Analysis
- max time kernel
98s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/08/2026, 09:25
Behavioral task
behavioral1
Sample
2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
- Size 868KB
- Sample260814-ldtzmszfmc
- SHA256 5efb61a76f30c324a376f8d9797df473a4f3b33d578bc0afd3795003a6bb8e45
- MD5 edbe48f7b9ed348391b0e63ccf98d0a2
- SHA1 9d3c2ee0d4ccaa8f603eed457052404b12703adf
- SHA512 c788e0794d97d0f18aa9d94ec9d318ce11e9b96ccaf35bff1f061d36835d54a8c6d49c744064835dcf478e9dac267eaedc7372727bf82fb3d21c97662724bb7b
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmC:A3kMr56ro56rX
- TLSH T14B154917A2984FA8D12F8178C9924962E7737C125F2097DF1350BE263F366D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral1/memory/4632-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002443d-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3000-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4632-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3000-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215c7-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001ff6c-115.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002121c-250.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002121f-275.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021220-402.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021222-487.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021224-512.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021223-591.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021226-616.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021225-641.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021227-733.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021229-753.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021228-796.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122b-809.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122d-840.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002122c-871.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122e-890.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021230-903.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002122f-910.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021231-923.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021233-936.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021232-950.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021234-970.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021237-1025.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021235-1062.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021238-1081.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123a-1112.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021239-1149.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123b-1168.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123d-1193.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123c-1201.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123e-1239.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021240-1342.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123f-1349.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021243-1362.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021246-1387.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021247-1394.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020262-1471.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024456-1509.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002026f-1541.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00120000000201fc-1548.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020277-1555.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002027f-1568.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000016968-1864.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022fa8-1908.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002443d-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x00020000000215c7-60.dat aspack_v212_v242 behavioral1/files/0x000300000001ff6c-115.dat aspack_v212_v242 behavioral1/files/0x000200000002121c-250.dat aspack_v212_v242 behavioral1/files/0x000200000002121f-275.dat aspack_v212_v242 behavioral1/files/0x0002000000021220-402.dat aspack_v212_v242 behavioral1/files/0x0002000000021222-487.dat aspack_v212_v242 behavioral1/files/0x0002000000021224-512.dat aspack_v212_v242 behavioral1/files/0x0003000000021223-591.dat aspack_v212_v242 behavioral1/files/0x0002000000021226-616.dat aspack_v212_v242 behavioral1/files/0x0003000000021225-641.dat aspack_v212_v242 behavioral1/files/0x0002000000021227-733.dat aspack_v212_v242 behavioral1/files/0x0002000000021229-753.dat aspack_v212_v242 behavioral1/files/0x0003000000021228-796.dat aspack_v212_v242 behavioral1/files/0x000200000002122b-809.dat aspack_v212_v242 behavioral1/files/0x000200000002122d-840.dat aspack_v212_v242 behavioral1/files/0x000300000002122c-871.dat aspack_v212_v242 behavioral1/files/0x000200000002122e-890.dat aspack_v212_v242 behavioral1/files/0x0002000000021230-903.dat aspack_v212_v242 behavioral1/files/0x000300000002122f-910.dat aspack_v212_v242 behavioral1/files/0x0002000000021231-923.dat aspack_v212_v242 behavioral1/files/0x0002000000021233-936.dat aspack_v212_v242 behavioral1/files/0x0003000000021232-950.dat aspack_v212_v242 behavioral1/files/0x0002000000021234-970.dat aspack_v212_v242 behavioral1/files/0x0002000000021237-1025.dat aspack_v212_v242 behavioral1/files/0x0003000000021235-1062.dat aspack_v212_v242 behavioral1/files/0x0002000000021238-1081.dat aspack_v212_v242 behavioral1/files/0x000200000002123a-1112.dat aspack_v212_v242 behavioral1/files/0x0003000000021239-1149.dat aspack_v212_v242 behavioral1/files/0x000200000002123b-1168.dat aspack_v212_v242 behavioral1/files/0x000200000002123d-1193.dat aspack_v212_v242 behavioral1/files/0x000300000002123c-1201.dat aspack_v212_v242 behavioral1/files/0x000200000002123e-1239.dat aspack_v212_v242 behavioral1/files/0x0002000000021240-1342.dat aspack_v212_v242 behavioral1/files/0x000300000002123f-1349.dat aspack_v212_v242 behavioral1/files/0x0002000000021243-1362.dat aspack_v212_v242 behavioral1/files/0x0002000000021246-1387.dat aspack_v212_v242 behavioral1/files/0x0002000000021247-1394.dat aspack_v212_v242 behavioral1/files/0x0007000000020262-1471.dat aspack_v212_v242 behavioral1/files/0x0007000000024456-1509.dat aspack_v212_v242 behavioral1/files/0x000200000002026f-1541.dat aspack_v212_v242 behavioral1/files/0x00120000000201fc-1548.dat aspack_v212_v242 behavioral1/files/0x0007000000020277-1555.dat aspack_v212_v242 behavioral1/files/0x000700000002027f-1568.dat aspack_v212_v242 behavioral1/files/0x0002000000016968-1864.dat aspack_v212_v242 behavioral1/files/0x0002000000022fa8-1908.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3000 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4632 2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe 3000 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_edbe48f7b9ed348391b0e63ccf98d0a2_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4632
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 868KB
- SHA256 5efb61a76f30c324a376f8d9797df473a4f3b33d578bc0afd3795003a6bb8e45
- MD5 edbe48f7b9ed348391b0e63ccf98d0a2
- SHA1 9d3c2ee0d4ccaa8f603eed457052404b12703adf
- SHA512 c788e0794d97d0f18aa9d94ec9d318ce11e9b96ccaf35bff1f061d36835d54a8c6d49c744064835dcf478e9dac267eaedc7372727bf82fb3d21c97662724bb7b
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmC:A3kMr56ro56rX
- TLSH T14B154917A2984FA8D12F8178C9924962E7737C125F2097DF1350BE263F366D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 897KB
- SHA256 19f6763c39718e944ba3b90250e01348bfe78f6fce14f8607011f3bbe75e0202
- MD5 41c5d8249457555f6860404ff8043126
- SHA1 eed8b19f0985bebd41218b64464d71d72beb7ab9
- SHA512 fadc5b1d5e30232d8534a1d999bea33138dfa3bdd324edcfd17c698b6e704dbe857a9644eb9b632d737cbd8aaab250af222421efabc5292967b476d1f90c8b01
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmUP:A3kMr56ro56rB
- TLSH T13C155A17A6984FA8D12F8174C9924666E7737C125F2087DF1350BE263F32AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 914KB
- SHA256 b0d10b3be794f67f76823b4e72a994064dc05c0a74b49d4e4b986fd538c5c9db
- MD5 eb823a69d8bf19a191983f5649f89dd3
- SHA1 b7428c0d033d84a75f31879c92cdf0fbc364f6d1
- SHA512 d6bd71262a663f5f46b03ba368dfe1990a41cb8aedc388a117af58d70c4700c62cf8dd59ace1cf5008179319ce413e91114d826871fd20696e2f8367402cf26d
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmz0:A3kMr56ro56re0
- TLSH T19B155A17A2984FA8D12F8174C9924666E7737C125F2097DF1350BE263F32AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 959KB
- SHA256 eef3d2d48c66550693b9c282e1fbe5c51bf902d5fc01877546489d887992ceb1
- MD5 d7e46324bfe09ba40794123eeb92fa87
- SHA1 b28724d1495185ea6767130b7054d8f5286c2e69
- SHA512 01290e5da7e968a7135f2c8eb32ca83a2dd3692b3b79586b0b238cff584539c8f98e561e0206ad58c562868f771a13bac48fa947e4bce6d752e16ee7ac2cef2e
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmI:A3kMr56ro56rb
- TLSH T161254917B6984FA5D12F8174C9924662E7737C224F2087DF1354BE2A3F326D0AE3A653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 953KB
- SHA256 02cc3d963a119a715cd7e94557e1a5eb378379a451ff44b6c897661464d62740
- MD5 aa450c86a4d1fea7d7badcdbd055c10e
- SHA1 f0427e20c2142b2acaf4437c7a91c4fb1a163b98
- SHA512 339ddf34c44f9855cfb4c63c7ec3fe730113a1483b8a813bb9ab0d1be17ba395c70f4171e297561154312926f6e0a18a1251aa5f2bdfcc56e6b36cc67d17897d
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmb72:A3kMr56ro56rC72
- TLSH T14A255916B2984FA8D16F8174C9924662E7737C225F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 920KB
- SHA256 5ef784f5c22c2c1457afbfed0f84f5d268ffc50c4cec11bb9883a735e5905491
- MD5 016a4fd68eeef61a1e25c86728b460b9
- SHA1 d3b97801ec9fc9af20d28e6186e93d3def7d5354
- SHA512 7d77044d25b56c997d4427673369061f9e7a817c9b47058cdbf44420f8ea8c9cb73ab8b2cfb766c3f7b69aa4d269fe5b74cfe43df5932b40903c7df8ed0fe642
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm1fj:A3kMr56ro56rkj
- TLSH T107155A07A6984FA8D12F8174C9924A62E7737C125F2087DF1350BE263F366D0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 975KB
- SHA256 db42c74a6c59afea2d82b3df6e9ba817d17b28dcff467143b7398c0312b26bab
- MD5 7789456ffdf40746a28d78dce29d884f
- SHA1 269f7fae8301fba516ea7ce4eecc8ea06778c473
- SHA512 b5b9db0d9955ee113bd1fd92e22cbe5ee2465f17ce8bebc0e7b6b09b33889ad42348f234de2d3106dadee7318aaeac8e1e91005062631329fe841a18608286a4
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmGhk:A3kMr56ro56rDW
- TLSH T1FF253917A2980FE8D12F817889924566E7737C265F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe
- Size 967KB
- SHA256 e776ce76c157e682d6dc7c218f8de458b27302285e6bc6d5b5a70b09e1cb240b
- MD5 eaf3ea18bbc4cd72cfde8e77f7ce0e51
- SHA1 b3fac0c020b5e62d245c861a4bb543ae6e78f53a
- SHA512 06ade110ab28ce6bdc772ffd4b341a0fc269b5efb6b4fa63afc25b7981ff0f45a1573bd77704df82a70f0e20ed8d4c63bb474f2518dd1bda8135be07a9867607
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmkUwjBXG:A3kMr56ro56rMwFXG
- TLSH T1A0255A17B2984FA8D12F813489914962E7777C125F2097DF1394BE2A3F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 966KB
- SHA256 e26e02ea8ad6c996783828a677c1ee4fb8944e487598357898bb784cc550168f
- MD5 e89d08b19a9d439faa6a186cb2495689
- SHA1 737897f6f9381c67745b984c3cd40592d485adc9
- SHA512 3a7bd9ec15672e4086ce3cc294a366159fc62c48fb8eecba3f6b215a4f389c6487ad4e4d66afc25b3fc5a0ad861f6d146fc405f87926615cca043a5caf23c1de
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmcbBPzBAU:A3kMr56ro56r9BPVAU
- TLSH T1A2254A17B2984FA8D12F817489914962E7777C124F2097DF1394BE2A3F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 8c20e6db52a4b74890d6de824e984fe5868ce4ef3ff24635aaadc8a3c2d5be1d
- MD5 8e96c321fd0dc5da2a733612c5a38757
- SHA1 1a0ccb9cb7edb858b8ed7f646c76fa52d53d9634
- SHA512 7dbddcb9f5b52a8613cd653ac04fd4ec92fe510553b1f835087becbadb39571ee84b0fd64b1c6d49ae60124da2c0d356da1ba468c1e8a4addaa4690c11901e95
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmC0Le5ji0hmxNrM:A3kMr56ro56rTPji0Aj
- TLSH T1C3653A16B6A44FA5D02FC178C5D2569AEA733C425F3087CB0354AE293F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 916KB
- SHA256 b0795bdfc31ffad4932bca56fab0f2136dda4fe7f40c6cfea663a72bbcd3e86b
- MD5 26fab141d3fb3dc4af07ce421ad14ac3
- SHA1 bbfad328d450896c71bebd4f7765abf4f511385c
- SHA512 e71abf2cbc4b23cd9267e49eaefee292d969fa96e4e9016d66fbd69a6361eb95ab6b90cecad353685e758c53929406dc7a409deda8ab7ed1e8e1bebf20236d7d
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmnb:A3kMr56ro56rWb
- TLSH T140154A16A2984FA9D12F8178C9A24562E7737C125F2087DF1354BE263F327D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 891KB
- SHA256 df17571afb364be4424ad77df23c392ed6ddff5feffe9e3d58ac951b505ae901
- MD5 41037747e1f348356c30b565d7ccce37
- SHA1 0d55fc633d174996895fedd72b113b09ebc15716
- SHA512 369c2669cf4bb6e576f654ce616e1181526822f2b1fca6b8bb8a27540728d20d240e7bd8cccc80ae841cfaf677c1889949fe282ea7db35ecbe0b874d213f3c3c
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrml6:A3kMr56ro56r7
- TLSH T19B154917A2984FA8D12F8178C9924666E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 891KB
- SHA256 1b5ad9fb1323d4e753fd184247a3c3a6187788041e2dd6ae3a4c921a8287a8f3
- MD5 3bfa91bad08e8e836d77847c9767efa3
- SHA1 bb35540c34192c01ab24742d6d670f24a1c55ba0
- SHA512 212f205308f4ebe127b0024650c0bb2fb7724a60ac9ade4bbbe3b27d4f6348d2aad23c0d6ce6c5c8f07e1c5c2d608ac12c6e829bc45cd250f1ae6b64d36a7e44
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmbo:A3kMr56ro56rj
- TLSH T1AA154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 891KB
- SHA256 d1704c6ec935da43666497e9f60caa9d6acaa5135b5a323901569fc335cde73f
- MD5 fd5701745f3826ec99960bda252be4c1
- SHA1 9723df38568a19f2e6f2358f22c31429949fecb1
- SHA512 b8b85e435feeca6599def63eafcf09aab78c918051b2b3efd44d0ef17f16e1677f204f1ba49eb186073252629d015d534cf065fa13485bd86f6bce8ea95ed245
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmPu:A3kMr56ro56r1
- TLSH T1BB154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 891KB
- SHA256 28df84fb5c66c67abc17a898a4c8cee0bc79fe00d09e7c7a6843824de0084608
- MD5 6dea2d914c86be22b33ea8e290cd796b
- SHA1 c4d02651d885803a64480656fea03fe2918be2d5
- SHA512 4945bced3726e26a1192155906ce92c32cc6229c7f75e65ba85471ef3f282d05eee06c99da554738e919e3ce3d10e44ebf30204a96e7b17a5a3f3711313c7373
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmd9:A3kMr56ro56rA
- TLSH T17E154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 891KB
- SHA256 bfe4a53952dbc0026e3f0b71abec9eeffe13a78bdd2cba1df732e1440865786e
- MD5 18e4b1fcafd701b4fbf445ae44586d57
- SHA1 b1c9e08d0b39db367806a36948cb0cf841eba281
- SHA512 a8828f03765548c44d0954a1c4ed2b4e2e1466989ad54937e6bb2b5d551bca343a99e0a0bf3b730f00fe3ff26e8e4fb24f0dcf9fc90a6401fd424d9bb66e2632
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm5c:A3kMr56ro56rx
- TLSH T152154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 891KB
- SHA256 9e7c50d84bbdd68ec0943acdd308e5d120d621689e4da3321dc88900b805598d
- MD5 2c3694d03d6c74f5f3dcb5b22e2edb46
- SHA1 5776867b193b483e6062c09047cf6696e783c041
- SHA512 9a890acef52a0c407ce55952c122ca8349b63640676c7bbc74a18e0f7499e8e75813f3a1edc2ff740765147608873b9a4a34ff5e10eaba9f19f70569069e14ee
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmyp:A3kMr56ro56rP
- TLSH T116154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 891KB
- SHA256 3b4cdf9a1c1284a3c28fa6014bbe8b3af77b03c5de606057df2970d123fe795c
- MD5 10dcbc2fdc9f975736b99c53c3f6a148
- SHA1 26ff5ca3a416d81a2d2d7fb5b5c112fc955b1860
- SHA512 07b8983b93354fe6d1dc8a9fa7d3aa5d22334befd8689e432d4b1f91f0626372dade13c1ec8c0f0f2f7226e12f037576af230fd345c9c492f6de00931af70b52
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmFN:A3kMr56ro56rE
- TLSH T152154917A2984FA8D12F8174C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 891KB
- SHA256 d416807680de132092bad744a1ad4889c3b5475a5ffda786fe266c1ea8ae69fa
- MD5 015a72b4c1065c86373830db19fbbd52
- SHA1 67ad1d8c521db8d1f360bef43c92a636b1f3606f
- SHA512 79a5bcb183a078a140ea8e666d90c24fa3dacb1a50666983f5ee4ee6896423b6937fd55ef7bf469aeb399c7d0f7dd448a91458a75e9e7a69fa7c982efa1b3185
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmXF:A3kMr56ro56ry
- TLSH T1D5154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 891KB
- SHA256 82db7bff01261531dba50ded2c6de584b0b4856041369e6b5281bc5c21c7860b
- MD5 cdbb51502fc457d195ca4976d699b572
- SHA1 b4d4181d24ad217e92f854c9ac2ce79246f8176a
- SHA512 1843e59a4b87a2fdd166be57201e6e096bc47bef0efaf250b6eb0adac76c75e12d616d31385aab0d59921a77f8d2751710413cbb0e5ca03d6db9d46b5a557beb
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmoC:A3kMr56ro56rG
- TLSH T182154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 891KB
- SHA256 1970f0294e11be262b60c0d1ab3671c451e508edea3cea2f9135bbfc42943134
- MD5 9d25e52515f98e34802924d1f5d75986
- SHA1 a4e365de0ecf600123288cf618fa5bd5f96abf47
- SHA512 d9241ce26e359783c9045a8de4aab1b8e443d200970ec75587b6ca18a75ee7b7f5c2246e24f22d658749bfbb06b83ef3d5887177fa34dcb0d49c87a9ea02c605
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm7w:A3kMr56ro56rz
- TLSH T1C2154917A2984FA8D12F8174C9924A62E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 891KB
- SHA256 036226b35cdd0d6008efaf882bdedd2ec7d8f9bdc6e7282f5b317662011d0f85
- MD5 c0490ad786b410a2531eec6d0e292b11
- SHA1 79ddb98cf97115fbbde0867a00df1fbb59f10573
- SHA512 cac9edc9d5d3dff6c8cd60869642d6a59daeb1ed71cb45a60b612077cd1fa758ad992b0a53e12699a2af7100960d9b3ad5c5f8ab578458064e8da61ec9a01695
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmCT:A3kMr56ro56r/
- TLSH T1AB154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 891KB
- SHA256 8278b7da7a52678d54babc5ff2b0e176ad7dd734ce8322ebc70af763ee1bcb75
- MD5 3bb1a2e7a4f08e63c1916f5f14922ec0
- SHA1 1194874d5825993292f9da080bbf267d00e7ddf2
- SHA512 322f367c7de8611222359ab9bd5502b19415823c2b23edf0f871f903e4814caac5089e4aa68632618d3739262dcb27d6b3fa4d402fcc6419bff64b8bcf7c97f0
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmSu:A3kMr56ro56rQ
- TLSH T199154917A6984FA8D12F8174C9924A62E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 891KB
- SHA256 091298f64dba1289d4f54ce6b68eb9ba2f3746d1b4df759be77bcc1582064780
- MD5 14ad335a748eb46642de6dab6916579c
- SHA1 8d10fd08189909be2081813b2c6fa1dec98e8e61
- SHA512 5e4e75fb3ec27212a9bf25eb6dc5f3e702a470e802275e621973f5d1c9ed46ea6fdc3dfec6875d6a07bc3b47902506bb153440ebed6ec7e0518220ff8459f2da
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmMb:A3kMr56ro56rJ
- TLSH T1F9154917A2984FA8D12F8174C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 891KB
- SHA256 79d80149fd79f953c4364f3527de55a3ed2b496ab38094186287f49373cb5a89
- MD5 302d0b5046e41fea7d0a9b8345db27cd
- SHA1 3f0bc584d2bc3ba1497bb50721dff0ae35d9a479
- SHA512 44efa699265455b4a0c70b38ff1165ef93a7a553c1b745f786dede84b6a8ec6e6c186469d7a477b5c9234ff5a4f49fb61425ef38d0bd586251c9a7930b23ea5d
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmyf:A3kMr56ro56rZ
- TLSH T106154A17A2984FA8D12F8178C9924966E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 891KB
- SHA256 81621e36f2aa32b911be71ee336cdad58d6d91b3c48ccc36126c3042d0ace532
- MD5 8bf09fe3611e553a0d96dea33d77c8b0
- SHA1 2a1a98240df7bf507cd2138bbf7b854cb4b63942
- SHA512 bb5bdc9e7b80bec71a4db5f5d3071b1319e4afdde21c8f637fb06693ceaec468d75b4321f99720313d7f67475714d49be59ba8cc2a635b5c6ff4678035b1b751
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmfK:A3kMr56ro56rx
- TLSH T1E1154917A6984FA8D12F8178C9924962E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 891KB
- SHA256 0e3cbf8ddd704dec403c72a06337b56f7c737d5169cb333290c13e3499d472fc
- MD5 eb19a93bcde2a9388da796bde62c56a3
- SHA1 588bf43f3baa4ac5eee8fb1b1b68718f77d03e6f
- SHA512 b8b3fcd268c577341134f97dfea2d6be1a9b041d2c3f08864a9a5cc0c6ee1bc44c3ad8f9cf98a41c85639eb0adb81a580a87ef9030e58d7ae00e8af2e3924777
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm4k:A3kMr56ro56rY
- TLSH T18F154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 891KB
- SHA256 47fe4ec06b7cb4b6daa04a76aadcc1fba1f6b0349591bd6eba70c0100fe3ccc8
- MD5 ca7261ae243fbd1bdb5113040b77242e
- SHA1 cd22e32a89f5fa53e4a52c736d0229ede11afc44
- SHA512 edf782caa5d0a63ebfdbbbbc7eee07209c547a1e1f7520681d236ead20414389efbab0a2db4eaa6f7ae2eca952b6b29d8a311ce2bd44a93f99e96148236b7ca7
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm50:A3kMr56ro56rR
- TLSH T1A4154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 891KB
- SHA256 ae32ab407858221aed3d4da1227b85c0d0b4bc9c0cc4bde013ec2d86c549bebe
- MD5 af7e8cbd9261989752ce62acdc26305e
- SHA1 9ae2110dc435861fe5a3fc9fb759ae9d626d3df9
- SHA512 16672dc96932b6f018738faaac2997f6dc8095a8848cbdbda263c183bbacc084e7fabf206d4bded8e96c48124d8029c4c101ec703aca254a4cd96c758fe9ad79
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmsg:A3kMr56ro56rw
- TLSH T130154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 891KB
- SHA256 dbe3dc4ddb407a703ca705933bd13621ff6787a8eece8f83d0cbc5b545214ada
- MD5 1299a0bdae6753bb19ebd96c20026756
- SHA1 dbef0174d4285f901acc7abbfd92e97e1665d81b
- SHA512 d322b7847a5cb846a9a0bb48492d798b0bb30cc207d44419329473559d29b2b6608a5dfbbd5be59368f949b6e922f816ba625f5067673c17dde4f35045616666
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmJr:A3kMr56ro56r6
- TLSH T114154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 891KB
- SHA256 de2c4673c3a871178ef405f0e933f2c81bfeb0a460714bddd7291dd6ef902f0f
- MD5 e167c30ab922a695f69ef522de52a0da
- SHA1 d482e11393ca1456ce90e2ad20506ae45da6ae26
- SHA512 8a6171b85cbdf968215275422f71bf496d30978a7422256ba86c2e043db8bfff1494815c757afc50bc4764597872183b869f354a79c2524174fd19fdb445ed12
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmrn:A3kMr56ro56rc
- TLSH T159154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 891KB
- SHA256 d040b8d189cd99738d89add5b03eaef7e1a9339d23aa9a06363d7f8e5282c8bb
- MD5 b9eb78c6fa50a412d389068945d64d29
- SHA1 6bc53ca58a333bf96a07017a6408b168043d397b
- SHA512 be25fe2bfd92c026089c4d22b0e4764080260ab155e062295951b60ffe089e56b321f013cd010e836d6add729f4c0eb5c39c0559a5bef29add339b2c9dbdc0a8
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm3x:A3kMr56ro56rK
- TLSH T1D9154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 891KB
- SHA256 8ea367a26c682ebf98fea6af21444956d7d1b3fba9bf0a0146952515c4b94b7f
- MD5 6e3ba591f03c256074253de123747063
- SHA1 6393ba99b72fed873a2cb0ef24455a9b49be5ec8
- SHA512 7de17567bc2d2c3dd36c0c0d0b940d919e48d90d0bae57ec80fb47be5a614fe8a03ce22febb96bd747104ca9f33e69b898c85b3db00488e45fc73c30709594b0
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmtA:A3kMr56ro56rJ
- TLSH T1BE154917A6984FA8D12F8174C9924A62E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 891KB
- SHA256 0bdbba834f136847af1130a904ccb491d5b1f74e32bff25225749b616f68ca7d
- MD5 2bdc4677ca57ef6e0338e7097f94ec64
- SHA1 1f0771d370c4e82e56ea61d48edadcb070431710
- SHA512 ac020805bc26c3d77d12bc85cfe1a460f903928fe3ecf5367bc2671e825b5ae7585b4e46d7968c0a02bb639f2bec63a6e2ee9cb222e22b4922dbbcda924367b1
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmm9Q:A3kMr56ro56rQ
- TLSH T193154917A2984FA8D12F8174C9924A62E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 891KB
- SHA256 c65171ba193a00c1dd97a47d7b24af59667083e17e1a0bbdd97d0865e9e36055
- MD5 0a355dd9017c3bb9695870c33767fc15
- SHA1 20689ceb55bdafce781acc6b7d960cc5d2730bb7
- SHA512 8bc2304d82ae97d2e1c6874d81240288f58329a4b080e0cf0ff0d951b8fc1baa4424b45464673cf32d8519a45d2c94afaac758b01cf06dd2dccb8a3a800de67a
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmD4:A3kMr56ro56rL
- TLSH T15C154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 891KB
- SHA256 49a7a36d19a2a5edfc2814d020374f9eacb952526cbc5ac92e179d276688c244
- MD5 860b9d0e303ac921b5da8d9c2adfd11a
- SHA1 4aee5cb852a655b2393072ff7015b794d87cf025
- SHA512 f1a16f4d1150a695665a5cd99d6116b734347232b2a654cf691f1d6fa6fb14519ed393660c744da1ae924a008732419969a58b85cdb80e1b383477d3fdcc47f5
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmqu:A3kMr56ro56r+
- TLSH T164154917A6984FA8D12F8174C9924A62E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 891KB
- SHA256 5f1f955c818d071b453415f8b7c12f00661ca32bf5942e4352b8c7503d08f76c
- MD5 d6588ee914366a5f76631e3aae1faf63
- SHA1 6ff811509706b2e9877826c4ff88952a45ca7762
- SHA512 2368d9edda66eec2e2be4306256cdb433007c8d4362d78fe76f5cb5a39581cb3ec67b6a2c8f09bcb8e7f51b16791bad26d1cde01f0645cad12f4198e556768bc
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm7j:A3kMr56ro56rw
- TLSH T16D154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 891KB
- SHA256 2b9f031a24835244646dd2a82306be112e3f8ab0e915a33a7d6e4db5aec721de
- MD5 a2c611c309e92d76a067f0a0f89a4c21
- SHA1 830effa845fa9195fd39e47d0de0606837742592
- SHA512 89b10e8859a68453f3183dc31b8bc7e9e5a988404359b999d6e40bbcf0f76dde14d3699194ebd4b3ff3ee3a7387bec63ce3575f8fc07dc81fd1b76842deb0fc8
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmGg:A3kMr56ro56rI
- TLSH T14E154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 891KB
- SHA256 97acf0e59daf3d1dbe0b23aa4a7c2ed7b6ced141fe221c8ce7a09aa82e8600ed
- MD5 6046fcf5f2f9f4888c40f524a03c0ebd
- SHA1 2e517b021328ac66169347aee9d4fb06302ece59
- SHA512 c8a3bf57519d510973ddd81ff495c568d6cd2c3de8b725f92e3d23fabfb6afa79504dce7f32ee3c37c4d5e3ec3476c73c6345bdb205e4f759ca532f9f0577ce0
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmpI:A3kMr56ro56r5
- TLSH T12A154917A2984FA8D12F8174C9924A62E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 891KB
- SHA256 ba376c5ed38ed32feebf22f09bc841dba2e205fe18fd0324cc2096fd618b1b67
- MD5 0103a091f9bbae7014aa60e51a55f5db
- SHA1 e22a57f3e2be1ff87f6a966494517bfbdd9b38a3
- SHA512 d39c4b98fd8776e1bd95e9d5c9d0c0f1febc4bead64248e4ddb4c49ef743a81ef13845eac70b4b9faaeec5cd3a38974a43d2a93dc78e6da5fdde8d7294ed520a
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmLo:A3kMr56ro56rn
- TLSH T159154917A2984FA8D12F8178C9924662E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 891KB
- SHA256 04e2fd759c55c9ceed47f8812fa5d20073fa7eb858f008b5f45a1e96459ea93a
- MD5 0335a0f20d53807423ffdc1001301570
- SHA1 50223e9992422da786b612d0628bffd2ef8178c3
- SHA512 5fe7f00fd7d45eeb8b46cf7d8ba71aeecf2d3750eb7bcc19f69481bba3637ec0c30e0bd31357ef7228c2506cec82f4e4c2d6ad856915807cca6031909ef79edb
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmw+:A3kMr56ro56rS
- TLSH T1B7154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 891KB
- SHA256 9f7c9567ace6407ddfdadff71b9d1300646ffc4d3dc85578babe7571d4c8b986
- MD5 909e3dc031cd6c559f4eaf3733d454dd
- SHA1 3c6268cdeaccbb11efcfc7785f6f4d14f366671d
- SHA512 e6fd71d11194c7eb5e546c08a4aeb5edda97865ac6fa58c7436ead2a848e86af2bd2af87d956636183474dd3ffff2cdd98727b5e78b2b4cfb957e821041fdfb4
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmIQ:A3kMr56ro56rG
- TLSH T186154917A2984FA8D12F8174C9924A66E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 891KB
- SHA256 8f7290af7249b7d79cf1013cfe48425af8c82dc9c86e7335527c7e3c6ee5f7d3
- MD5 b1eeb05befa2bbc8b9b22da2cdc3fff3
- SHA1 5e8a3bf7e745baa5d16d2488854f4beef4109c22
- SHA512 f8b231989c77c69393a8ed7a6a9cc2cb4159880f1c92bcb8f30a3b67c51e359b3f57aae874d64959ef678bd052d3df1d8db4b577853d0ee07608cc7ae61ec848
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmBX:A3kMr56ro56rm
- TLSH T1C2154917A6984FA8D12F8178C9924962E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 891KB
- SHA256 acfd1dd5cc6998f7859fa62daa6bffe18615a12d06411b7e0107e318f5943c47
- MD5 512eec82ef1da798d5db540ed14d2c4d
- SHA1 87837bb68723010b0264c32e42b902cc4629df58
- SHA512 30ebc04a8f5c7df6492bcc6e14590e04629cef029410d02d3c22575ee7caec70e258c79567a45d5a827530cdf2de8cc0e199a22116ec10e08b06699491b91cc5
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrm7L:A3kMr56ro56ro
- TLSH T1EF154917A6984FA8D12F8178C9924662E7737C125F2087DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 891KB
- SHA256 069f239bd4a8fc1351d7b4d95faa79fb3c5e474f78db2064f1866c37e9f17091
- MD5 318c97060b89a602d5eeab15b245d0a4
- SHA1 0217173e750ce94b5f992da94cee64f99e9c88d0
- SHA512 793c54140d3bb4c9e7a1029f6c31443d552ca23233d737f2245e21e89b760d32d9118b00a7fb0617eb1fe118382a503bee97e6f9214a0a84d0c02c2091b37cf3
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmBM:A3kMr56ro56rp
- TLSH T15F154917A2984FA8D12F8178C9924562E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 891KB
- SHA256 7189df7e0a3abf736336315bc719dbf5671158c61b1fd87e4f798b0facdd1c0f
- MD5 a4598d495785dd2a22f74c4da046130f
- SHA1 e90488bf936c2e510a2f16912331ad4862ad9d48
- SHA512 86ec74002d7142559da350d8978e4723107debb609f3152a37e838c57f69180b5344b8449a8fc900d7f2f6a76f4b23c1467ee2a352a34fce612e0184db6d3125
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5Tvinrmqh:A3kMr56ro56rb
- TLSH T17C154917A2984FA8D12F8174C9924A62E7737C125F2097DF1354BE263F326D0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1012KB
- SHA256 e4316cc6670e32f2194006e05f7398588f5270be8c12d35ed2d0cdc10f8635dd
- MD5 777498402d694fad5da6695d8685e4b9
- SHA1 e9928505cdc4f49706fbea311672e7180ef5d238
- SHA512 dea9da57c7cbcc9072174e904048f3d055d4ff38445e83f9ae42dc408bcc8e5b8321fd6e6f235e04bcf0f1cc053da7c2b86caca093aef0461a70a6801cd2f8dc
- SSDEEP 24576:A3mnXoZjzyaTfjnD5TvinrmygD5TvinrmrD:A3kMr56ro56rU
- TLSH T1AC25D316E2980FA8D12F8174CB914562F6737C125FE097CB12D0EE3D3F366906AEA653
- MD5 SHA1 SHA512 SSDEEP TLSH