Analysis
- max time kernel
92s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:42
Behavioral task
behavioral1
Sample
2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 773KB
- Sample260804-zhcstagf75
- SHA256 7fee659f5ac6d10102a753ba2d0d7e29d242a1626338c17507a3a7677502f7b1
- MD5 32730c441dcd9349a4b364f0dba5ff13
- SHA1 9cbfa67a5380b629f4e0121818979c87ee7eb93e
- SHA512 28c5a230439bb4b2fc6decdc1cda00327396f6cb2893b33d59dac6751c8fee38b0ce5298032a55c37705ab534684a33737830ee95218c95a5d0b4e9bbc4787d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5c:A3mnXoZjzyaTjFxhvND5Tvinrm5c
- TLSH T137F46A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/924-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5ba-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6b-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/924-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4284-174-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3b-253.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-278.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c1-441.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c2-490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-600.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-704.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-767.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-842.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-1082.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1132.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b0-1850.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5ba-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6b-57.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3b-253.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-278.dat aspack_v212_v242 behavioral2/files/0x00030000000198c1-441.dat aspack_v212_v242 behavioral2/files/0x00030000000198c2-490.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-600.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-625.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-704.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-735.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-767.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-842.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1051.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-1082.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1132.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1151.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1176.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1183.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1245.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1330.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1368.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1375.dat aspack_v212_v242 behavioral2/files/0x00020000000066b0-1850.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4284 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E03D5D6C-388E-4B12-B85B-347D19A529BC}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 924 2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 4284 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_32730c441dcd9349a4b364f0dba5ff13_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:924
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 773KB
- SHA256 7fee659f5ac6d10102a753ba2d0d7e29d242a1626338c17507a3a7677502f7b1
- MD5 32730c441dcd9349a4b364f0dba5ff13
- SHA1 9cbfa67a5380b629f4e0121818979c87ee7eb93e
- SHA512 28c5a230439bb4b2fc6decdc1cda00327396f6cb2893b33d59dac6751c8fee38b0ce5298032a55c37705ab534684a33737830ee95218c95a5d0b4e9bbc4787d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5c:A3mnXoZjzyaTjFxhvND5Tvinrm5c
- TLSH T137F46A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 871KB
- SHA256 f4c1a482101f2b4184108c52e4b80f6e1be2e711d7357c86bbaa5175bad95d55
- MD5 173aa507bdc732f3af2f3cfbd7c66f72
- SHA1 e2a39ecdc7064385e81f58c1ad32baa1b80ba895
- SHA512 dbb44e8935dc81b3ea1163591ac75476651ae708d0e850ffeec5eef7ae5f728115087a8d5efdf8582fc1e56cbb7e34e3a984a0421d5157e59f590e0dc2132e9f
- SSDEEP 24576:A3mnXoZjzyaTjFxhvND5Tvinrm5v2MqDBxc:A3kMb56rVMqlxc
- TLSH T1FB157C07A6940FE5D02F813489914A62EB77BC225F2097DF1354AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 7f3541b0f63e9bb5e6be044ab36fbbbe23d4156e5f7d8761d1667fe3a9d70939
- MD5 2d0f3c5173fe88da3bfe6b76bba9f587
- SHA1 f0f0d615b2533c0c37b2d0e930167fa42df7391c
- SHA512 5690ebc569fa21d88f1f2a9854e088baadafa13e4d5e02e7e4b935d7dd7dfd277f1f232b05da2d445e639c0497f5ff2abeb8c29771a88789f0b0f927d1cb2f70
- SSDEEP 24576:A3mnXoZjzyaTjFxhvND5Tvinrm5k0Le5ji0hmxNrM:A3kMb56rNPji0Aj
- TLSH T124554A16F6A44BB5D02BC078C5D2969AEA733C425F3087CB13559E283F277D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 821KB
- SHA256 0f3f8627c972294c705645f2cca5f52c84e4838072259129ac2cbbebe8c8ea18
- MD5 c7fe8d9a07510f11bb89397fc1842883
- SHA1 f970a37351e012c6f36e04baf24ead8ca589c59c
- SHA512 739a82ba62ac197a21972117027392370707cee71f11524530875285219e93b93f191888c0742519647e77ba2a8528a8a2ee4836f2a7762f063d9193da06b9b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Nb:A3mnXoZjzyaTjFxhvND5Tvinrm5Nb
- TLSH T15D056B07A6940FE9D11F817489A14662EB777C125F2087DF1364AE263F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 796KB
- SHA256 b4ab1c4640c6a52bfd0a85391becd7e4846f6a0da1e4db77ec0c06788ced4f28
- MD5 31519dc5e554573a44066844e2acb332
- SHA1 96fea1a7435a2fb861742ec2eb7cb2a4189aa73d
- SHA512 dd10cd5afc98f10445d4de031426f6caf0012cf0df0580205b05514449670a599fa612943b63faf79eedad7ee928d02f9109601e17423d9ccbfaaa3f7a5c7857
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5v6:A3mnXoZjzyaTjFxhvND5Tvinrm5v6
- TLSH T154056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 796KB
- SHA256 5994b36e41dd91ce02a99d3a364d220d43693d81fcdaea9c7fbfa8f569546cd8
- MD5 52c33ec6a38e8794caadbb9baacc681a
- SHA1 0458f4108342e21503a9612fbfe93850fb8183e7
- SHA512 493a196a0f768e5e63439092eaa7e0bbee5d4b80310e1f40d3f351c7f455cd6049777884b4207600d81455d9dc122501b4eff31ec12410e0a0c83574000a1724
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5/9:A3mnXoZjzyaTjFxhvND5Tvinrm5/9
- TLSH T114056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 796KB
- SHA256 33be6506c2412ae52a3e827300aad225d68e3ad3b7494e16af705968eba691ae
- MD5 3fbffa06daccdedd2a25394832c56a9a
- SHA1 5b7d4b1868d696e33a2f1b70a199f892d421d687
- SHA512 36fbbcd59cc3840aa415ef955825bac13c1fd69a225a4b80cb8570c0879e8e7bc662238028766070530a41a73737df2209ed7701ad1634dd2f95e119b0ed984f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5bc:A3mnXoZjzyaTjFxhvND5Tvinrm5bc
- TLSH T1D5056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 796KB
- SHA256 ecffe3c19140d60c39da5ed2a54f718a13d275aa1e9cc8b1a2578b093b421551
- MD5 9ea3bf59fe231ecbb6b0c52dd14d8377
- SHA1 24d4620e325e25ed71b884746a86f4b8a97eb800
- SHA512 2db9324d654df8fbd6cdcabb33b42991fef0058310b9a74af961f43069bc62625bc1015f60ab775bc4ad71b28649124587a08df322f4a3d54d8212600babcbe0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Ep:A3mnXoZjzyaTjFxhvND5Tvinrm5Ep
- TLSH T1CC056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 796KB
- SHA256 ccbd20ce86ba73da0f31413518c433a0f0d9a93a3f9bc902b4945435bf5e1b8f
- MD5 8f4296e1bf3966c871132750fae93c38
- SHA1 3867917b2759eca611eb52353d6ff564cbee327b
- SHA512 d3232dcc1cf334bf98e08e3782241d3ab48bf51e81692f675b419e356bfe4450ca3dfba1d14e0a3ad0b79561ae17a2e88b6d58a1eb4999ed8a36b9dd6b700aab
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5L0a:A3mnXoZjzyaTjFxhvND5Tvinrm5LN
- TLSH T1F8056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 796KB
- SHA256 c72257f99f86f1326defcaca81b51bf7865dba2ea609966fa9ebe0e13fd05210
- MD5 a83ea010c4931280c332dad82a2645e0
- SHA1 a472f9afef7ed505e53ff26028386850d7251a47
- SHA512 663ce7792118309ee37ab6cde0337a72b650555ab63b9050d375b378befda6d557904b791eef67dff53a92d9658086c3ce02d06f3ff13124353d4a30e31640fc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5ZF:A3mnXoZjzyaTjFxhvND5Tvinrm5ZF
- TLSH T1B4056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 796KB
- SHA256 63458c51f4e60ff31a753de91c08407d53ba9b1194e7cbbb82e6dd24ac53a8ad
- MD5 888c916c22ebf70c5cf415cffd86c2a5
- SHA1 708cd41f8848a2294c20ecdbbe5b72345912b702
- SHA512 f4d1e5679abeb223f777ae22291b7eb5ce1f1ab711a2d5ad2b2f6d9d8d88b09f9286542330ead08a48d843cebfab5ae3e398e32e7cb0070ab2aabcdcbdbed782
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5yC:A3mnXoZjzyaTjFxhvND5Tvinrm5yC
- TLSH T1E8056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 796KB
- SHA256 d4a554e4e79f5514a217efd6ab25daa738eedf8855a128f442457f85c963fc22
- MD5 bb56cc7e02b6c95d1fa2037f3a08280b
- SHA1 b23b591cfa968ccb3c907dff1bbd175ecef48f91
- SHA512 5d93e21a0ca9b0c03e3e1857f12d68d019cfabf433aaef43cc8cd73d7f68029e0b567e6fdf7093cc19f1114cdfedce11f8cc959ff19ab0aa6cc69e5d10289cd0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5tw:A3mnXoZjzyaTjFxhvND5Tvinrm5tw
- TLSH T1C1056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 796KB
- SHA256 20fda92131aab1df81f1aff9f779cfbbfd96e9419de83f7f69e5bd1d7cdc74e3
- MD5 e1e349064d308f79e2940eec478002c4
- SHA1 aac1f8ccf09178a7bea73fbf3e43188ca4a5bb62
- SHA512 8162568cebf6349ae4e762cb5f430ceef1a6dbb541fd5412e0cd92bde764abf8bd4f62a073de09eb14dbd7bf05b898e741b7e24ac883bba0da900fa953f267a8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5cT:A3mnXoZjzyaTjFxhvND5Tvinrm5cT
- TLSH T125056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 796KB
- SHA256 069879e8fb4706c1e10aaf85d7c7cde3f2b2f01f311f72b280df1f43bd64fce4
- MD5 517d151caf700c558f37348b9e11e799
- SHA1 c85ca37c3af6bd610a32396de6539ab446ccc322
- SHA512 d3ef1c33bb5db6e91cc2dcd9d56ff6e2701366baec586569b5e8979c29c4d9293b15edc4abe9cd55c82bc26d1e26345380f4dc21880d1362769b495edc8cc7ff
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5wu:A3mnXoZjzyaTjFxhvND5Tvinrm5wu
- TLSH T197056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 796KB
- SHA256 83b84c37e87abce8837a2bd75b32ec72d650b1321d2e27cddbad6bfb78d8bce6
- MD5 9ba16b85d5ac629d7f25f6811de6d7f8
- SHA1 aa3cd74ce5faa2d121050b1fbba3c70bbf9531e4
- SHA512 bf8ba10b92e061c2f22ffe6a13b1b67f0a09e0c00c89944ee202906a83b67e098a882380dff3efb81c055285dbe5a233972be94931f153fe55581f7ef93fd185
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Ob:A3mnXoZjzyaTjFxhvND5Tvinrm5Ob
- TLSH T12C056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 796KB
- SHA256 f960f44025f90c753bb6111dd7128218cfc41d4e77420ac926e394e21ebfeada
- MD5 9f6cad865e7ff996c60f996e0723598f
- SHA1 0d8d4616bcee93fcd1675f2a1e67196439e309ea
- SHA512 a67dd46263148ebb76ff8256eacc6df422b8d11b22a176dc9ef55ea38cba694198b08f979ef03c451e36185fd4986f2bd5b43073b89076a6a3c2b3173dc0b1cc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm54f:A3mnXoZjzyaTjFxhvND5Tvinrm54f
- TLSH T1B7056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 796KB
- SHA256 4f521ce14e0287647a76084c03f3fb2b77a14e991297179bb8f69579a8ec8a37
- MD5 bb39cf15219eb5be05e6277afead2e58
- SHA1 666666c1e71e46e374636c813c891b518f5e06df
- SHA512 ccf1cfdef6cad81e15f8d508d17f3209e2f7baeb76bbc268ef9bb4d647cf29e12275ca50e2f1b5f1532822d86640d6f0a8450e0e636200a9f66b8e8765446b3b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm51K:A3mnXoZjzyaTjFxhvND5Tvinrm51K
- TLSH T197056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 796KB
- SHA256 b09a763dfda146725d23a9935f5c373d735325f836a738625a91de96b0c6e8bc
- MD5 a92cfb2f5203ad63e047c636e7764a40
- SHA1 69d43f97ffd4fc9b4e190d1af4a2248b8dbd6025
- SHA512 bd552d0bdfbb4de375fe5bc90f3d6bfe492d86079abca09687eb42da57155fab08d3cdfdd49962c0980b20e6b7717da8633e61361281ce416825b5fe8e794e3c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm52k:A3mnXoZjzyaTjFxhvND5Tvinrm52k
- TLSH T143056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 796KB
- SHA256 99ff278bf28168d0fee541936e667d5145992966b8b1915d2e4aff3ab4e0ebc6
- MD5 c434f403af8310703f09ae7110b40c59
- SHA1 361a64af78f35bfad8928e74813e38c387ce2958
- SHA512 dfdcdc63f18d6e43682f2b0d44b8ba1b02390381942c0ef7534ef70bf2e78c7f6b550e5a74fd27ed8389aa89ac28d8b3ab964dca4b2b763ca018f63341c246b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5T0:A3mnXoZjzyaTjFxhvND5Tvinrm5T0
- TLSH T110056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 796KB
- SHA256 5cc7ec103baf8de87c1f75ec092996ec3e38859a10f4f67627bba333a65d2c69
- MD5 4da3e4cd1fde62f575f9b4d3a7bb8233
- SHA1 0ccdd203a97205db5c42d9f1bcd1f54be779ab71
- SHA512 81274cbba50a205c6bccd2c74d2abc0ebd65d240b7017baea4be3affa31d0b14ce950dd29bdbd1cdaf40c64d501d74f586622ee724b1c4157ae8a0ae4a7a1e23
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5i70:A3mnXoZjzyaTjFxhvND5Tvinrm5ig
- TLSH T1A8056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 796KB
- SHA256 7dc0ed04760d6eafcdd35ef25840a65b4e6c2e3a97d11b7f57627e384ff47dfa
- MD5 56fb370c9cb42b9567cbaf1169940eb4
- SHA1 774b78aa9a246512d860f47ae4ab64a55032b6aa
- SHA512 d02cfa8553bf2fd3175d773d0863bb26ca3a3fd77b6c42af5176612e8c4c9d1f1a36bebc7c526b56371b0e697b5ed1f8cdcbdbee75dd291533879d3ad6ca21d9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Dr:A3mnXoZjzyaTjFxhvND5Tvinrm5Dr
- TLSH T199056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 796KB
- SHA256 b9e6ee6ebf490cd60df993336d7a60c7970fd5e53a4e9afde00af37bf9570ee8
- MD5 e6f11bb477574deecebe7ac2d860572f
- SHA1 a9c0ef8f3f24befb67c961a97638a5aacf3ae68a
- SHA512 51b2c9244e5daa7bd8f2f61f77baeb6910cc2ffbd8787f5c0eb8c05afbe4acac0cb40598d6bb2360d3e8c6fbe66539dd25128ac4227ecd18fd05732c3281b6a1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5ln:A3mnXoZjzyaTjFxhvND5Tvinrm5ln
- TLSH T119056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 796KB
- SHA256 33587487e713853cd681fce935549a5b7bfd67bf71ad5d02fe701145e12264a4
- MD5 248966707cea3849d1991f4022dd2496
- SHA1 86b2f1bfd1c6d70ecbda94badfa75f139bc5fdba
- SHA512 4859f8420eb191315212766ae51b425d2f2dfb1b5e86168f0f5ac0eef8181d06bdef7ea6e4a2035ad09916dd7ceb444b01bbb37ba4744e587c7f6c1427a66599
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Rx:A3mnXoZjzyaTjFxhvND5Tvinrm5Rx
- TLSH T173056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 796KB
- SHA256 e9c874ef66d20e0a76b7b2c0218028aa808a9134cb93ffbb32ce5f6c0031f7e9
- MD5 1d7bd81001f29e2d5463b7d82e9def1b
- SHA1 9ebc93f99df840cb6ef0514411f1d4b74b838a8a
- SHA512 8053179cc3fc557cd2272432520c2ebdde9e103e5de36277f8973cb9896c971befbecaafbca429b39ac57602c60af892990f55957ee8cfd0bd5909fe66f1ffd3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5/A:A3mnXoZjzyaTjFxhvND5Tvinrm5/A
- TLSH T1B4056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 796KB
- SHA256 c56c9dafea220f34dcc794093e282976d1a0a0d3166dfdbb544fdc646c13771c
- MD5 d8d128c617bfa20e17cc54c42f5b162d
- SHA1 77c500b916ce6c0430cd785b111905d46c214706
- SHA512 8f091051d2f0d0640539b7545c2f08a4cf79104c0080c2b5619f6b221ae8b8ef2d4310e345aab94d358dd8e7b23af2c00425a77886111adc772a20d321565b0a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Q9Q:A3mnXoZjzyaTjFxhvND5Tvinrm5Q9Q
- TLSH T176056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 796KB
- SHA256 30f85e74c938b5ea55dd482b23c77f573ac9225600aaed2cff90e19c8076d1f4
- MD5 1effdc7266b97b847ac31ef1b8a11fe7
- SHA1 8a70ffbdaaf470091f0c601819bad118a26f1227
- SHA512 3486445aaffed216f26ed041b54060a704a911db9e5e5dfd600e3484e0c6a123722a69089d9189e843cb6af65f7353f9057a8d9ab018d71af4943e8de19281d8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5x4:A3mnXoZjzyaTjFxhvND5Tvinrm5x4
- TLSH T13C056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 796KB
- SHA256 9c5b258effdf760497cee73505f5314de5687df3e998f9cc820bf7d199f8e593
- MD5 14d550f070943a33cd2d8cc5514fca70
- SHA1 b18bd71643148ebe7356720f74e79bff077c19de
- SHA512 ec2eada13cb4a1c52710ab935c43fc0088938437ca431ba6659dec5cf48aaf11447b305ec1819cffb4c74b6f3da196d644bec57637f9afc250b9f142fbb9d08f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm50u:A3mnXoZjzyaTjFxhvND5Tvinrm50u
- TLSH T1BE056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 796KB
- SHA256 e820b98b014460857b61863c3aed4f163e9e6c69312fa3d68541f88c9619b939
- MD5 d8d76594f28665747fe32d9733068000
- SHA1 106e43e29baa794ffb2a4167e8d9d73359922d96
- SHA512 06dfc52b30b5ba7dc215beb882d27842c6b10961df5f12ad6e729351aa29bc409a4026eb12d85ab0541c5712bf4486b4a878323b46c872e56b97fe77e0a7212f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Fj:A3mnXoZjzyaTjFxhvND5Tvinrm5Fj
- TLSH T195056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 796KB
- SHA256 2d8381a14b491f13cb095be743638371f643e86b1acf6d85716755e9618817d8
- MD5 84ce0b1b9829324b8bdd0614886cb032
- SHA1 de5e86bc4747e668364ed74a256795f009307000
- SHA512 e49598be0710f0d19c04d803a613c65c3aca746b1c0835f6a4103073c25cb3aa8c6691e06079bc9bec18a22970f37731dd95d30ff30bb604f33f9a4ccf88e873
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Mg:A3mnXoZjzyaTjFxhvND5Tvinrm5Mg
- TLSH T1DA056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 796KB
- SHA256 00a2a2dc569d1d003eec2ab4a6190604cb01807a6d36ce0c520a60da6419e893
- MD5 86dde9801521f381d0c21e6504670dfb
- SHA1 13267be60ad38fb22ab6d97e55ac84e629d3de5b
- SHA512 5cb10ca65603fae4d2f81819a0b237a970cb5237c75773f02cd0e12d63e06b923590106b1442232bbbe18aa996f585b8d7f2bf83b59faaae34cabf7bf4259a74
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5TI:A3mnXoZjzyaTjFxhvND5Tvinrm5TI
- TLSH T109056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 796KB
- SHA256 b8ede5bf025653ea75371783882d7a3fa9daccc2dd6b1442b2663093bb4885e3
- MD5 9754ee86cdac0b9ba2082b01021032ad
- SHA1 39c1d9e0ce2ab5667b2326291b3cf78a57f4baeb
- SHA512 6cfcdfd4183bab2e03828a9f558ef9babf782f3c05b37f019f0de01229cca35b31f5694eb4f867ea6de392bcc7cf0b515dd88608175122d8b884a19be39b698a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5po:A3mnXoZjzyaTjFxhvND5Tvinrm5po
- TLSH T1A0056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 796KB
- SHA256 b5ead96518265ee40e0e83fe23c23d246b09053ee3c6e4f1bb5be5a099e83372
- MD5 ba101e9b17de19b7574b77e672091ebf
- SHA1 50e23d89ff4e268c21fad22090b0a304bae26828
- SHA512 80e22a16fca4158776f5ca03302304d3205434373998ef4bf9110482d03b940c591af727d618a778497a03506038bafbb2a8685d6c8564217cca75dc477219c3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5a+:A3mnXoZjzyaTjFxhvND5Tvinrm5a+
- TLSH T1F0056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 796KB
- SHA256 04c8ca0034024d68d21be08675a2cdef34073d83c8509f2a89792ef3472964c7
- MD5 36929a27a7b310e65e450d4a7134da9f
- SHA1 95517a670e112bb23918fd7310d9b5e4a7584e74
- SHA512 84da4250eb2df41dcf9cfda526fac514bc5ba2297065865b028157d1673bfffb12fb3e1a9d54e3e709622f34697861bf0ab6978428407476fde90c9111e6fde5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5aQ:A3mnXoZjzyaTjFxhvND5Tvinrm5aQ
- TLSH T127056A07A6940FE9D11F817489924A62E7737C125F2087DF1364AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 796KB
- SHA256 efa5f88326a31b782e20df76635fc2977863aa5fdb18ba487ab3de5eaba0e6dd
- MD5 6afc3229dfa7c3a0362364ea4326f6d2
- SHA1 2e82c9dac58998fbfaeeff1920421c3a26ccec9b
- SHA512 b5555c59f210134c47a87e6da239a4ade0e08e43ca459d68fb1e1045d2d15b32e88478390c6d1ec709afb5cdebf37906e7360893ccab01d6599821668841de84
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5rX:A3mnXoZjzyaTjFxhvND5Tvinrm5rX
- TLSH T176056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 796KB
- SHA256 6a804f5f26abe8118bb4e3eae8424e63f52bed6eda95190f46896d0a9e50f270
- MD5 34001b97c568188d9083456cf44c3366
- SHA1 053d31ef238c10ce38def6850f08472d6fad9057
- SHA512 d1d3b459ccc51a0521587677114fd7fcd6df1005a85e77749e3cfa518807d76210be260c88351306fe64548c9c691a9db56fad7a87878436f84b594f74db7eb0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm55L:A3mnXoZjzyaTjFxhvND5Tvinrm55L
- TLSH T1CC056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 796KB
- SHA256 b8c4ed4d54fe1cc838ec619d439316e6f835c6530b5e5f9cc98deee20f75f26f
- MD5 4f6a62110cd6d2e4171ae7f1d1404dc8
- SHA1 7a0a2df610584dc6154bb31244fc90397dc8b154
- SHA512 53a13eeaf19ed52f06cbe7052c85aa61e8fae529b3d68a6c388e24d03b5661d486701a46dfe7b69b7d379ae6e6149bb1782fc7ffb9ca82c2703ca67da36b2ac0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5nFC:A3mnXoZjzyaTjFxhvND5Tvinrm5nM
- TLSH T1A9056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 796KB
- SHA256 a803ace365bd0cd2c9ff5297e2371532a4ef5b76e85de7c3da2ee7acfa4487d5
- MD5 4cec4a037f893b6e46422a4af706d3af
- SHA1 4a828ee455b79279c0a1b27c14f967f5f9e3b8c5
- SHA512 c3a1d4eca78664aaa43fb6ade4d38f9dc257f4b31b998af520dc8ee6ea500389a1d3ea315432189264228ccc949da3dcd4679d4c785f8f3920ac1be9be5bb0f5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrm5Qh:A3mnXoZjzyaTjFxhvND5Tvinrm5Qh
- TLSH T153056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH