702d5bad0101a8d24f5432c9fa4713a2f8bb9f
- SHA512 d21a830befd8c175994842d7c4042b7c72c9c0aa1e5fb13b4b3493dcc99b0d119966cbcad23897e3f200db26d102179ada65368d01d738833f7a3bc8771a155e
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmMa:A3kMva56r
- TLSH T19C256B07A6941FE9D11F813499924A62E7737C225F2087DF1364AE253F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 973KB
- SHA256 9a7e0c0b3df4eaa37c9c684be4a15ca6fc411b6f6ce192aad51774e9a330be0e
- MD5 5a3a51cd4ce85638b782b7fe38609704
- SHA1 4b056754c9f87b0d6ae471604597571ee819d62a
- SHA512 47c544e09770cf453a214b9ebc442af42660fcfe9b7f9d3ac5477601c695a47e5fa47820c14cdaef707412e09e88f883c05ab798ac667427c7c91ff57526e017
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmnb:A3kMva56rWb
- TLSH T101257B07A6941FE9D12F813499A14A22E7777C225F2087DF1354AE263F327C06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 949KB
- SHA256 96e7942889409271e412400c3f90e4a74d57ccb9e28f1cb7f5e43dbcb75ca573
- MD5 636dcdd652de31edd382391260ba2b93
- SHA1 a1907097bf6c141d53a8bfe438e62d93e451fcff
- SHA512 8883cc1de40f7ee318b4ed70c642e1922add429e0b8b441238d321a362f1b8d36bef24baebdb4cffab1cbb57072562d3d2abcd2a8f650a0b15fd9843fe535d17
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmd9:A3kMva56rA
- TLSH T113257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 949KB
- SHA256 f90cc0f96ae11de46757bc5739844dfdc0d97223d11a6cd4cf9328e7c0e20e3f
- MD5 ea967e76a07994155f2855246f0f068d
- SHA1 93bdf03113ba2311282bbc115858e2ea64771553
- SHA512 16bd9172ca0b50e5f307c2981bbb6e4527cb66dc084cf9803563dc5847b518a5e1063c6f42a0a4587740a883eab0bf8a734d5a1258d124793830344d2049c9b2
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrm5c:A3kMva56rx
- TLSH T162257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 949KB
- SHA256 ffd3099cde98b3ea8cdb9bb4146c378c667fcba362f2ad7c6ee10e317e4ce617
- MD5 0103f2f4ad512630b72e1968942a3b5c
- SHA1 191af3151573dbca0926df1699257325633951f5
- SHA512 d9082585c663254b3f6613808caf6604c40a7ea817af10c70e8cd8017151ae79127fb2735bf288ac38bf070636249c9682165528120470e1fa8952a774225424
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmyp:A3kMva56rP
- TLSH T14E257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 949KB
- SHA256 d431f5595263321b9c482472ba5b04f4ac6dc0e91957d64f374961c36f9a1acf
- MD5 dc83c2501f26978c701db0230499e395
- SHA1 81a7048734909acf2b169890116baeaf20ca464f
- SHA512 328f873389057ff4b629890b004939cca5716321fb1ecefadab28c0d4b42e4a5aee300e352159213e8be988e1b68fee4c3967d4eeda7104cf236c9fac74f9118
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmFN:A3kMva56rE
- TLSH T149257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 949KB
- SHA256 57c8ca7425418b816741177d5fdbfd21220bf21aa926f72bf92bb9aa2d21b332
- MD5 98ab65b1ffeaacca0e053a907cf230af
- SHA1 83e62af16d99d1ea4f94cf28992f6d743bb73253
- SHA512 89fcb6c3ce1f570325e46e0c4a9a7a0249fc1d2b6f18aa0a19295270eab6cc5f1dfb5948190cde3b18c58cb8638b65923b4b7ce0c74ab7c195f8a33eddb92376
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmXF:A3kMva56ry
- TLSH T1A0257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 949KB
- SHA256 75edb7c2e09b48eaac8458014ae06ee45dab482fa1721b0bc4e445964500ce89
- MD5 39db4a2a098fa032e8866b4861142682
- SHA1 ee1b6bf05ef4adcf2b285b23669e79d5369574ca
- SHA512 516b70d0f6817e4e2906ed3fd472d42e0c651b60c7a34a88ace20da6f55b9a9d8cc87f9b23c404fcd7a81fe191c8f8be91a31e0d00090fa126d9989d17649905
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmoC:A3kMva56rG
- TLSH T118257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 949KB
- SHA256 85fe1dff23f526f6ccc671f4e23a0e6feee589090da018d911f26e3e013f1f35
- MD5 0ba7765e0258e06a7064c7a5b2d634fc
- SHA1 83f8a31010d98733daa036a1fb5177ab4605bdc0
- SHA512 954c6f5403c2fc19c91370728e5164171853135e1cc7fa0e83fd519316e6b875f5af576cb21ff62e1a1b1edad27e072884023612280c82dd95c55dead67c6038
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrm7w:A3kMva56rz
- TLSH T170257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 949KB
- SHA256 96bcac991719beb99a093c7439222773d6209b85899bb8047c6bab3ae0bc5b42
- MD5 41e99150a5fd1922a0ed04c94b21d690
- SHA1 59d5ee44efcbb94c0feee09395054908a868341c
- SHA512 992ea21bd09835ecd695417399d1c6c3a78a5849fe67e8116359033c26a1d0b9573406bd48db9e72c9ea527e6842a4068b1f271bdb69ae2d0a187f85a178fea6
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmCT:A3kMva56r/
- TLSH T1D0257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 949KB
- SHA256 57d612a864817bb1dbfaf9148b7f0a4b72bbdac51526e529ea7495f87a0988ef
- MD5 020d5045d65622fd1dc704c3dae9ff37
- SHA1 ba5bd2fa75bb23921a8b1837ba8a753ec41ab847
- SHA512 e57755b2bfda3007352e668e4e090a8996b1d9bba738f453aafafdb61555b6b85966aec1800dca20da319e400a77b53c29bf4f6c548e8be7ed12f69d4e4eff6e
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmSu:A3kMva56rQ
- TLSH T1FC257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 949KB
- SHA256 6edbd3acb196032d3489d7ac22df878a0bd00143b8091ba81b13a3ff53adf768
- MD5 9332183560114e6dcfc7379cb12217fc
- SHA1 f74048faa473c5f879074c12406c49ad7f292e2a
- SHA512 bc6b5ac58450ca492beb3e424b0f1daa987796423f63f5f7d6e985dc92651d43ed016dc6655a42974c7a0ab26e52d0c441a5a7f4e04d2cdb474d1bb6140b24f3
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmMb:A3kMva56rJ
- TLSH T138257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 949KB
- SHA256 e7ed29c3c6a66ccb1f41d0ec0814206e2f808656c2d58653ab8c805c74c36492
- MD5 4da907aed83e9c1cf96413dd01e09936
- SHA1 8dcf8beeb0cd617ec24c5786606a5c5fdb1481b0
- SHA512 ed098b284f96d63a627c7638dd32788c322867fadabec398ce5d63720dc369d4b50ab4bf5996eac12d11bfabe996a8ca60f239ca42e3b771029469de2b91a158
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmyf:A3kMva56rZ
- TLSH T1AC257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 949KB
- SHA256 01804b6325d1275a456bb449bbf990b9f9f6974117c6921f71c86cf7ba28f90e
- MD5 acd33683132d4f2c139fa7a4741b54d1
- SHA1 1336fc6077d4738716c546eede03e5e5f7fe97f1
- SHA512 e7974996a42648b61ace9c4d21968002bcffe1f29df518d3104b5dc5fcff8ed4203344cb97d22ec938f62794f199a4919e32a3338cbc39eff9a5d847b07d0504
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmfK:A3kMva56rx
- TLSH T1F3257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 949KB
- SHA256 a3a42caafbff396a767d8fc31fa7121bc34ccb2a8f0af05ba8093883ebe15a4c
- MD5 1ae790e088c9cf136fedc00235787d9c
- SHA1 70811299f5f1fb26c0cd97306b2df6dbb9a577b1
- SHA512 61405871dde2deecc623850d7d55bfdb9efb01981c1ba0b44d2b2043ed65b9da61f0449fb851ffa13265b83debf2db516fcfb2f05255f953c57a5ff5dc2e9fb4
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrm4k:A3kMva56rY
- TLSH T120257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 949KB
- SHA256 1141b282eed67eec38b42c0b96ae54a269fdf8106fc3495260068ed3bef12881
- MD5 80f5d3b913147e12880cbe3c0baa24e8
- SHA1 16a60c1efba9b552988c1c282b8da54c076e957f
- SHA512 b88af34047245a24d907486e78d03fbbbc1f19f2913a997d5de02a04697360934176a1140522bf1511e1ee6648c1ea4139fd6f07cc745153eaa76223b80243c2
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrm50:A3kMva56rR
- TLSH T15C257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 949KB
- SHA256 d963ff0e21e89210d8c63a166ce123538b7c03817d136b3c8ae95643b38fa715
- MD5 e845c6a5b0de4cd4d14ce8d45376330b
- SHA1 adb41808b6f8cb0dda0000abe0feb52976191a27
- SHA512 991c8a753133d5098ae768a83983624db8c281a56ca04b2ce1a8ae389ce5b309bbd91247bf3a7230d6141f9e3c0a7ff649f5efc9426a2fa7bf9fa00dbdd197ee
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmsg:A3kMva56rw
- TLSH T1BA257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 949KB
- SHA256 1c336197e87a69fb448517da26980c180809187b1bd2fd4d8fadc6d641d3c698
- MD5 8f6d95c7fe38eefacb531a49e23b139b
- SHA1 f8ab8c15dab74b2bcd67a5e44f4ce43af1468970
- SHA512 30539edb0aea0ec01d7172b226fd9a0519997e2c1328ce7d304edbfdbcaa5128278c18bfd93550c456d338cf53d9fe9237f470927f3fa83e40e21cbf3f4ac6c7
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmJr:A3kMva56r6
- TLSH T1C8257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 949KB
- SHA256 b9125909d95cbdf75223286487d266a62a4006ac17f6f418335241e98e1f6c32
- MD5 7e6d8fc4553638e38bfa60698cff2af2
- SHA1 8c27604053e83b3b31b6fae36471c6ce83fce7cf
- SHA512 6fbad853fc23e3e85cec5fbbfb9b789eff4e4285bf7d20c87189623fbd785fdf1fc800b11340c865df632de8ed71ccb322fc9a820c018dbaa20eec31653a40c9
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmrn:A3kMva56rc
- TLSH T106257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 949KB
- SHA256 ebaa4374cdc525574c52140e07b27597bc25047bcef9a0925f46ff881e35cb9f
- MD5 bf56ca647d08a90c23f9b9338a976573
- SHA1 7d058f82742e99ab1b03784b68c6d69332422fae
- SHA512 7738ee5481993c7c43d8bfe20a24553d27cf1f9a63cf3e971ff0a65bb523929c0aedac045a6aaf85257ced46134b18109e3862afe28fb148660451eed4790bc9
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrm3x:A3kMva56rK
- TLSH T194257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 949KB
- SHA256 0625eb4b10b06896fb27f1e30fc7fa11c718773f3086831c53f4e3a23b4cd3a7
- MD5 e988e0b27e90e9ed8ad1659b1c9113e7
- SHA1 e1b0befbc2a9338e6eae8d814bd058574610e5e5
- SHA512 3b3935f250d966fe778fdd0d41cf143dc4b25c95f7e2d40416acfdda295f5ecbbd3289452f2473920878dd8f9b849d123233d4a2c9115d32c0d0bb71ec9b716e
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmtA:A3kMva56rJ
- TLSH T1B1257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 949KB
- SHA256 5b47a785b611bf93d4f27368e5c0dfab64ff22a0b0eac1fc79770462aeb7e1e1
- MD5 0b7ad51f3b6fe0989825b7d7b98a4def
- SHA1 7a94d7c760bda86d21b9b6e9ddc86a58881c9204
- SHA512 a0e2d71d9e64b6c2e09eca467d550a70d4fddd70f872d54628701b1b013a3d2924ba478e33b109df2ffc4745b6e005efcba7d7bd4991328d289818fe410b1e0c
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmm9Q:A3kMva56rQ
- TLSH T1E2257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 949KB
- SHA256 6ab52c5ff38b2559b8a3a568ffca964e6e8335000ed60da0bbe7e2353027f9cc
- MD5 cfb0f0c7af21226923af62f493db5c06
- SHA1 f9d3e56313eb321ebc0ed115cd1ebd3e9fedea29
- SHA512 19cefa7e8fff43e361d02ef9f30a9489596ff006291a35f82e7050b080af7bd8f66e6ec041829c522f96e087ed9730fdc074a39695e257d834e2687b578c9c79
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmD4:A3kMva56rL
- TLSH T130257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 949KB
- SHA256 5342970e9648fe4aeb62a4758d145ab90b3b951f3b6e85fe5a70d5999a9df0e7
- MD5 006d6c94ea92d68490321c7680269d68
- SHA1 d0e7b22ac5903bad6d892eb977f75c2dbb04694c
- SHA512 a2880b06d43d1a39ff4b1cde8cfc72fdb5fa059b6a7363e47f22a87630a9d79d9de24c4a89cbc57b669c5244b3bdbc91ed7e113c04160408b06ec449b2471b5f
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmqu:A3kMva56r+
- TLSH T1BD257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 949KB
- SHA256 903bb07772ebe85efcd8556d61dc9f95b9eda62a8f2d7805605e65a2d2674c90
- MD5 9e6b8f53fda806c52ecbb3b27b47af74
- SHA1 9d7203b951e7e44d8ab574f0d471cbadf9105d1b
- SHA512 c1cb46072137d5f877d0c731ebd0013d0ed7125a7142985f687106e9868092efa687f91c6307473b7dd404ab6ca3ad02804c08920f6ae159b71f531977cce3a9
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrm7j:A3kMva56rw
- TLSH T15E257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 949KB
- SHA256 b8b41e86f19734a3c50bff066e5ec0f2a08b85ecb0e4d5bf5046f47b2509ee0d
- MD5 89369c6b62ed783b0f57db2fd0a63f93
- SHA1 c38aea5913c6818170d0bf91dba4b4afae5ea04b
- SHA512 d410d86f8ffcbae8e93257923ca9e529df39e7890c77650bf5c3b4c44d7ff17aa768ce8f960b1cb8761021635bdbacac772abbeadd7e991595a9944f855c7110
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmGg:A3kMva56rI
- TLSH T1CF257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 949KB
- SHA256 63b2b2d868fa17f3e1b6ee0e5031b49f88636f25468013102598f51f049f3abc
- MD5 41e1f850606ad92b2d6b78bbda0a658a
- SHA1 8b32eb984808963da431817485253cbd817d767d
- SHA512 165e02dd75d4152d43d343c8ce4c9c5fc2676b52c43954cf790cd5194cead571a9b2bfb21584dbaaacc0a1058287988f50cf525c143cb756ce85bc6d82de1fbf
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmpI:A3kMva56r5
- TLSH T10D257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 949KB
- SHA256 958b378b84af057352370d3f705ce4fc0c1af4229ddd0a360eb533552e4eea88
- MD5 bf993095f9bfbcf1ff537a25d8ae25b7
- SHA1 dcfda22fbbc2209dcd691bdd16c515788734254d
- SHA512 23c143769a044b29869175e790cfe013bbd6a2eff1310c656307d7077b65450a01e9f788e0b9a2cff35bf3cf73d56bd02a83ba54a6cea0e6d74d18367de9846a
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmLo:A3kMva56rn
- TLSH T1DB257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 949KB
- SHA256 938b418391f90d1fd6ee6336de539e8a89862a358fc563eb95b793525929c0af
- MD5 b0da77c68d5e9204e3cffe4db1128364
- SHA1 71d36c9cfb69f75f68cda4edac38a60531049fbf
- SHA512 83c9a126a1d54df9a00a44165b19446c9b452b944158e0d5397fe3c1d26e282ad3d07ee48fa4e2301566dd746bfb14ae42d4544b0379572d2d3fc27b63b560d9
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmw+:A3kMva56rS
- TLSH T128257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 949KB
- SHA256 dbd524e0a74638121fab257c155606f42381d79b053bbb3cbaf90c609b23c580
- MD5 6ad7f510c76e6a8d6d5e866f70658614
- SHA1 aa39b3d3255c50c957eabcea56492cf5f87f9794
- SHA512 275c9087b17f1e5a6e588d6ec233428d08980e8cf4c589aee7bd42eb8c10fda88cade14ff158a26f650c6e13c59566fa941e0a21dbad04d83bde7229fc2629d6
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmIQ:A3kMva56rG
- TLSH T1F7257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 949KB
- SHA256 f9ff7fb95c2ed66ca4e6cee1e69baa46a9a205fd6ee788d90e233112c5a7a95d
- MD5 e0b40eea5a1cf5cfb200e8ba077d5054
- SHA1 4bbdaf25c2392f19e49ec2694c77648f1c9a3efa
- SHA512 65356c14afcdc59a6e44428a8fdf7e980330354f77977a167ef01a75af956e73b9e3e43421a436ed31a9960ebb7e345caac32bf2fbe9574bfb8a09b48a21ef12
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmBX:A3kMva56rm
- TLSH T11D257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 949KB
- SHA256 09317f65c6f225b2a1095d61b16b0f07e4f4e940694817d78e6669f81a39f448
- MD5 df56ab89b010b7c8ac16aa5c66f80584
- SHA1 947254d4fd69aee10090d60b9a03d58cfbe26f12
- SHA512 163e73348f97cb234808241d031f8ce8e8d8f4aef32f080e858fd794358908b0cb6c63f99ad79e61a60496de4cd98a83a4ee4a92954492641439caec552336d7
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrm7L:A3kMva56ro
- TLSH T127257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 949KB
- SHA256 1f9fffe24bf3b6514322d8bfd99ce42064eb5b41c124ea196114fe5be89c096f
- MD5 0df31fbba2cc08097f08ee380179447c
- SHA1 5672cdfb32153bc47b3acf5bba64deb0d670c4f2
- SHA512 d7b28d7ecf10a0b31597ed50a470c0ebfbf35ea1ef524754d851447747309ab20d8ee402e34d78529d04146473bc4fbc4f88ec8a5a0266ed1d214f311fe8a590
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5TvinrmBM:A3kMva56rp
- TLSH T1F4257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 949KB
- SHA256 b4de9bbdb5985d950748fe44faf86ae69ed28179ceb020cfb51a023bcf01f825
- MD5 f305ab0df77ecb130cab6b17a8839c2f
- SHA1 e76c9b10d7e0c2678f1eafd616f7dbe9be88a4e8
- SHA512 49a12708ab9162be11813594794491fc4ba81e53a9b646c7a9f45f14a8344a1f1c63d0a5341d8f648e8257fb0aeda13fe3ab86d1c73006675e88c0f8ba58b3dd
- SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyTD5Tvinrmqh:A3kMva56rb
- TLSH T16B257B07A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH