Analysis
- max time kernel
104s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 15:21
Behavioral task
behavioral1
Sample
2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 717KB
- Sample260807-src2lsyanb
- SHA256 b1d11503d0d6b808ca77a5c001c3ffe0016f4c2af650e8fe4d10454a3bd15fff
- MD5 ccadc6b4fdb142d7dfd84e1158b9cb44
- SHA1 7e388aea2d655e379cc15ec5acb1c9aed174fd73
- SHA512 c42c303e4ab31d9210429be6e6f60b5778ea374dbd96fa35df6a143e065a1bc595e4bcb0e5b8ad68392ce27c93acdf977c100c81b88c77083987476cc781b45f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmC:A3mnXoZjzyacNVuh5D5TvinrmC
- TLSH T10BF46B07A6980FE9D12F817489A24662E7737C125F2097DF1354AE263F327D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/3452-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3452-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4228-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb5-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-443.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-590.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-745.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1068.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1155.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-1225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066ad-1855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000187f0-2099.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5e4-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb5-60.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-274.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-443.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-492.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-499.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-590.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-621.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-641.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-725.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-745.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-789.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-826.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-851.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-870.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-883.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-896.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-897.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-910.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-929.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-936.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-955.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1011.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1049.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1068.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1099.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1142.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1155.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1180.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1187.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1188.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-1225.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1334.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1347.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1373.dat aspack_v212_v242 behavioral2/files/0x00020000000066ad-1855.dat aspack_v212_v242 behavioral2/files/0x00030000000187f0-2099.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4228 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3452 2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 4228 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ccadc6b4fdb142d7dfd84e1158b9cb44_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3452
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 717KB
- SHA256 b1d11503d0d6b808ca77a5c001c3ffe0016f4c2af650e8fe4d10454a3bd15fff
- MD5 ccadc6b4fdb142d7dfd84e1158b9cb44
- SHA1 7e388aea2d655e379cc15ec5acb1c9aed174fd73
- SHA512 c42c303e4ab31d9210429be6e6f60b5778ea374dbd96fa35df6a143e065a1bc595e4bcb0e5b8ad68392ce27c93acdf977c100c81b88c77083987476cc781b45f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmC:A3mnXoZjzyacNVuh5D5TvinrmC
- TLSH T10BF46B07A6980FE9D12F817489A24662E7737C125F2097DF1354AE263F327D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 816KB
- SHA256 9fa0b35d4a8ae4338aee39463756e5aa7eac22a13f0b6bc07fb8375839ed6299
- MD5 2adb7157a04c9024822fcf2c242b1957
- SHA1 a62996cb1c90052d940cd8b09173b608fe2df909
- SHA512 ed7f827d65fdfee4e82a8e158acef93d24d92c5ed598048d9dc0c0b4790574edf5f435ec4e8a0ebeeb3e3ec04968b30cf9c3da211d8d361e537b53ccffc29420
- SSDEEP 24576:A3mnXoZjzyacNVuh5D5TvinrmR2MqDBxc:A3kMpf56rnMqlxc
- TLSH T180056B03B6940FA5D16F813489A18962E7777C221F2097DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.2MB
- SHA256 07a181cc3433b19676bbc0ac6563bfc01459780c54435e77d3e85a4a39df6cd5
- MD5 291e907abb2363a346fa53ebdc25259d
- SHA1 77782f2b12efa484ffaafb84a927f15aa09e3a2c
- SHA512 24b76e429f1de96015817a94e938ca45d8abcb928d29dc00ea72d97c77d3ac4636e1b1e27ae7888d381eea9ce7180386ac4d0bb9e5ad530c4d43cac46f9c811d
- SSDEEP 24576:A3mnXoZjzyacNVuh5D5TvinrmC0Le5ji0hmxNrM:A3kMpf56rTPji0Aj
- TLSH T1E3554A16F6A44B65D02FC178C5D2965AEA733C421F308BCB03959E293F277D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 732KB
- SHA256 f074b2e500a6ef01f5fb874cc147d1e2d1d4592e42829a607e590af8c12e56b8
- MD5 c3dce22aca8d7ea4e672720d710e333a
- SHA1 f5c2fa82793d548ab3b1b2a012ddea461414dab9
- SHA512 48e342817f55dead6fbdfb7b040817b4b8dcaba2f68a6ac7a5b08a02f4644b6f547cc2427fd8ce0f73eece1446d93e247588eea8bff67503c7f98fd5dbf618e4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmMa:A3mnXoZjzyacNVuh5D5TvinrmMa
- TLSH T111F46B03A6980FE9D12F817499A24662E7737C125F2097DF1354AE263F327D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 765KB
- SHA256 ef20b247f0ee1df7e07da996be380942798680da8cb94e31aac89276a8726b18
- MD5 b03c17714d2d0d06a492d049e6fae415
- SHA1 a207f9a64718b36efe9378cbb5be090e8f84f804
- SHA512 c61050e9399b6e695a9367e538ea1ea9197a3d1452ba725d8d47ed2c1bd82fcc2c23bdd8eac80df0a39ee782e69a3d2c0d8e567718fc7c9cfd334d1d9f5d8a89
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmnb:A3mnXoZjzyacNVuh5D5Tvinrmnb
- TLSH T18CF47B03A6980FA9D12F823499A14562E7777C521F2087DF1354AE263F337C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 741KB
- SHA256 fe58780b92425f48e17f40e756f0630430ac26422db4763ac66771414bf9ca9c
- MD5 a60f4fe0ff4e04bba348bc91e7725504
- SHA1 622f4578d1297126d5c9707869b3ec6d6f5bf353
- SHA512 80374bdc32e3054f57b5f14453a853aaf60541da1d6ce5a520be59b40faa1f3ac34a8e463e7daffb9a9e66aa7a7da711d4f4568bc4ae66a854619f28d871dce2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmd9:A3mnXoZjzyacNVuh5D5Tvinrmd9
- TLSH T1A7F46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 741KB
- SHA256 2ca16ce1f6f7eeaf4b15b8d5b22a3363046a182a71e5fab42a4641172f03c88a
- MD5 bcc5612fffec17af6b504451930a99a1
- SHA1 fa89e5eeb01e042ce61c007f1dc311f4217c9fff
- SHA512 50f3cebba172bd8320cf6c0c3999fc14529de3e47b835da6bb4d8a70b0882b54f5a2e4d154fe885260e9e73e47d49e32459563520c637b5a0810d26c6b67c24d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrm5c:A3mnXoZjzyacNVuh5D5Tvinrm5c
- TLSH T1A8F46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 741KB
- SHA256 9ec642e63ba06219330a9a11eca85eaf7676641636b869b2cffbab58aea343f3
- MD5 8812097258ea9f12a8c7cd81d881fd35
- SHA1 282ee291ab8a232c03d839ab4a81fc7e75cd02e0
- SHA512 c3277234555e290eb9ca280cbbed09fb7222cfb4c7a6a843a16080bc785b85a9c065640fd3b564225d887c3cc37fe42091b496660ec501aff2ac1d106506c559
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmyp:A3mnXoZjzyacNVuh5D5Tvinrmyp
- TLSH T16BF46B03A6980FE9D11F813499A24662E7737C125F2097DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 741KB
- SHA256 954d27484d8e358588ead1569cec5ed950124c94d860c404e36729be63cd5b3b
- MD5 48518fd552daf708d44422a6764061a1
- SHA1 b8dbabc2facb7affa1a904f16bba6b6ed50f7083
- SHA512 b105d05ae84676614ae8d871b10c4b8f423e7938a64835f5fba4f28bfcf26e198aace9e5105d5b50c8443fbbf75d2f6df1f241c2666b535586e5154901b77d8a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmF0a:A3mnXoZjzyacNVuh5D5TvinrmFN
- TLSH T1ABF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 741KB
- SHA256 bf6c524ef342abf3197e51cd7c05997a561b57f0a902c5f1fdaa95d8b2bdeba1
- MD5 3bc77d00ae67f3d14cd3a7248f5a8def
- SHA1 cdab5ea2e5d1e03b64b9cc93209a9772630dd57d
- SHA512 aec01f88ac6157bcab118d03b51c2098975427eef4fe1a47ff6201384fca6bccccb072b081fbc3157e28e3ae217f9af937eb6f38dff8fad7461bb94df292f661
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmXF:A3mnXoZjzyacNVuh5D5TvinrmXF
- TLSH T10BF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 741KB
- SHA256 7e3688a58cf0064cecdc4b1b22b8af36b9fae658c74ca625fa6d910d4ec9ddab
- MD5 47e6e7b24844781f78401612eb4f8256
- SHA1 bff8a910486f63cf28085005010d6bb6d7a65ba6
- SHA512 c91300e2cf7611f9743db5d955428842511a603aa930ca25c5d5abb1d8d3874671756b84651d8cc86ff5d02d637eeaa601a3b122cdc70ae6c24cbec31546d6c1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmoC:A3mnXoZjzyacNVuh5D5TvinrmoC
- TLSH T18DF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 741KB
- SHA256 7bd6f0c3c4479878abf14ccd500702e0a4cd46c04f98ccc5f0a741b61c79b399
- MD5 4af66674be616b44ae8d55e81db8a7a5
- SHA1 654dec0d9a48786de6e4d7d3544ae5319c53723c
- SHA512 003ed936819074f70d82cd05884a7489b634a128f8593fef5c243841e1396fd87cde3caaad0f9ca08bee2c11601d5a034bc89ca13965a31fddbb10eff113ffce
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrm7w:A3mnXoZjzyacNVuh5D5Tvinrm7w
- TLSH T1C9F47B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 741KB
- SHA256 8eabbbfd352a9b1bbdda91bb21c05e74a97bdba2c211a108c39523ca70cd07a6
- MD5 a8a8bf14a72e4158942ef6d903b4a889
- SHA1 f860e20a7d7ee2cdd622353b2f09cc878042278b
- SHA512 ccc12c6359e6b5448a293ee962a5654a8a9b07d3a0cf2716e8aa19a2ddca2100fe66aa8f084ddcad0a71211f7b2bf2e73daa16fa74316ee316f998a5dda70d2a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmCT:A3mnXoZjzyacNVuh5D5TvinrmCT
- TLSH T168F46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 741KB
- SHA256 f963f9971ee949d74f700a98b4a53e82e319a7bd4f4d43941e683521f531cb89
- MD5 ae582fc7ef71b2e78efd6fc1a093f0bc
- SHA1 8fa0b9ed0aa42aecd15b3bcb22af1d4d5280cbf2
- SHA512 b71b391425b3435a77dc725b569c046a6086d8dcdf7ad569402b8b5a4d3cf6387296d67f541125d8f180561e8bffc95339f389086a262c0b164d1b520b2a4d6f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmSu:A3mnXoZjzyacNVuh5D5TvinrmSu
- TLSH T1A4F46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 741KB
- SHA256 b5ea042e86b7abb5685a1f2782628513faca32b2b58bc3a5187e3eab1c530c61
- MD5 3e605ea4b41b0adf82a5bf12d6866c77
- SHA1 f02049e5ec04c58a2a854ab159552ec297458b50
- SHA512 d397189dc33a30232f4bd6b789edd941fece6ae8876e809efee3acc597376545d257c59c5c9f66f9a55d72683814bd6014926d19d24b72b7c607f4b14ea5c8e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmMb:A3mnXoZjzyacNVuh5D5TvinrmMb
- TLSH T154F47B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 741KB
- SHA256 0c5cf3caca94a3209992061ba58aafaa485b340a7b2d2bd62447fb3c2cf37b38
- MD5 e658c9dbb14d0b5b8592150cdaaa7a9c
- SHA1 d656020c91b51caf4fce4f5a824bcfa3501504a2
- SHA512 5155a0a82e500857e46f9db693a86c98a79168dce010dad56fa1153f33511f925f44a2c16f26aa063ef8f9d1eb65fb7f4068797ec3af0c85ec67be6e603b6ba8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmyf:A3mnXoZjzyacNVuh5D5Tvinrmyf
- TLSH T1E4F47B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 741KB
- SHA256 719bcaa641ed1eaac28026a991b41398902360154187ed4a1501984fe8b5fb40
- MD5 e52f5b002684613307c812ab7b252997
- SHA1 e44b27fdb9812ea32737fa69c8a71a52eaead349
- SHA512 2d3517695649b4e8bde70e37cbae0a4c8cbc968783ed2f6c142ac22ad5e52536ffbdbebee20fa8beb50b97c2d7f8480c5ca58450ccf4a70a5b5a0b7d46cd0ca9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmfK:A3mnXoZjzyacNVuh5D5TvinrmfK
- TLSH T19DF46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 741KB
- SHA256 9959a16be46d109b72f5d2c99be0837271c3008dbfbab999f30d223dd0a020f7
- MD5 f2c661dc7b3d8dcdaf1982b18b712646
- SHA1 23a5396b76b2a5d07c556a94cd6281bf649c8c19
- SHA512 8340c36bc71a06149f88d2f5d13140b58f3db84b63121bb56a28ccb5e6599098310e9f581915530a58a5d596b2212f95d362ef8f634c7a5088bba312dc4ef37a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrm4k:A3mnXoZjzyacNVuh5D5Tvinrm4k
- TLSH T1FFF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 741KB
- SHA256 c8524e7322dd7e523992ee4d5f86be3273a72f4333c95569aa1e29a72ce69463
- MD5 85ccdbb0722527cadfbe89cf83e8bfa4
- SHA1 1ab8e59c75897206ad380b780205b839c3b55bb2
- SHA512 503e085cb9e18ae9d89e60fa5f566d38bd75fb5a618ac8e494fe67159099af91faf6973375968c42410952f00dcac843748411534bfe4e47aaad2fd97437928d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrm50:A3mnXoZjzyacNVuh5D5Tvinrm50
- TLSH T152F46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 741KB
- SHA256 fe65089b1bd4f496e9b36b1585954f4d8c8a0eeb0819e1939ec7f2cdb4e730f5
- MD5 2b72f64769930a3e6e0d80cd11e7fdce
- SHA1 87f072fa8a8bcf719187d5e34f9edfec6b307567
- SHA512 030236827290024798da85bd6fa0ee35203aecb652aaccf2324c997dfacb8c3fe800f16e8b148566c2f412a49e871254e2b593f99b269c4943e78328e2c10c07
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrms70:A3mnXoZjzyacNVuh5D5Tvinrmsg
- TLSH T1DFF47B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 741KB
- SHA256 3b2c81a48ccd13fc8a87f918ee773ec8e63966cb1392ac7bb8fe5968727a3063
- MD5 720fc908f6ad7aaf8338e3434cd6308e
- SHA1 799e3257156a1c5cc58f25cd9cc91122d87e115b
- SHA512 8a5126a66975d0ca6dc08f795cbd37864b634ec83ed9240291d763ee321c40f16347c63ec1f47de0083433a7dba03f965b9d4ebf8c2a3329e115c495a3efaf4e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmJr:A3mnXoZjzyacNVuh5D5TvinrmJr
- TLSH T124F46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 741KB
- SHA256 855beef8691dbe4775241b1520f37d9008f9a76b1f47224b5dd84f09b156d865
- MD5 2db66f9182e68df935204a6ff01d3f25
- SHA1 a84f0d317d14bec51374197aaa686ed0a7cb83cd
- SHA512 3b8a990bc73710710d32624c8e1635e3fa65f15ee38f82f98521cea9da3790fc058175335a7a7ad1b1870dc75207c6812692fcf83ed57ac669f543762cae86da
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmrn:A3mnXoZjzyacNVuh5D5Tvinrmrn
- TLSH T14AF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 741KB
- SHA256 95daee1b9c741bec3dc060a04c4e4daa6470b558a60f55e847e1d08b9073066e
- MD5 ddc05fbffa3cc0399dbb53bd2a6b3a9d
- SHA1 00627f7ae6979a30e25d4a4e2e2361bf86880af7
- SHA512 299a01942d43dff2fa292b51fcb4f47b1b9a2eb5a817afb501c90c78499485a9e5264f25738704ee4375c72b509b5d20f0ffde0aa708060a04f855e601cd636b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrm3x:A3mnXoZjzyacNVuh5D5Tvinrm3x
- TLSH T1AFF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 741KB
- SHA256 0c0a10a220dc0df859dda64d87e3bc137267dc91914abac560354b2e76ddb89b
- MD5 7796bb609f6907a1d0a985efa4290348
- SHA1 9c44736f814c543c075fa6945e198c6d25d9bbe9
- SHA512 db42d194b3e1a12fca971a9f2958d511aee28f1705557bb135e00e2897117f9d66dfc3ce4e5c11c1e0bb51a97edff3e7095f76ce25f5cdb8d6fd32df22ca4dc1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmtA:A3mnXoZjzyacNVuh5D5TvinrmtA
- TLSH T1C2F46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 741KB
- SHA256 411ccd51d9bca212c11e8c390323679c7d18882df940456ec735142881d90ac8
- MD5 a0662bf343a9e1b13c899a9d44882d51
- SHA1 d0681016880096bca2addbf6520628213b57f065
- SHA512 85b1b1c17f3b595ce9bf2f10c2dc789717a3ee3387d056ea76d771e890c3fc47362668f76f26e4fb225b98cf73d1e15ccb124797bb6364236a9afd8b89dd3bb6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmm9Q:A3mnXoZjzyacNVuh5D5Tvinrmm9Q
- TLSH T1A5F46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 741KB
- SHA256 095e570e5d452cf98f4d81a753f85532d44d997a9acf0a91d14455fed5ac85e9
- MD5 b62cf4bc5167186aafc057ceb932db78
- SHA1 f1e5d95c8c359462084e3d012146cc8fd15949c2
- SHA512 38770c2afc5f6de9b2105ac2888e495331a3e42c2fde155bb0067f16be24e5299416b3013bb4ab13cb82ef47a3f1d1a631ba20c8befda03badbd850429242675
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmD4:A3mnXoZjzyacNVuh5D5TvinrmD4
- TLSH T1BFF47B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 741KB
- SHA256 2c9d05849bd468547adabcff782623d358763657c429cc2ab110532f4e8329b6
- MD5 1a7ba95e5451c8be0b71ed903dc55d6d
- SHA1 382a3da971eeb4158ff627b50fe214fd17e125d1
- SHA512 e8fe3533c60944ba88ad6e2fb4343de6f21b0b079def48cdb68526ff3ffd3eee64357ff34f0eb24dbac18fe849b3cd65061286f58c47823c390ca00807765040
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmqu:A3mnXoZjzyacNVuh5D5Tvinrmqu
- TLSH T12DF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 741KB
- SHA256 8d4c21d34ffab575e473b22f8dc48adb23c540ab72cefea7a7a606e1ca1566e2
- MD5 e7cad0eb0c204d3b1a6b0d23d330ec43
- SHA1 629a2151806ab9a40cea6bbab292643672880ad5
- SHA512 b2eb17cc5779e76d256401df9a716af68e03f18fbac5e85d6d0627a8e6a8adee80941c2e1a162a09730dd85e82d7e461c67a9821f6cbad51291908b97f8b08fe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrm7j:A3mnXoZjzyacNVuh5D5Tvinrm7j
- TLSH T18DF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 741KB
- SHA256 b130a930d52db7afe5054cc44b8731a029f6c9809c1a46ec135ea17761bd9e1a
- MD5 583d1c47e2ee55cbda207b8a8fecfea9
- SHA1 fa5ebd5abd32e5804fd00bc4dab24d85be4cd21b
- SHA512 15cda8150a8e2c6c301a7669b73986dac2ae1b9d8890f1acca3ff94b95af00687842f51dbba55c728f1acccc3af348eb451c206de11b966df1de0b0797f6bca9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmGg:A3mnXoZjzyacNVuh5D5TvinrmGg
- TLSH T1C7F46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 741KB
- SHA256 becbc8c3d42d423ea0086f6557fdf4932e790f3950269c6603075646b4c91790
- MD5 089c0d8122aa489c4ada99abc1adc58d
- SHA1 e6fca68b7220e0d78c9ee4a9ebe31823da2dac40
- SHA512 33114d78836ec7cdfcef704f08108c37d7f11264d9ff23ad4568f90d38c8724429100068ba6577bab9537656f157feb1b3346c0df22b64db54480e74ee7ca201
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmpI:A3mnXoZjzyacNVuh5D5TvinrmpI
- TLSH T199F46B03A6980FE9D11F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 741KB
- SHA256 18dae2df1478fe5c9741d9406736d9a6de44580bd765534f7a4114ecc041dea8
- MD5 afe09ae58e89cb3034f4cde9d0dac407
- SHA1 4d7e314bdc43d4cd4eed87775663925aa840cbdf
- SHA512 8ece25abb5c3659823336c8c552aa4b88ea9e9a319457f08f31afbd845dc49e7e9ed6c6a701badc402a3453cb064a9433f8edb9bb44c51a7bc2aa10847ad1af8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmLo:A3mnXoZjzyacNVuh5D5TvinrmLo
- TLSH T1CFF46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 741KB
- SHA256 31dea5b4a8cb4dd3a6d125d55b2d4fbebf40248cdb25197a32d7a79723485834
- MD5 a42caa1e5b20d8723bda2d6cf47ea309
- SHA1 f3a3559e44db51a355c7753dd206e621e5bf6c29
- SHA512 84bd46f85973f545e701c4192e5a557cb91b01e63497ba8f2810feb9d0e4127a1d9f70c13fcaded64e1a08e0aa72af31de3755147411aed4c8d672ba26299594
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmw+:A3mnXoZjzyacNVuh5D5Tvinrmw+
- TLSH T1E8F46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 741KB
- SHA256 c85abbae4b7d762319f9e06b5d84230ed54bfac20ccf7ff6aeb78132cfba3390
- MD5 de13c5f39c64a9b1c22877a9d3a61973
- SHA1 f1859d218aa807e196a7e84d9b591b8dcdd2488c
- SHA512 67b418a85447c60f5ecee7366f5b4da8bb4dc6dbf279e598f19d72499cf574786f7bda62586d3b7473c9a7b8222c2c457a52b020f21defca944646956230e24d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmIQ:A3mnXoZjzyacNVuh5D5TvinrmIQ
- TLSH T139F46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 741KB
- SHA256 3cec53d83faea50cd9e4fa058c685272a644c8aa4c4b0ac5003b44b64b6f6626
- MD5 6c5d172f602e9d5d90efa24a16c9a536
- SHA1 1d0e74ea377473f864c9ef71e787f55665844e26
- SHA512 adfd155fdb17bb9df9098fe262edfcb1f06f2fe55db3ab62bdcfee30f5b0c055540c0fe3f0309a10ab329ebc051e2b07b30880a2ac704f6ec777c4bdb76763e6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmBX:A3mnXoZjzyacNVuh5D5TvinrmBX
- TLSH T1E8F47B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 937KB
- SHA256 9b8b2cff71d1dfa8ae396bc6c19bf963c9c75794545474a31c66159506366466
- MD5 7c3049cb7c695a970b3ea6249eaf5696
- SHA1 51f801c8a189a776dcae97baa9b579066dc3c560
- SHA512 3c9dd47ab3f035eb5de413bbc1dd26b0a91462f8cdb2d8a3263618ae291c280726c05d745d658f77082e0c52671df63ad8b5fbd07cea3cb107580f2f1e0e4070
- SSDEEP 24576:A3mnXoZjzyacNVuh5D5TvinrmGjCXF7IwZ:A3kMpf56rZC17IwZ
- TLSH T1EC157C17A6940FA5D06F817889924666E7737C221F2087CF1394AE263F337D06E397A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 741KB
- SHA256 7233add720cf1e12dd2c44adfc62ca741305994f4e93937c6379390eacbac3cb
- MD5 5154defb899b598831350bfae318ec27
- SHA1 3b22ec8e86425e96a66bf151819bbc1c5b570279
- SHA512 5fc337e8755f25865780bdd9f94924f7163c9cf4d2cb1d5ca7e92d428956010ae09ffd58f72284e942c93a69dedba77a3565247da376b8adca4c77ab0f3db0af
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrm7L:A3mnXoZjzyacNVuh5D5Tvinrm7L
- TLSH T19BF46B03A6980FE9D11F817499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 741KB
- SHA256 3fa756f0d68dabf80e7ef139339fe5634f414f70e3dc10e1484bf8aaebcf0740
- MD5 c92f9cbb96a8939ac281a9fd5cb22ec5
- SHA1 72310a311e3c6d4b602b3e30e954ab6764deb45d
- SHA512 a0fbdef3c5d3eb5436d34eb629b667ada9676e17332a1eadebd6e66f4fe1c04209b2de3208ac3838a1bcf7932ce5746b4fa615ad4e2e826690483f7bca5a87bf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmBFC:A3mnXoZjzyacNVuh5D5TvinrmBM
- TLSH T1A7F46B03A6980FE9D12F817499A14662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 741KB
- SHA256 6260bed12759091b8b6981f6f6f753def7294388055870ee64f504b8ed232315
- MD5 fef1c313b90c78684d252b9b24bcaefe
- SHA1 67f7380a4ee6756ce2edb2cc7f4e56a8746e7a75
- SHA512 3b53d91d518ad46a179e12878c2e84773add4f284b2453bfba9598a0e2777000bdc34c46f6229bc1e806a870d922291bc710f1091e56bea65d80f2ad28333a7c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVuh5D3JeU7vinrmqh:A3mnXoZjzyacNVuh5D5Tvinrmqh
- TLSH T1E0F46B03A6980FE9D11F813499A24662E7737C125F2087DF1354AE263F327D0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
- Size 970KB
- SHA256 baffb1733621e2da52c898a65f1c91ba56d8bbc4b58b4f2ed44b3645fcf9c77c
- MD5 79620fea0cb350c29f8518217275d5b4
- SHA1 18a3332d53904b0e16f58cd9ee1a2cdf6e81911b
- SHA512 027269c46904a05444e857313a4bd919e72d75e86c9dcf11cf13fe8b8f36c10112cfc9a3deb6008973323c471440e11bb1360b617ea504ef43638ef6f04fa45d
- SSDEEP 24576:A3mnXoZjzyacNVuh5D5TvinrmQV+PAk2hMH3:A3kMpf56rPi2WH3
- TLSH T1DC257C22A6980FB6D12F813489A58576E7377C124F2183DF1354AE2A3F727D09E3A753
- MD5 SHA1 SHA512 SSDEEP TLSH