Analysis
- max time kernel
117s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 00:59
Behavioral task
behavioral1
Sample
2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 787KB
- Sample260812-bcf2aasxft
- SHA256 9d80888ee6078543444330e9051fd8395286ecf6647eebbb897408a8a286ec7c
- MD5 316d92b689a8af7dab9ee37ce3e18199
- SHA1 e86f8ba15c6afd70d9dd7c73ad63186f6c124e31
- SHA512 8014deed65c135c804eeb5afd14efc0cf146f30b1c7db88b1d1d0c414349920381c44e67b662fc5423cd8a1ef6b312c9c7a7fdd65284f04dea807cc6c4dc39c7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCif:A3mnXoZjzyacNVOE/HgD5TvinrmCif
- TLSH T1E6057B07A6940FE9D11F817499924A62E7737C125F2087DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral2/memory/4716-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c547-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4716-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4544-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001896e-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-243.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a4a-453.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-600.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-729.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-939.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-965.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1076.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1108.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1165.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1191.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1235.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1351.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30c-1410.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b66f-1891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b670-2012.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c547-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2de-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7b-60.dat aspack_v212_v242 behavioral2/files/0x000400000001896e-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a48-210.dat aspack_v212_v242 behavioral2/files/0x000400000001983a-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-230.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-243.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-251.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-272.dat aspack_v212_v242 behavioral2/files/0x0013000000018a4a-453.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-490.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-600.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-631.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-644.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-729.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-748.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-811.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-868.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-939.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-946.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-965.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1020.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1057.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1076.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1108.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1146.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1165.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1191.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1198.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1235.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1338.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1351.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1364.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1383.dat aspack_v212_v242 behavioral2/files/0x000200000001b30c-1410.dat aspack_v212_v242 behavioral2/files/0x000200000001b66f-1891.dat aspack_v212_v242 behavioral2/files/0x000200000001b670-2012.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4544 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\SearchExport.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4716 2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 4544 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_316d92b689a8af7dab9ee37ce3e18199_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4716
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 787KB
- SHA256 9d80888ee6078543444330e9051fd8395286ecf6647eebbb897408a8a286ec7c
- MD5 316d92b689a8af7dab9ee37ce3e18199
- SHA1 e86f8ba15c6afd70d9dd7c73ad63186f6c124e31
- SHA512 8014deed65c135c804eeb5afd14efc0cf146f30b1c7db88b1d1d0c414349920381c44e67b662fc5423cd8a1ef6b312c9c7a7fdd65284f04dea807cc6c4dc39c7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCif:A3mnXoZjzyacNVOE/HgD5TvinrmCif
- TLSH T1E6057B07A6940FE9D11F817499924A62E7737C125F2087DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe
- Size 886KB
- SHA256 bf1de0b81117349952cb982becd239b78cbafb28e41aa2b3c16170430d35af6d
- MD5 96af9310e46d156febc9568341e48141
- SHA1 5d0ddbe545035b2beffb209d3210379c43691823
- SHA512 35b77d5246d88f806091637ad90d494617de0b660507e5b0a043710a8e0331ea226212cbd0b8307b523d66c669feb427d6793cd107d9e0b82d52ac35a8ab7735
- SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5TvinrmCi4IxITB1i:A3kMF56r2xI11i
- TLSH T1B0158C13A6940FE5D11F813499914A62EB777C225F2087DF2354AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 886KB
- SHA256 5bcbc4fb03a6d59c3131d4b5d556c351a0743ae7457aee104a7bb836f73a68bd
- MD5 0ef60354e50e9e02c888d1ea3190705d
- SHA1 5b2433d5a7c198eecb99a2377ae0c1520846e3b3
- SHA512 88a1cb62eeee7201cfde73f4d9e65e02701d66e71794f87a9c01c1f8cd16fa2eaf7b6994cbec08156cb7eb6d610d4bccbfacd01f51983f7e0a8059dca02d903c
- SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5TvinrmCiRbBPzBAU:A3kMF56rGBPVAU
- TLSH T1E3158C13A6940FE5D11F813499914A62EB777C225F2087DF2354AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 558036dfedfcc356c52292cbe8e47d9717f24bed1084f091cd87b2ba5cb947b6
- MD5 53785930b13ab2d94de7a0ddc84e308a
- SHA1 b66e4bef2199277e149f1b4ca04762dcd4792897
- SHA512 e7ee35e74f07611798b660cf6a0835f57d1c4ca7610b3c7475afff5a20a76243ba2acef42297a74e68d8ca56856f9c4bb6b098b04579543250a01802b30f7817
- SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5TvinrmCiL0Le5ji0hmxNrM:A3kMF56riPji0Aj
- TLSH T123555A16F6A44BB5D02BC078C5D2969AEA733C421F3087CB13559E283F277D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 802KB
- SHA256 3ea31995b4caff2f8dff7150076ac0dcecf216b26d9bf1878fa0255ed0d92093
- MD5 aeedb561dbf1b4409cf36327469c2656
- SHA1 ae5cf775a445a0f769127c58c76aaf3c1accb63c
- SHA512 fa9b3a7245961a869960302162e8710f823963d344cf8e360d59bf5c2354f50d0c0844a853ea384f71a8abe903039366ad16ccab6a73616368762a88cdf44e26
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiNa:A3mnXoZjzyacNVOE/HgD5TvinrmCiNa
- TLSH T1B4057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 835KB
- SHA256 f57f83b65e1fe91bc7206995d90431c193a11bd1c2df4760f619205ec423ab1d
- MD5 b7c4e3ed5ee87c750a115b769ee8e050
- SHA1 d929a227e01f2c450cb8a3c73d27dc86dd9c40f4
- SHA512 f11a7395ea78182e1ed3bd9b64013cb3bc8e1a933b440803e4d05c5f2e68dba8e5027809c2175057791496d571689099e4f5d618ec7f449f32e84d178761deef
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiub:A3mnXoZjzyacNVOE/HgD5TvinrmCiub
- TLSH T141057B03A6940FE9D11F827499A14662EB777C125F2087DF2354AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 811KB
- SHA256 d47455296da4aae69143a61f4e883213bb6d1109ba6b350875aa8d324bb44265
- MD5 489e4ab514b76f47c3d3b85d75079c7d
- SHA1 170159527efd82e7f73ed9431b6c197b169e6991
- SHA512 1d7f6a569f9dcf39718e502fc18ac138c53d3744de67be2eb1368229d7ac1314c6c6602a2212af109be78a3330225fffaef5f16bc576ad556978e20bb48d7507
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCitZ:A3mnXoZjzyacNVOE/HgD5TvinrmCitZ
- TLSH T158057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 811KB
- SHA256 5041ca458cd2137398f004833c83e1bcda0836aa2c7abff2036e0be29a4d1eb4
- MD5 8e7b4330c7da52d1b329d7d0fd7443ad
- SHA1 3d7d177ae5ac85ec5f25ed4dca41dd106400f652
- SHA512 ca97166d6a41e0c7a5f90923325188d617653f5fae6d4f92a215187b56a4769f45d6210f210b2498dee6b7342ba5eb9fca4839641247e185688823e236c6b0cc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiW1:A3mnXoZjzyacNVOE/HgD5TvinrmCiW1
- TLSH T14E057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 811KB
- SHA256 9aced9cce6996e189fe33d59356c3a7967df07acaf92b72c554ac2900aa29219
- MD5 2e6024444c22952880f37cd3fd3cacba
- SHA1 3a4adc8dc400797c736f4f534f55149f60a842ab
- SHA512 268a5025226ef5910e548d3ae9b386468c77e42d3ba766c656001caca71ba279d21c80e4f575505491b2b76f60a4ef031bc87eb69b1df42e92940211ee9ede7f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiE6:A3mnXoZjzyacNVOE/HgD5TvinrmCiE6
- TLSH T10E057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 811KB
- SHA256 84ad39d693c8d7fd7d2a0fd161697c86a30c7f0e87e6aa3fbd441f3823a5cd9f
- MD5 76e9e00c2ac09134bdb8db0b0d245385
- SHA1 c9e6e3e8b534e0e4b76a630746cef23946ff9205
- SHA512 82c5e71f67af0cd75fc39925ceda001f710afaccd925f1c5e28c7f3541f8c82549b965583c1fa080a1a450c711995aec583d8eab0fb18adbd233fb15917e7fea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCigN:A3mnXoZjzyacNVOE/HgD5TvinrmCigN
- TLSH T17F057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 811KB
- SHA256 53a21d42c8bf1b42bf8b10207e1e714e0851473056e070c52e03126453e695ef
- MD5 d544f42005f722441283fd1d1afa784d
- SHA1 b180ed522abe4832338dde1f8a357fb158fc6f53
- SHA512 03685567ecad9e75693f18eae352e3f14bcead9f31cbdfb63989e96e0b9a8e5b16b0522c08ca2957f5d2fe5f275d84236bfbff6a2a1596f6e19ad65a1b392af0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiOf:A3mnXoZjzyacNVOE/HgD5TvinrmCiOf
- TLSH T1E6057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 949KB
- SHA256 04e23a7cb6d6558abe0428f29d4fc50ced3c2d9dbf422b3c2143904e5692aa86
- MD5 f01d09b6bbb48b0423526edf81309712
- SHA1 575ff2a87d208381a9fe9095134a145fb3da8d2c
- SHA512 4ed50637bacad86f04333cd5a5ef40143b4a8b9bd3bbe6c3db4f0546fc1e3b87f729ebc4778633b3b32d64fc5d19592e15165ebad28db621456e914e4f4437d8
- SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5TvinrmCi1zy7:A3kMF56rEs
- TLSH T16E257B17A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 811KB
- SHA256 08ea002e610d3f5490f55dee472be21592bd420964461aa5f79ea18e3f7f0330
- MD5 75d6f0d8d4c72c286915817b68dcad7b
- SHA1 585976c9cd741914ea3563f2ee54967538fa8508
- SHA512 0993d2778b94124a467cdf287e2862efe94a4e5abe34fcacd4620db95b1ee0de8f083372a13668e634952e8d0284f0d78526650448b61af2bac05e9cd747adf6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCi4o:A3mnXoZjzyacNVOE/HgD5TvinrmCi4o
- TLSH T11B057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 811KB
- SHA256 8c685e5702080810c6460fa5e77c5f9a33c30648e34df677774154ec63e4d518
- MD5 72a15cba171338777f7974553f36cefe
- SHA1 3a9c064df11c6d22e43d993062d07d43f315bee7
- SHA512 d0f8929238a213f41febccc0b8844d546837f9af81faac6f3f08e8ebb854d3888a19679b344ff38aa1a383827ea1f41ed5f0881db75111a7192990292af45043
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiIu:A3mnXoZjzyacNVOE/HgD5TvinrmCiIu
- TLSH T132057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 949KB
- SHA256 868360222a964692e21c0c9d52f02988e3df2330d577e6c2d1f52a23f170751d
- MD5 1e85ec9643701a108e093f3a3c3fc989
- SHA1 9f4f3e4fd8cde3e82fbb5c7be9f60f58c2e58eff
- SHA512 05cbb09967ef9e1a0f24c7f5b7aed0f513fa65af081cfc1a0341a09c0522f1641434b90fa80a213909de35663d3545ddfe45eecf9a5d6e554b8aac03a821a039
- SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5TvinrmCiEzy8:A3kMF56r1T
- TLSH T12D257B17A6941FE9D11F813489924A62E7737C225F2087DF1364AE263F327D06E3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 811KB
- SHA256 22759a183c625596f108ddbdd73de4fd185b054e837854334da46fbce020bb9a
- MD5 70302b6547fa59c4d55456de91b2e16e
- SHA1 a6c70bf30ac70b01fcbacf6af3b1544f2b799808
- SHA512 f2f8122809e85a6d894e2f035128e7f84bf020c36e1829f097994b0b94339bc4a403553fd4fdaf4b1277daf6ec4e10023b841c5a686c6b9dcdc0fae232b2165c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCic9:A3mnXoZjzyacNVOE/HgD5TvinrmCic9
- TLSH T1C0057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 811KB
- SHA256 be7f9be2e4839a28d20bae3e86aab3900a83f841bd070fb8ba5a278230906a7f
- MD5 53b36d5a78f354c8cdcff38347ce4238
- SHA1 77d162ee7f6bb122c7c7390a332895b94d76ffbc
- SHA512 447b9b3bf2c6f8fe5f05b1f7c6e0b6fb329438b121c45ab7bb8caebd932005115ac81b9577dd504553313131a069a3a2fd84b494880ca2f8817fc3a23efc03fd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiEc:A3mnXoZjzyacNVOE/HgD5TvinrmCiEc
- TLSH T174057B17A6940FE9D11F817499924662EB737C125F2083DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 811KB
- SHA256 5879057a98d2452902d1703468027ebc3d48933edd580ba564b6e3b48e506bfa
- MD5 127236f68da4dfe6b47feb8f2ac00d6d
- SHA1 236583279c4eb3aa5451b832c3b930a9c8a5f427
- SHA512 16f6d7bad99998b7093e54a880f30f7f5454cd12d185a7684d3ba2951c36f6a06e2ce3f5de8e5cfd468805f445661d34922bb6ae77a5697d13036942c5da86d4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCidp:A3mnXoZjzyacNVOE/HgD5TvinrmCidp
- TLSH T12D057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 811KB
- SHA256 2276f1915bffd89571be7d82eb664a90d534fdea4e5610582cf275df238dab56
- MD5 73399c74d3f223766be2045ad4a702cd
- SHA1 d390add3e516d7f072385f48451adf7ae20e31de
- SHA512 324fb2ca74881c33efdc6142b1ff1bce9e0f36c9ec96259553bebcb474c3dcf1e7824df5e3c7dc8c57369349ed4f48c1617b3bdcd37f437caeefd44a2924a9f4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCii0a:A3mnXoZjzyacNVOE/HgD5TvinrmCiiN
- TLSH T11C057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 811KB
- SHA256 7ec33d16d2089a843fa290b7bc51816d95edac881424f75154c7266deb30cf48
- MD5 54d7d67f84fea1480c5e0ea96df1d983
- SHA1 87c807c44f8265375e2aeae4bceb32cd46074811
- SHA512 80fdf38674d5b71025f2df6bea1e81419e9fcc4966222305e1dcca1d771a9e72fe39fa2f1d6204c9e59aaaa911c1c2f38918af32fa6c1e6c29188e87e970709e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiGF:A3mnXoZjzyacNVOE/HgD5TvinrmCiGF
- TLSH T19B057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 811KB
- SHA256 573de2087f913a3a9ed2ea6cf32cf2035caa6d7febf7941616ef6ecec52964a1
- MD5 d9ac073afbf3e93b086f072ff8f4b460
- SHA1 222636c0d94eab34a37279d814b9ee602a4ce566
- SHA512 f906299d33ba406867bad08f49ae505caa26c7ef3d7f727fbddb2812298478ba8042c98c28884b59f78d25005eeaa8bfe1764a6acfe03c034d4e58223777d25f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiTC:A3mnXoZjzyacNVOE/HgD5TvinrmCiTC
- TLSH T112057B17A6940FE9D11F817499924662EB737C125F2083DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 811KB
- SHA256 ed6bac46a916a111f288c9f5f83944dab04a28c4cf470bc897d0468c41e27b7a
- MD5 86917797fab1a9d3da500f5a1c953cfd
- SHA1 56e6f5b6bb6b19c8be6de000b2197139156f917a
- SHA512 d7c78ee63779ddc97fffeb950f1e34d6ddb01b939d362b43261a33497cef5fc26e3acb0ea291aa3beba3d13eef65b52347c091b8c485eee62be97c3c3bc007b4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCicw:A3mnXoZjzyacNVOE/HgD5TvinrmCicw
- TLSH T17C057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 811KB
- SHA256 e81e466618c5d3e8028f0dc73a21af9a48deced71c6de42baec8b75a5aa52cec
- MD5 2c37bfe1408b58f39f27d1c1c5b801f3
- SHA1 c16ac2ddcc6024454f9391d9181cd6ae400c8075
- SHA512 b25bd26820c08d0936c038f343bc6e86ee9df260f045c7f6ddfb00aa33015e66c159a90e2e7988a267f854ce153104d21f787398c538c480913c5cb476323e07
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiTT:A3mnXoZjzyacNVOE/HgD5TvinrmCiTT
- TLSH T107057B17A6940FE9D11F817499924662EB737C125F2083DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 811KB
- SHA256 c95981cad09b3ce92960c08264c6f2e022b7bd07aba6007f4894dfaf35d7ef05
- MD5 2e5f45d073dd39a250457a3c4fba4aff
- SHA1 7321f1b32a22c0ca482084da58efccf09edec73a
- SHA512 c43185e150fa4f858fee58b036a4a005eee820666dfa8d6604076dcb398683d46bb1e8dbb68ede5be09e17344f8bb60fa3becc42c572d8d9d42ed7e657b489e5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCilu:A3mnXoZjzyacNVOE/HgD5TvinrmCilu
- TLSH T153057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 811KB
- SHA256 4875e46a783dfb69d51ce0cfbe6dbca247b875d9fbe69ad836eb322bbc05f8f4
- MD5 5c2b9965b0ca07335dc4843c8c69b0ba
- SHA1 bba18a0467d8a68d7ce6e02f5e9d9738dd99ba21
- SHA512 422458a643d5c0820a7ba8e5fc1e0c587dde6e728bed09fcd611f1244b1abc2e049c7778dd4dc64f693ed4508b2a749b03cc0a62450f646f97c4dd19bef7da9f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCitb:A3mnXoZjzyacNVOE/HgD5TvinrmCitb
- TLSH T1FA057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 811KB
- SHA256 24cab2ecae0bc2a68b9f1ff5cd7139e5cc806f497d4ac255d8682a9c322f8f21
- MD5 a057e8adbabe3970f38d7b92165778f6
- SHA1 598193e6c4327ddde82c745052764dbf104fa550
- SHA512 27812c47ac121c9368179a6c1a65d03512bbc3e6f4b1389ba9521f59aa957260edf1a7f14d28b5a2abe0b6d8919cbc7a8c2f7707c7fc6edd769a80ba92533872
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCidf:A3mnXoZjzyacNVOE/HgD5TvinrmCidf
- TLSH T120057B17A6940FE9D11F817499924662EB737C125F2083DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 811KB
- SHA256 297092912d60959c82b9366abd6ce9c0844fb8877e4a44d96eaafec126e59f21
- MD5 91ae585f4c009307c2dece0529f295dc
- SHA1 0b69c6b3c606cb16349434f3f213293e048f2436
- SHA512 0411a91a4a67b5ebb1f2082f7f20e9e91e5d03a8e9fa8f640ab91dc282191bb6c117ee3aca65bdd9444ddf4e3f4737e53ee9e7421c417a8d8f73ae968520d4c0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiGK:A3mnXoZjzyacNVOE/HgD5TvinrmCiGK
- TLSH T1DF057B17A6940FE9D11F817499914662EB737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 811KB
- SHA256 a6883539c22a6620380bb012310a825d07e611f1e7f4eac0ea4ac263c2c27cd0
- MD5 9a6cd69d92896a9687e3b0d4ebf0389a
- SHA1 9618c46189b8d0c3d1831a7141c068357dc046d3
- SHA512 6eb068ce871d741399dbc6c03b1aa22a247125fc766faf5074650b556467535b830b4d7e9ba46a5038b2902f896616524370c4460a3992b6e2c62d6a41a93315
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCizk:A3mnXoZjzyacNVOE/HgD5TvinrmCizk
- TLSH T1B4057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 811KB
- SHA256 ae117818147797d107be7b1a9c49b7961a0a153e2a9aa1bce85a045097c5c6c2
- MD5 35530f9038b8a0bbcf7e6c84ee5ccc03
- SHA1 004847ca05a7e493668f03648e2d268aee6f7318
- SHA512 101c0c32595ede7420d89fd41d96c51161d373624b1bb77b6f7ec7c6eb7aeb0846d0c7e9bec2ec367b5c6abc109cb73690b30f2e6a14c8f17ff1881f8844f3c1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiE0:A3mnXoZjzyacNVOE/HgD5TvinrmCiE0
- TLSH T1B7057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 811KB
- SHA256 bb101ffc9fd820d9b74d151c21cc53c64560a94a4aede48f3b4a4569440953ac
- MD5 2ca6d65b6d84ebe105c4308f53e7284d
- SHA1 ed32636e84f45b917d20a112d94d572150d63e1b
- SHA512 83e6518779c28b2af06f304054baf9be877d81c5af260d10a91dd40245223cfac1ad3bce0836680a2e20f0ffdf38786045ea32c3ed77686ea9da58c83d3dc89a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCi/70:A3mnXoZjzyacNVOE/HgD5TvinrmCi/g
- TLSH T19C057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 811KB
- SHA256 2ac878b7d4f319e9e9d5a444b6f793528de98b1e769528795a4bc628860f3842
- MD5 f6a8f7c4ce85e003e627cc11f7005ac4
- SHA1 4995439e26cf44b0419802821b517f1d813cea08
- SHA512 9178cff8af1c26e38a15adddad877869e644c69ab93b6ecb9c85cc3a4d07dffbe2ade523ff666e0a60916d9a27eb5da3eba16941a9f9aa424a10eb7acbeba39e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiSr:A3mnXoZjzyacNVOE/HgD5TvinrmCiSr
- TLSH T1A7057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 811KB
- SHA256 64a333b4f483a8cae5904bb156e5914fe9c384af30376461ef57af865970dd03
- MD5 b7ce474b1b1eb72671adf44f1a945a14
- SHA1 e56ca160961e673c78457c17ee39019311de56df
- SHA512 b0f337a78adc1d3af1db42292d5f27a3b5b6b21d6bb4f10b0dcb2e231e4ba06a9ef812e38556b69159e87048f371cef720a332e6af7e02395bb891dc717d3f83
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiwn:A3mnXoZjzyacNVOE/HgD5TvinrmCiwn
- TLSH T1B2057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 811KB
- SHA256 44c653dac7f660314cf1c17d1473ae43db9cd7dadad8f599814862ba68e8ac79
- MD5 5e3e730e19bdd6ae70c32e740eacd066
- SHA1 9a3801d87940d11edd877680b3a6859468c4dfbf
- SHA512 2b98edb79c8490193b900ef9e237e1ff1f1f7021077f364e21337119389df0af5fe9a9dc0deb60cd43db34add54fb8d2a55256c8b43020259408ec7403635b27
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiOx:A3mnXoZjzyacNVOE/HgD5TvinrmCiOx
- TLSH T161057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 811KB
- SHA256 e80be382f270cdd326a2e1ef5be97266892f074c19516410d6df10a8365667d4
- MD5 197e67635419ca51664cb1be5ea903a4
- SHA1 eaf3596ed47b9a5a352e115412d7aaa7ab2551cb
- SHA512 58bda6ccc934d4328ef441e0344c8206f3703d614fae70284e09807e16c801472ba2ffed941438ea1436ea1b7d34fdbc02a7890e45e427db01a8df3bcef82ab0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCioA:A3mnXoZjzyacNVOE/HgD5TvinrmCioA
- TLSH T1CF057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 811KB
- SHA256 b79572e474df30eac0ea84f73e38d6ac7fc6da8d2bd725c01a9a439a419f9a98
- MD5 a6075d8d43bed0b4c49a0710e3071a46
- SHA1 ce615f6450583f39bac1d463544a1a18d61dea12
- SHA512 775139b34881450890cc9c08ddd4a23ed0295e87aaf01b88dd2d426fa944a449880d0b25ceacfa55796eebe6cb585d39a793dd32439b029806907d9cc2365a0d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiB9Q:A3mnXoZjzyacNVOE/HgD5TvinrmCiB9Q
- TLSH T1D1057B17A6940FE9D11F817499924662EB737C125F2083DF2364AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 811KB
- SHA256 f95e05c7c21644b846b1e88fac364a96d1db5cbc10e0ab1786eab40459c0679b
- MD5 7e9505a511b5db05e1621cbd1fa0ba26
- SHA1 9edae7e3111ac5e1edf332194f8ad91269e83b6c
- SHA512 eafa52b09597757f8ffc13cc390a5716f8075edc425ea4c3f42323e3c79966f9ac0200c3b07d85916c50c66caf6c879c2819a371c8cfc38b870a03348c0048b8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCi04:A3mnXoZjzyacNVOE/HgD5TvinrmCi04
- TLSH T145057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 811KB
- SHA256 4bee5b7d7f88b194f6a8193b5ab2a3b49f511ef6cbf00163db360d2b70440ae8
- MD5 27f1daaf298ba30642bda79697cde2c2
- SHA1 12eb6c0e9dcff170dbd636dc641a95e0c3814d0a
- SHA512 c1eb850a7c8aae2b6efcda42aed88d07d10da422a303382b750fb615344b038968199f15acad84d450a4be5596d37d9e76c46cee08078f8680ca507df003cda8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCifu:A3mnXoZjzyacNVOE/HgD5TvinrmCifu
- TLSH T13C057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 811KB
- SHA256 48f7bf3a4f436013ad95e5d5efe5356a197ef6014faa756d7df6bd5b02a13f6f
- MD5 59adc00dfdae72c08a4a8c1f5c316a0c
- SHA1 568077d5cc59c71efd9cace293d6933edb10425b
- SHA512 1e2867d16f1724d61e3ad227f9076a0bd228d7c60615bb34579a5c2b6c6d5c910dd49b2c1ce6e5f8776153ac6aa4e1a9b11e1d824742cd675161749259f80150
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCi6j:A3mnXoZjzyacNVOE/HgD5TvinrmCi6j
- TLSH T1BD057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 811KB
- SHA256 6ff35f8f44bdd0d6e232db465d434dfdb0983c6f90128cedacffea97f0aee031
- MD5 212616aa571adb0d3a1a442c883a9aba
- SHA1 b478fee70c99dc9c525b94a86e5f66f5180df4b2
- SHA512 15b1bfd0d5737e18e550fbd0ef7c267f1b07d981d774794d68702012e75753920d67dbc9170ef1546f0ab37a1935f4ffcf7179a87d33ec179181b147b8ecbefe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCing:A3mnXoZjzyacNVOE/HgD5TvinrmCing
- TLSH T1AC057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 811KB
- SHA256 486f4c1c5bde587515bfce6d46af4d2321ccb41fbc214083cdd6c615c11a4a4a
- MD5 d5dd941800111c1909112cb351c9bb2d
- SHA1 3f9c7512b4ede48d05f752dfc3b9d7fb7d32c741
- SHA512 62ef5765f727b9662135ef82fb9f5d25469306df7a9e648e65f583963de341280e6b468f4caf539db9b3d3e8198f0b724c95340aef2bdeb829520f9ef523c96e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCi6I:A3mnXoZjzyacNVOE/HgD5TvinrmCi6I
- TLSH T1BF057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 811KB
- SHA256 1b96a5c6065bb1a434e8470815d4f1dc0af8a13f46c44600205c7199d7c32026
- MD5 097f53f733af6d5667d2c91e631f291c
- SHA1 5241f9ac2586c389cb56a6f6754a622489969082
- SHA512 bd4812fb7367ff5e4c75f98194eb00fc80196cd9aa095f3da7d6a14eb84a1a63d88572b26ebc366b3a15389843109c39603fddea40106d46aea4228b90def98b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCi4o:A3mnXoZjzyacNVOE/HgD5TvinrmCi4o
- TLSH T168057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 811KB
- SHA256 22229d70c8525e78b8610601856ada4d865f9b55126e5d05cdd56feb62e2ccdf
- MD5 33929605a80d3b318076ebb5606ea22b
- SHA1 4109704b6cfe26c4cfd5b65fd919cd5786b4c16c
- SHA512 f97c925449aa4326e87811af9cf5080df11d044ffe02eeec9f8a7effe18002a3e8b98c2650c0a98b13cd7f00550497a6957710ab1f29eb930c55a7d913ca5096
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiL+:A3mnXoZjzyacNVOE/HgD5TvinrmCiL+
- TLSH T15A057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 811KB
- SHA256 28e5a6258ef79403c329b6ae9e42d25c43fb15968c8f8cf16e08dc875274551a
- MD5 80e66a6eb1bb0c1d664033e2364e673b
- SHA1 31da3c81eb4c9fd17805d6763680d0cbab71564e
- SHA512 620dfb09a8339f33347b7cab510670a5385219d7e1953477e8ccbdd380f0d49b629b4e7c893973b89a6e2cc0a128d27d195f72309dd448920cf39916b3e16bc3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiBQ:A3mnXoZjzyacNVOE/HgD5TvinrmCiBQ
- TLSH T182057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 811KB
- SHA256 12e07b710265cff33f46fb5a44ac75857b8daf97dd23005329675764a4cecf95
- MD5 f170d8fe85e4b1d4ba613b40e6032c04
- SHA1 df1095034adbeacfc9b82c038da4e1361cddad50
- SHA512 38140c1aca2af673e91bfacba2c765a8fe00fb52430a221300c92fb6a977bafb1bf81026a8a64a0901be869e35830a317b69b711f6fad1f0d30143dad577c38a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiGX:A3mnXoZjzyacNVOE/HgD5TvinrmCiGX
- TLSH T12B057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 811KB
- SHA256 d68747cb6692f42515e7ae3118aa1c54d268ceb4afcfc4dd0bc5850d70ab043b
- MD5 166c90617865d65ab720926694281b02
- SHA1 2255d383cfdf4e0051504aceee0d0df1ba140677
- SHA512 80bc61f830d92c7314671ed8ef3b34822b96ecb82c598b9d86606694093f17169b9bcf9701769c9ff11904f0cd63233391cafd1c3de4086cf0f0c15b5d2b5da4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCiAL:A3mnXoZjzyacNVOE/HgD5TvinrmCiAL
- TLSH T15C057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 811KB
- SHA256 f4ba6416632134a56f44b861522d51639cfcc3a72899ab12e15174cc0fe3d4f9
- MD5 655423ae30437cde95a2925a8758eff5
- SHA1 73123307d1525e8643b220b68b8886ca8a3cd4d8
- SHA512 4620f352f10fe7c3c62d753f5e79428a198ea782ddaa9065de63a15a6d10cef3a59e83cf720e83abd76dd50c8b80cee55f353d610ee6be81edea94b4e347efc1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCisFC:A3mnXoZjzyacNVOE/HgD5TvinrmCisM
- TLSH T128057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 811KB
- SHA256 c6945418dd2d486c14033cfa3aab4332afbe5b84edd020ed7f8a094a60e1ac92
- MD5 58952d366fb63f635abe858d89590950
- SHA1 06e2c1f86d0f4437b513bd01079e57d80339f61f
- SHA512 367ae41a7a9cb01b3ce93dafddee5bc11a5a82a23b79c04be7ff54ec2960898fc15ccbd81ba8f8df377866754d1648a7c1e91ad1a24ee0abe16374aed4ef904d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCi1h:A3mnXoZjzyacNVOE/HgD5TvinrmCi1h
- TLSH T15E057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
- Size 928KB
- SHA256 e87965a685bf4ae708db8e3273560378395aded4c52fb9bec950eae77817503c
- MD5 3b951f782a75b93314aef1362dbeb38f
- SHA1 76a3f62b58dd30ce9b0b9af0a9027a30c655275c
- SHA512 7a22909942d7c9e8052dbd6ca31772615a37fbf48b646a3e8cd0eeac068252da606cd75ef0c59ac04044ba8e26584efda74e0dbe4ba22349bce16fa586d52258
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/HgD3JeU7vinrmCicKRu9:A3mnXoZjzyacNVOE/HgD5TvinrmCi/u9
- TLSH T187158C17A6940FE9D11F813499924A62E7737C125F2087DF1364AE253F32BC06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH