Analysis
- max time kernel
99s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 13:53
Behavioral task
behavioral1
Sample
2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 907KB
- Sample260810-q643javyfx
- SHA256 63fcc7548f96330cace9de74a9e9cd698482b4f0b9b2e59b47aeb357c85f632c
- MD5 50d7ab17212b2cacef36ef9e5d9d6056
- SHA1 4bf527eee7d69772eb46a5089f16d3b11ee0df44
- SHA512 60d8e057e1f96de0fc788b6f2320263f9364e1d5cd0c3616a5d66749382beaa23bf672296a51a3a3a92475aa9f5ceb1aff025ad144d9767b3b4c9c6b906f9381
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbeuM:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuM
- TLSH T1B215AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/3388-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c62a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00060000000175fd-101.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3388-162-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5836-169-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-471.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-587.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-703.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-822.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-974.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1006.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1092.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1135.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1166.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1319.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1395.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c62a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-39.dat aspack_v212_v242 behavioral2/files/0x00060000000175fd-101.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-308.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-471.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-587.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-703.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-735.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-822.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-853.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-974.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1006.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1092.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1135.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1166.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1192.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1319.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1333.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1353.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1372.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1385.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1392.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1395.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5836 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe - Drops file in Windows directory 62 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3388 2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 5836 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_50d7ab17212b2cacef36ef9e5d9d6056_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3388
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 907KB
- SHA256 63fcc7548f96330cace9de74a9e9cd698482b4f0b9b2e59b47aeb357c85f632c
- MD5 50d7ab17212b2cacef36ef9e5d9d6056
- SHA1 4bf527eee7d69772eb46a5089f16d3b11ee0df44
- SHA512 60d8e057e1f96de0fc788b6f2320263f9364e1d5cd0c3616a5d66749382beaa23bf672296a51a3a3a92475aa9f5ceb1aff025ad144d9767b3b4c9c6b906f9381
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbeuM:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuM
- TLSH T1B215AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 82ea0fe02a7f4c70c0b40adfe91cca293eb36a6e476ccf7313f94b71adef58e5
- MD5 f4da0fb226f0b32af437d798c7d09f84
- SHA1 7445cf8e8d9dbc3110a4212e50ab20a4e92ab50f
- SHA512 54a3b9d577652966c71a9d0a4591414c5fb630ae392f672ccf771323e9b3a86b75951f6f68a2eb266f719484ee29ca8c294065ad9e2619bcfa296b902b6fd0ed
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuU0Le5ji0hmxNrM:A3kMeT1LljXPji0Aj
- TLSH T1E7658D16F6A446B5D033C079C9D29A5AEA7238461B30C6CF1399C7292F337E19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 921KB
- SHA256 4d4e5d5bbd9c5316a80b92b2e9ede413ca4913e4e75ad80b663c6f244380cac8
- MD5 2f0dd005293239c2f916899c2d4b6e0c
- SHA1 9f33b37741becf96c47d7e3b80916105d17dc4db
- SHA512 3bed5bfec8062662468a2f0f05cd18f1cfc71cb0cefdc5bd13ae4fa23e75eb68d851d798b469cac123815a4a96a05923bd53a6a1b5c8f9b0e7a3067c94837b65
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuea:A3kMeT1Llj
- TLSH T15B15BF17E79014F9E8178134C9A54A22FBB1BC661760C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 930KB
- SHA256 48927eed670f7566dfe076aef31d6e9f232d1d8cffdd44f266742873d63f45d0
- MD5 d46269682d798fee679ac8a242ac06f2
- SHA1 e9bbf7680406d67b60d2f09f79e199709a2978f4
- SHA512 84844f9c7259dfa0873f6cac326f270544a6cde372ece90bf3592b83ce8e91c584c3f23f62ed2f0fe395af97d3a35e2ae85bd2a215781a63725aaffb81fc87b5
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuP9:A3kMeT1LljM
- TLSH T17815BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 930KB
- SHA256 106f41880ebe53aa861fc32d405f71acf4aa71edc26f69790e8f0a5b958472d1
- MD5 39786506a5d0c284031faa340f36c424
- SHA1 4dc68ab7b5b3b5cae579b9f44d21dc72b6bdc355
- SHA512 9715521ad7cda755183e1aed3e266799a75fe34842d584bed3bd6eb1df75b88bfdcb65939260f4dddac54512760899add91445571947a95ddfe370f839fef653
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeurc:A3kMeT1LljF
- TLSH T1BE15BF17E79014F9E8178134C9A54A16FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 930KB
- SHA256 229734d53398772cf858061336b22318165cc8051c66b0b7253f130131db4794
- MD5 7ce57c7a2a5de561b719929f4316d2ef
- SHA1 5adefe112dff6e2b2fca00be7f62d1a98b265abe
- SHA512 915e9a1302ed0795b474c648a15ba838ee5dcc90908cd76b771991204766886982066bc6ad33bcc4b1900e79e36c7822f074ccc79c8ae091faba48e60f7a236d
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuUp:A3kMeT1Lljr
- TLSH T1A515BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 930KB
- SHA256 89cdef726f743c53ac3ee89de8721f0bdf3b98696ef86941f81bb845c202b65a
- MD5 050ca3186ec17f3581ca94a53ac1404d
- SHA1 9688bc9c04682072e60b7dac14c265bec2759f07
- SHA512 9bec438b32b542e62d9d5f5e794b3bb600233cf34d20c08933b9d817080d479557b7c4b0863fd9de1198c69dc0e97efc05152ff5c429f9f584399fb16b917453
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeubN:A3kMeT1LljQ
- TLSH T19615BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 930KB
- SHA256 575ab65dccdd3ea81dcb3a2214b827e1d20c73c7f0d3a47dddf2c97b41e5017d
- MD5 4236c261a63ea6bd569a59fb78df88f8
- SHA1 08deecc4ad2fe0d5775f6f660a909ebcca1ad224
- SHA512 cd22cf1cc6dedd785e15b1f4fb02ada00829e6c32e1b8b727641feceb2fe2ccb83722f8134df45899d679bef3f9d62caaf9e9ea8f50988eaaee1645ab47b224d
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeupF:A3kMeT1LljG
- TLSH T1C215BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 930KB
- SHA256 d5de38a7de63caaa10d7b54cc054b266610667f55e30f634416897906ec10fc2
- MD5 2155524066d660de7766ba6d02d0d83a
- SHA1 429dfe5f61ed4f0a608e5b1f2e2054253c4c9f8d
- SHA512 4363398b59225afa1782d1e5125674fb620807e46b9ded671d9afd8b16d68105db03a8fa7c83655350f5d38bec3aaeadcd37d1496bb35649e526579f90befbb7
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuCC:A3kMeT1LljC
- TLSH T14615BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 930KB
- SHA256 ce2d4522a8edcace6d0ba4d25430a77ddbb627edf4f8e581122dc6675c09799b
- MD5 fcd3c5c99677dd998a14fc7c93bb59a0
- SHA1 aea689c361f358082c971f14b351ed5569fbfca4
- SHA512 525cdcbb9a47e41883188a44a1263a308de39ea2aea971b074abb106b7ae082553322cca1d8d0d00974461ce92b46ca9668562b5127563e12dfaf2adb1ad1aba
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeudw:A3kMeT1LljX
- TLSH T12815BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 930KB
- SHA256 97b9859607fea6afa02f55ed6ae0339e68322038151000998f7d7eedd5c3420e
- MD5 d026a356bb5a193d332f5610a6bdbdf9
- SHA1 bb163c64eb2130341e4d0c78141a44e0c8bdc2b9
- SHA512 f9f5ecf3c314c20e899af902e6b6eaf373b1a87f2991d084bf5f5a72ce99d609413f3673ae5598eb58df447881fea4724f6f03dc8a1cd2287bf073a6a7be3463
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuMT:A3kMeT1LljT
- TLSH T10D15BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 930KB
- SHA256 4a4c43c0593d0077be347c5758c5d999da1b4806b0fa1600b40b8efdb596a436
- MD5 048a1195982b83d5dd6696cf2d495d1b
- SHA1 d4bc0ba593dd3ee03b48cc9407f848affbec1c7e
- SHA512 744dd2976eafe379d22adacb20b70c33363d15f0e9db8c06533205dc90adedf1503c88a4f2ddfb57b5a22a1a8d3cde278b61371bb42b1210cdeafb366b51d11b
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeugu:A3kMeT1LljE
- TLSH T1D215BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 930KB
- SHA256 95fa325db50697f078a22d161f4049dc7394c4bae661b0f3bc7a14b4f3184f61
- MD5 935800639520a7569e25f45741c08a3c
- SHA1 06b94f2c37ff8204dd51f64c6ec8419b19bb0694
- SHA512 522abb5ce6843729125495ab52af30f24c4a4c7d026007202c56585632b4121ab7851332f2b221869a3c2ae8bdaa357f51a40c2271c26932010631c8413180a6
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeu+b:A3kMeT1Lljt
- TLSH T19515BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 930KB
- SHA256 8500a9c3b5b0c1611e4c3c67dac6795cabc62442696c08e901bc62fa436aa3d1
- MD5 b1a8a0d0e0d115f62c4cb5fbe08d3b17
- SHA1 4474b205d7958075cd92997d3484727632605027
- SHA512 d8ade9c9e465e136954090c96e98a4d64cee11cdc367968cb1cc6c71a7443efdd98e354a446a75bfe6a153f159536d52878b7fcf2e06e7ef928ac94a0a9dd792
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuof:A3kMeT1Lljd
- TLSH T1F615BF17E79004F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 930KB
- SHA256 458a54c4f68048b52c8d304c9aeb329f5cf37f419410e17b480ccad2af852195
- MD5 01ab657006072c84a73f82a775f438cd
- SHA1 82e24f91e4b0cbd991ccd768f5f485a20717651d
- SHA512 fe5bdde4ce11cfbf054bfbe35e1683d8fcb95984a0a47c8c9bbbec9159165cc85bee3952a1b4653ca7b6dd22d85f9588daf39adeede3407c3522a73d3ace4917
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuFK:A3kMeT1LljV
- TLSH T15415BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 930KB
- SHA256 39e393e49f0145504072d3a9a9e674ce0cd5ad5d75332325d36b8ec507439add
- MD5 1eeb6a63bceac06ddef4d56036204f80
- SHA1 c2a6014d71c64360c4966311028da0d383560c06
- SHA512 86c9d378d266c182ff491b6c04bb081572aa99c96275a8ecd7fd0ee96d7a4f61b50f2cf3537b118f82b66cff55b08921cb6f814b999f25c6455fab338b4fe220
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuGk:A3kMeT1Llj8
- TLSH T1E215BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 930KB
- SHA256 34bf36109a1cb29806208a2c3c04ddb79f32c780d3e59c595f2d53b3c2d7e472
- MD5 f81aa67f025a4d29ef24da6705b49094
- SHA1 559467aefd185b1238b130cdce600d7a06992a11
- SHA512 2fef2814e8d5d841ad4234cf21ba96312b1506807f0bd5b68fe765daa7047703f8a0ebdd129ffee5a889efc42042d9989285bd549f67f9f82714600f8a01875e
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuD0:A3kMeT1Llj1
- TLSH T12715BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 930KB
- SHA256 3d92337727912a4c612bf08f6680ad404fff4f228fb962c8ba1e2e4f3972fc00
- MD5 e1d2566d6d1c50c3811528762da64f68
- SHA1 13c894447ac3017ff0e7a33e2e7b921c91a19b4e
- SHA512 9018f2f45ac64d9600c5d7a74e076892ad29f234249631410026393c9c3c91dd5a4e69c2a4f059165d714a78ddd62938c6e2def1a0fddb4150080e21519fe686
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuSg:A3kMeT1Llj0
- TLSH T1A015BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 930KB
- SHA256 12da62728c989fcb5465f1273e8acbc72a2232013d5f361b5f728aef1d09d6e6
- MD5 1eb178ad5314c0efe0d551d8556f1abb
- SHA1 911b7c077ec3c1403136968045b9c28caede585c
- SHA512 92d0470dd632a150f5c3d2bbb5e030121bc3a36961c88ce217a0b1f44252363e17d202ed8cbbc127206276c2417a9e326cce6ccd0afff094e06727cd65f11046
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuzr:A3kMeT1LljG
- TLSH T18215BF17E79014F9E8178134C9A54A16FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 930KB
- SHA256 60c94957b3ccea6a6efdaa417fc40ed05d31cc98ac5c0f7359a57a29789aff3b
- MD5 226e6c8bfdc082507c641718ddd83cd0
- SHA1 d651f9e04cbf5c2e2c045b720b6d2b194f880fa7
- SHA512 a524944668430d6ce409f2c23080e4ba8da8c9ef66aeea508678b8cc9a764ce19afbc4da2ba6ad9ca06cc5e0854e057b4185c7b5147196b0d9bafdc3faf11529
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuVn:A3kMeT1Lljg
- TLSH T1C915BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 930KB
- SHA256 478a79982e33da67faf0a01f2b4fd6a73bf5f39ffa1222f57f6d92e5a6aff141
- MD5 91deca62896369aa88fde86f520652ee
- SHA1 25d188e725c533ec232f54ac9a269f7722e4aee6
- SHA512 cc9d7b64dda94f39250a3555e6d40b0963b373d6ad0f701f487d04c62faa17639141bafc426cdf78c2523ceccb78c24c85b5688326d01ae6717c38ea410b853c
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuhx:A3kMeT1Lljm
- TLSH T17A15BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 930KB
- SHA256 4168bc4a23b150ec718a03b8c82f9ae8f02e2b2e985648cfe196a1b37d4611e5
- MD5 55ad655312d84daf7402d35b7098fe18
- SHA1 0b0abc59c82e6a99622628bb6ad8e931b7ec3fb3
- SHA512 543777f8e694d5a821ea536c5d5f353d68275a291166bbf81d295ae844e683df5b30c9fc8e6a46534456d5cc12e494d1a7cbeeedd3b6e9ec71f99fb45dc1f8c8
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuPA:A3kMeT1Lljd
- TLSH T1A715BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 930KB
- SHA256 26eff8c0a2d03ba4ce8f60882615b04ac3309d93811d53f9b98d2b4c7e01996d
- MD5 306221b41def9a4a8224e41d91b49da3
- SHA1 04929099dad96500c35b8e61bb345da719fb8851
- SHA512 b0923298fb1810aa3624eef491b24fafbb779f670301c17d2a481337efc60213c3630e90c72e670abe8786c963692479da9c27bbafe0e74d097b336b1535b42f
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuA9Q:A3kMeT1LljM
- TLSH T12015BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 930KB
- SHA256 5084fd7fa98de6bdf6edc56b8f2dc98de248fa9cf11f204fd97ea5303606c04a
- MD5 5d032a757bde731c45f62cd647c065e1
- SHA1 4948636b432818daeecf0ebf91dee60cb1497c53
- SHA512 5a38e867fe72bac63243b676802a3ec40c8c0b3b98fbea1ae5bb78d81ac18f4870539c3def5b473c84185fccf63b46ffdb7b55be7760b38fdd74da1532d4887e
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuB4:A3kMeT1LljH
- TLSH T1F315BF17E79004F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 930KB
- SHA256 4f01c9cfa2e3da6bff5d39c5ffc1922a734a4aa23c63768928d8b667e3360fd5
- MD5 ae69af9bbe1561444433bfefc033bdd4
- SHA1 f61e45b0a93d7c39fa03ca2474ca97dfed133538
- SHA512 b9e439598d1001e56a6ea0cd1a62e7a02bf17ffa60009d7bb247050e69fc63da6687e59ab0e4a892845174eabb6bfb02d10f7b1cf9cc35e728ea462f4e69e08e
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuku:A3kMeT1LljK
- TLSH T19815BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 930KB
- SHA256 b4069dbb81eb9bf2ca041436f0696620e5238ea7c0adad62fda1f32ccf721530
- MD5 d22b14394aaf1eadb58f816676414ff1
- SHA1 c55e8470c3e75f6440bb42a6248841b6b52b58cd
- SHA512 b626443022b8bc00019830d172b61ef3c14d94a6e346a33b181ee3c4f2af99c91db475143a13c2eacebde3cbaf981dbc73c8fccfc4e4db8f97bb82ed20816365
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuVj:A3kMeT1LljE
- TLSH T12C15BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 930KB
- SHA256 a6577e2a6f57f7eab2faa16d51502eb475ee5ffb523dae3298205dfb4c1346c4
- MD5 54fb28a37a4c2b12b0d0a3f5cde9c0f8
- SHA1 5f077020b6e8a1baacfe5e7a3b73c2c42e651aad
- SHA512 69641579550d2b82b7a432af5846f0ef655798e7f74287f3bc344a1c2babc70a7b57d51770bd3345c8904f7d2b448e6f7b8ef20dde777be71be53864bbdc7b3b
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeu8g:A3kMeT1LljM
- TLSH T19015BF17E79014F9E8178134C9954A26FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 930KB
- SHA256 8ca9ccfb1acd19fed753168f38a287c4a26cf91f031b4c623643abbf2708b842
- MD5 5500e48efa540ecc7b4023fbd054547c
- SHA1 aabb8aba7e739a278aae6c94bcde4ae597876d94
- SHA512 9e4ac410dec47365439d157352efee9ec25e17680c486df8b859531c368ec9b672369e589b276bdf0fb8d6d41867864dc1522b897d33cbad9255d3772607c1c7
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeujI:A3kMeT1LljF
- TLSH T16315BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 930KB
- SHA256 650ac5b34f55a72fc34f335f846e18a62d97ddced9a0f8622dda4ef18c018301
- MD5 d295a39a75860ae2aff35f8d0a25615f
- SHA1 52c7b84a8d89899cbfd7b1d1c1b779fa463aa848
- SHA512 a7524d078b3a429d3022c34d40eda043d4b57dcea90442ab86e3ac2d2e5b437a2ed9a3080bff4cb1f33abd3b15620542f538c6cf5d3e7e94928a74609b48ee39
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeu5o:A3kMeT1Lljz
- TLSH T10915BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 930KB
- SHA256 ca89358358f0a042662ee41596b91ebbc2fd644063e0a585c3bac4e968796064
- MD5 8ee76edba7eb75180e0c2772081b4e8e
- SHA1 6c2af4564eeb8968ddaac88cfb7092a9a8f8d0d6
- SHA512 832d792a0ae0170aa762d99aba7bea9466bfb828c3ada112b9bd5a8ab7d0b126bc29458546500662fabcc87f2c9ce2ac06daafadedacd82561d68ba74d6ea345
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuq+:A3kMeT1LljW
- TLSH T16615BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 930KB
- SHA256 06a049163166009ec5d0d0a6eca84d53731d44c402cdeea78ea51694c901a67d
- MD5 d5fcddc478b4ccc8ff9387f6b9eff6bd
- SHA1 12de9b4fbc2ef80e2f775ad761ac10ff04342ae0
- SHA512 19979a1669076701778c5d22e37ced1d46a83c8b382cc805f3e881088e3fa2fc99cd9f6f8f5047c33bfc1e74e7ac89db2e616cd929bdb96f465a7541038c1420
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuqQ:A3kMeT1LljS
- TLSH T1BE15BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 930KB
- SHA256 4159e0bfd256c10a2259ac5dd6b6d2951b5274af3f2492964e72919c90cb5085
- MD5 8f4f3d69f551520fd3130526f5073b4a
- SHA1 ad83df006fc08013598fb43bcfd53396a7d57c91
- SHA512 49bd46827a928b0eed2bbf2864ffc64c42b8a681a2e567ec95785e1ec9ab02e81caf0f17537d3d5accde493de0d55695610c56d39643ef2e977abf9d5cb96231
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeu7X:A3kMeT1LljC
- TLSH T10115BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 930KB
- SHA256 413b4381d5a99669fdb1b45b492ce699a33286d07543c1b8ae3d2f835f29031f
- MD5 0a9730bf31c269b53181eb53de3c1416
- SHA1 e7c82845d70fb89b41c420b95a5e9494dc36d250
- SHA512 4513a61d6b4078b32ab3b1399c96476efb63221ef1a1c9116e90e0a9d1868240c33a2d5def7c6e9daf057da1a39bdf68cc5b0b4b97c916b835d7e109a2cfe703
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeupL:A3kMeT1Lljs
- TLSH T1A515BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 930KB
- SHA256 2a4624151683d4cd6da3bdfbcbc30191f7e615bb1739298fce197aedb461b808
- MD5 600d263d9f179584a4d1906ea9fc3525
- SHA1 4748f11cae69445f089579615b6cb21e4a0338db
- SHA512 b0f65df9d82a82ac1cbdaf91fb672c7a16a67bcdb9c1430a33ee4fa7c5109a1d99859a69b5617885b3dbad1dea2807bdb9214eea37ac1a3bbfc225ef47d03d97
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuXM:A3kMeT1Lljd
- TLSH T16515BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 930KB
- SHA256 a208b1c76142fda62291f34ebebe5637dc58f7cd5032aa886593fc97bd2012b8
- MD5 5ef867076549a3905eec22d828357394
- SHA1 324a7c79e300e0439f690fdf5f9dcff78c4d4923
- SHA512 a2af2d7e97dc862b86e50a8c21cc3d0601e90c8f8047a28f60d12aa35d1199dc0c022055935ccaa8bb6d1c8c7f3ea4f36e827d88b9669a9859db2059b4f6a2b1
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeugh:A3kMeT1Llj3
- TLSH T19815BF17E79014F9E8178134C9954A16FBB1BC661760C6DF236892262F337D06F3EBA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$
- Size 967KB
- SHA256 6b3992da94ee3389538cf8d9bb20a64afa4e0ba59ebbdfc27616f992eb439db1
- MD5 ace8b18490687a2d84a6b47527af4f4b
- SHA1 e88895660d38ede544905dd29f1c98627c0e2810
- SHA512 41eedebda7bb2e0b91bc8871687f02ecfdd29b2e140202e2eb32d9369106d0fc1809b2a9dd3d5ed0cb10822a7972a2d1bce134e3807cb66b48ebd59931dfd8af
- SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbeuFjv:A3kMeT1Llj+D
- TLSH T1AD25BF17E79004F9E4178178C9A64A12FBB1BC661760C6DF136892262F337D06F3EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH