Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/07/2026, 19:43
Behavioral task
behavioral1
Sample
2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 909KB
- Sample260706-ye8kmsgv5n
- SHA256 9861f6bcd308e7423e81c6748c9a315ef138eced7e8e81bdd6b84d89b6f99b4f
- MD5 e2d4e7b9010b9a194c2b31673434b869
- SHA1 ceb85ed24094b4fc1f2db04d6b3bb4036939fab0
- SHA512 e22b3bf4a1d78e6cdd58124a336682f5f23a69fda85994908b21c913470f481faf539f48a00e51abc514c3f1b7ecd256f608c9277b7de771d1c1b3bd8f460023
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYf:A3k03kB56ry
- TLSH T114157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 50 IoCs
resource yara_rule behavioral1/memory/3200-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024556-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3848-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3200-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3848-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b6c-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215f1-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020281-202.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020288-257.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002028e-319.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020292-459.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020299-496.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020297-533.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002029d-606.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a3-631.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a5-722.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a7-742.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a9-792.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ab-799.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ad-848.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202af-873.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b4-892.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b6-899.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-907.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202bc-927.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202be-940.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c0-959.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c2-1008.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c4-1051.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002455d-1070.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202c6-1107.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c8-1145.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cd-1159.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020307-1184.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020309-1191.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-1228.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030f-1331.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002030d-1350.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00120000000203ea-1369.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000203eb-1383.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-1391.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1404.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1405.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126b-1406.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126f-1407.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-1408.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001500000001da6c-1533.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6df-1731.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001600000000071d-2147.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024556-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022b6c-42.dat aspack_v212_v242 behavioral1/files/0x00020000000215f1-61.dat aspack_v212_v242 behavioral1/files/0x0004000000020281-202.dat aspack_v212_v242 behavioral1/files/0x0003000000020288-257.dat aspack_v212_v242 behavioral1/files/0x000300000002028e-319.dat aspack_v212_v242 behavioral1/files/0x0003000000020292-459.dat aspack_v212_v242 behavioral1/files/0x0003000000020299-496.dat aspack_v212_v242 behavioral1/files/0x0004000000020297-533.dat aspack_v212_v242 behavioral1/files/0x000400000002029d-606.dat aspack_v212_v242 behavioral1/files/0x00030000000202a3-631.dat aspack_v212_v242 behavioral1/files/0x00030000000202a5-722.dat aspack_v212_v242 behavioral1/files/0x00030000000202a7-742.dat aspack_v212_v242 behavioral1/files/0x00030000000202a9-792.dat aspack_v212_v242 behavioral1/files/0x00030000000202ab-799.dat aspack_v212_v242 behavioral1/files/0x00030000000202ad-848.dat aspack_v212_v242 behavioral1/files/0x00030000000202af-873.dat aspack_v212_v242 behavioral1/files/0x00030000000202b4-892.dat aspack_v212_v242 behavioral1/files/0x00030000000202b6-899.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-907.dat aspack_v212_v242 behavioral1/files/0x00030000000202bc-927.dat aspack_v212_v242 behavioral1/files/0x00030000000202be-940.dat aspack_v212_v242 behavioral1/files/0x00030000000202c0-959.dat aspack_v212_v242 behavioral1/files/0x00030000000202c2-1008.dat aspack_v212_v242 behavioral1/files/0x00030000000202c4-1051.dat aspack_v212_v242 behavioral1/files/0x000700000002455d-1070.dat aspack_v212_v242 behavioral1/files/0x00040000000202c6-1107.dat aspack_v212_v242 behavioral1/files/0x00030000000202c8-1145.dat aspack_v212_v242 behavioral1/files/0x00030000000202cd-1159.dat aspack_v212_v242 behavioral1/files/0x0003000000020307-1184.dat aspack_v212_v242 behavioral1/files/0x0003000000020309-1191.dat aspack_v212_v242 behavioral1/files/0x000300000002030b-1228.dat aspack_v212_v242 behavioral1/files/0x000300000002030f-1331.dat aspack_v212_v242 behavioral1/files/0x000400000002030d-1350.dat aspack_v212_v242 behavioral1/files/0x00120000000203ea-1369.dat aspack_v212_v242 behavioral1/files/0x00040000000203eb-1383.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-1391.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-1404.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-1405.dat aspack_v212_v242 behavioral1/files/0x000200000002126b-1406.dat aspack_v212_v242 behavioral1/files/0x000200000002126f-1407.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-1408.dat aspack_v212_v242 behavioral1/files/0x001500000001da6c-1533.dat aspack_v212_v242 behavioral1/files/0x000300000001e6df-1731.dat aspack_v212_v242 behavioral1/files/0x001600000000071d-2147.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3848 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3200 2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe 3848 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_e2d4e7b9010b9a194c2b31673434b869_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3200
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3848
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 909KB
- SHA256 9861f6bcd308e7423e81c6748c9a315ef138eced7e8e81bdd6b84d89b6f99b4f
- MD5 e2d4e7b9010b9a194c2b31673434b869
- SHA1 ceb85ed24094b4fc1f2db04d6b3bb4036939fab0
- SHA512 e22b3bf4a1d78e6cdd58124a336682f5f23a69fda85994908b21c913470f481faf539f48a00e51abc514c3f1b7ecd256f608c9277b7de771d1c1b3bd8f460023
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYf:A3k03kB56ry
- TLSH T114157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 962KB
- SHA256 139f3135170f9b27b7f33c9acaa6acba104aa9fa4ea6521bd3446f3727c289e6
- MD5 765e34b95ecf0a18508949861fd300dd
- SHA1 9aae32759f170cf296c9c9c19e8d5ef0a3973a21
- SHA512 bbc42c70ad8fac79eed2b2b7e9b8097dade4fa7a8337d9950d6b5fea2b636bb89d50eb30e31952c76001d81b5c69d85ddab1a8bfd69546eda179fe4ae5ea3083
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYmfj:A3k03kB56r1j
- TLSH T15A257B13E6850FA5D00F81749A958672EA777C125F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
- Size 1.0MB
- SHA256 00edaa7a713634077cffaf261b4f20531cdc26a254eaeeb002965ba95f89aa28
- MD5 25799ad43ec0aa0c69f020b440eb892f
- SHA1 54364767a3dd09ba5b048e50bebf05b74aa5fdd6
- SHA512 1359500fe93452cae4fa9025780e6a557f283ec3ec4429dc4ef157b197f2e1f5016c6c309a1423fc8ba6673bd0b3cc0d3d73a2e754477539402cdd5e1c00a58f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYGGen:A3k03kB56rkI
- TLSH T192256A07A6940FE8D10F81749A958662EB777C121F2093DF1358AE153F72BC06F3A6A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 e3fff12fb0c03309e1a14e74529d604699a4f5e8c92eb0499a654db0e73ccfa6
- MD5 1fdb2c75770e58636f86b1c6ba95446b
- SHA1 03c82eef46863f19442054d3cf264fa699c2f22b
- SHA512 c663961fd84e9cf83b18509ded41eb134147b4b999e3593924585a6bfe58b9cad25aed1c590b9e86e14d1fe1348a090014e7b2f6e6f441fe925be896ea622f63
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYL0Le5ji0hmxNrM:A3k03kB56ryPji0Aj
- TLSH T13E655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 924KB
- SHA256 c873360c01d434c339006126afd2c7bbcd6a3ede11637832964c6d0d97e56b12
- MD5 b52cacb9951e9b388b7b68ebd13991a0
- SHA1 fc76b9d6b29b35ded062ea13a01be2ef2b9c5ac3
- SHA512 f060b05531f0aa2ce790a056f096987146fac7b5a192a24aece76d580e50cc291cbc811e38fbc4b0eda8c7113a1014e8b9a6617d247eb7046d0da912572591e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYNa:A3k03kB56r
- TLSH T1F9157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 957KB
- SHA256 14f0b5331d9ef50adcfeb9653f41570d769d3a23d4236059d357a9ac2158829a
- MD5 5574666baef30842dec73422747f9f3b
- SHA1 a94986c5521bf5d66f95f066516f7f1eb0b3dda8
- SHA512 95596b281c00d38fce802d9d2f1f82b88238bb423f98dc45c5bfff918600a1cd64b5d8662b3a47a2d0655c564b739bfc3884522b5b33e34621005f32d1eeaab6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYub:A3k03kB56rXb
- TLSH T1B0257C03E6940FA5D00FC1749A958662EA777C466F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 933KB
- SHA256 64833c09b9825d3bd7e87b321c93a1714fb0b58ed4be9df03d8f81b702920eee
- MD5 4145138b233f4cb038fa46c2ab1011b6
- SHA1 02f69b0ff7b2d4c1e4456e7de8297ec6f28a133b
- SHA512 57bf74156da176124ce15144de74203bb354b248d45a26d05847f7ba0acfd092f30512676fb8fae54773665030b8fa307e90016b816b015db6a87cb7b43e6d3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYtZ:A3k03kB56rA
- TLSH T142157B03E6850FA5D00FC1749A958662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 933KB
- SHA256 a6879dd72b39e2e16f05e1a393a86c48e037648f69a6c763332bd2c1c66e848e
- MD5 e6ef3fae5c522e4e68b4b06e6e8d153f
- SHA1 4be4d8237968397674299794dc804b330e3129f1
- SHA512 65581939c2f8eef66b9f6ef1ced384982b0c166cee3413cbd95073ad109bcaf6d6cc1a4bbe18151e77ecac1aae347645324e00d5cda1e59038ab181bd4e42ad7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYW1:A3k03kB56rX
- TLSH T184157B03E6850FA5D00FC1749A958662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 933KB
- SHA256 9e963f4f369503cdceb0cc0943f8a868d318da135604b1303b58cb8b633b4f5d
- MD5 752752d16db37336b135bfcd2362c48d
- SHA1 2f004a01d4f72827397f61e0ec62ce071a26607c
- SHA512 c6bfc48c2ed1bbeb4b638647198dc48cd971b66abdcd854d19391035a639ee32c9f37789d1b9834e360acb146e1b3e3f5d655b3587675a275f54c46b9162d594
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYE6:A3k03kB56rc
- TLSH T1ED157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 933KB
- SHA256 7d5ad64a9fa2a17ab28498459f1bf1f8ce8607f1abf396f869a463ce850c4faf
- MD5 deed19e2d86e5facc837fb128c70e21d
- SHA1 1a0cf85f50ff7800512abb57123782247d054fb8
- SHA512 aa3e304ddd69c7a168937000da3affb9db00478c1d75f3af25975bef2aa797d4974e9d1d2a6895f1f7cf08518a61e671d22a47eb5aa25cf6466272be90d624d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYgN:A3k03kB56rB
- TLSH T105157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 933KB
- SHA256 8928153c7cd4af0e58f672faa3a1aa0348264c2081ba96e6b1a8911d9acb10a0
- MD5 3afa6fa8b7ae2cc9f88cef51a86e9aaa
- SHA1 8ab4107fcc631a6329dd6be268764c1bafde6fd5
- SHA512 4b282564e0654af077c25b44e8d07c3d237dab2862e064c673587b427d2e85be22de3e34ae74ac91d7dda04577effdc24572ea3fb43e69ae69cb954ba2ef383f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYOf:A3k03kB56rh
- TLSH T1ED157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 933KB
- SHA256 f918020e03da0f3c65b6f8cee025bf9aae0c40ff028ff85c9e8db1a33598bc0f
- MD5 7c1d8df3d0beba775bb32351d00bd07b
- SHA1 63238fe8092f29d7bdcf801cb93cc67fe032cf14
- SHA512 56ba5e96ef83ba21e1ba245aa426692d4d773d0c748a50fb4ae2e1d420d706223c5293874b18e1c49aa8b199bbb577fd3c8688014f9b98865f1e1a5706c5ca4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFY4o:A3k03kB56r0
- TLSH T134157B13E6850FA4D00FC1749A958662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 933KB
- SHA256 8bdb71f25928887864fedcca833a4ec8a68fb00608fc4b03342bd6016788bf4c
- MD5 85b0fc650cd2d327eed57cefadeab71c
- SHA1 be477e10bc851790c0f3b9e876fc13a45edbe69a
- SHA512 870f273755da517a8d390b900ee3c5c6cbf0d4bcba90027eb4512725b2766d637312dc3baa6e3ada466f105024bc5e4d78a7a532f21f616d35304677f24b3942
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYIu:A3k03kB56rG
- TLSH T135157B03E6850FA4D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 933KB
- SHA256 784f56b5cf5ff8fc64557c0b8594fb793ce0197d04fd8f044fff0dbcaf7420b6
- MD5 e38b0ba41389097315a8062119183af1
- SHA1 277178d6450c2f056e648b71e12001ed6ea4386c
- SHA512 03090bf122427d15a6e192515295ecfb1654ebad5897934a72ae8f51190e843c1defa650ea80ee20ffe1cb10f77177d1f0bae67d553b6319c0ccd56ac07648ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYc9:A3k03kB56rH
- TLSH T1EA157B03E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 933KB
- SHA256 f4147419350d6877e0b0cbd85be71c513e271fc23c0df019481a01338cab26a5
- MD5 190185bdd14175cbfbc4a72477dfbedc
- SHA1 7b492b8f24e2edd4999fcf27033c19c86d8455e6
- SHA512 d61479ee608af84826c6fcd337b14584e139d4d3a79ea31b1fc776e6db954ac4fbe799366d11a308d4f35b354b59ea5c0502668728f86143c8cf1553f50690f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYEc:A3k03kB56rW
- TLSH T1BB157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 933KB
- SHA256 d04ee8f7862414f5bc77c7771086d6247295fb3ae5ac313447d433a8e1291efd
- MD5 5ec9771ea64840ee3e39fa9d25bc7d86
- SHA1 4d6da824fc77bb578e3ef96ff6f874bd01378fe2
- SHA512 cd1d36d222c812ef2759c0ed295d860be3ea5184cdd54adc7dd5b84b9cf38bb63d81c0a574fb22f8bf28e0ae1bc638a82de6370c98acc686e4bf5e162432ac36
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYdp:A3k03kB56rE
- TLSH T199157B03E6850FA4D00FC1749A964662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 933KB
- SHA256 1bbaa17abea1e6f788c49ac83b9b20eb2d5a481f96520121bcae5bc4367ea2db
- MD5 68f8571f1db9dbcece994d20b45b76a5
- SHA1 73c2ab0baa8a651f136bfbf102bfcc07582ad59b
- SHA512 072ed37bedcee0b3f7a0d69b9695a28983647d4082fc4f82dca69d8a13fede2b585812cf6db28053e5759e76dbeb7424ab8b7b0df7ee3b863b65847851e4ceeb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYiN:A3k03kB56rz
- TLSH T177157B13E6850FA4D00FC1749A958662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 933KB
- SHA256 9891cbccbb0b64a3541cf18e51ad2b174cf74d92340f10817d1fd70ceb4758fb
- MD5 b0282877512bcc47144dac6908d05d7d
- SHA1 af44071c270f7272b52eb726cdafb435c04e87bd
- SHA512 3be918c7c167f4f69c5c870f4519259e7d721b96df485bdb71efa964e8ce8e613ca59d08c342c18b0cf1c67511708ff38c375f32e928cc0ebaedeab0843a52a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYGF:A3k03kB56rF
- TLSH T1A7157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 933KB
- SHA256 3da48ac824eb638a11265f827e21f65c3f708d45ed78f286d005cc719003c3c4
- MD5 566b8af1abd87225db7e5f23363e1a07
- SHA1 11ba3588130052e4f9071e493741f34129875b4f
- SHA512 26e81213b94bdda937fe044693bf0643a41909273fc82e506c551e49f5571929dca09c36ae88c7c3a2d81effaf6d6d1a3e84530a49455e7d4b13b360aa378cae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYTC:A3k03kB56rp
- TLSH T119157B13E6850FA4D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 933KB
- SHA256 3ae2e4342e9412daa05e5739c7df6aac7020c16480189916adabf5171fae2037
- MD5 f8b20762101688d0562bf111fb0603d5
- SHA1 91e6075628bf6c55cd0c55aced24dfa51d301796
- SHA512 517cda97159454a205c8255cb0a4e23737e1ce5aacc281fed3272261b9e4e5cf8832b6846bc2bdd4ef46bd5a4ac1d7f1da7b8289e2b015ab2564a0e13a2ffbfe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYcw:A3k03kB56rU
- TLSH T139157B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 933KB
- SHA256 2d91008640cdbe1d5c174dc8578e80e5933f7fe0a97053000069c9e912c595c8
- MD5 502767bff3b5700f7b495ca96a40b3a0
- SHA1 48c7cdd870d1395bd6e79fc45c3b393d06f19988
- SHA512 6489235a3e21898ace23df3cc830ab1b2a3777a00f3e61e8a5753ca3b5024771a119e4a92a368cbb6d321487296b6d4cc2e18c136f378a6fe21c9e2ff9b302bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYTT:A3k03kB56r8
- TLSH T161157B13E6850FA4D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 933KB
- SHA256 abcf36a535e56adcdccbe3942389cdcf0eb535bbd0f8f3ed523fe21eda336c79
- MD5 cb730e86036fef45ab75691d076d121b
- SHA1 924201c7f87044f965f616fbafc63c3fe7fe73a4
- SHA512 7d2f5a6fcbbe32a8504fe39fec6094fdf6016e414bf1717a80e23624e8701f6bf988c751964a6ac4e36d224826cc5cd938ca37a949d3fd7ba42007f71a95cf64
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYlu:A3k03kB56rb
- TLSH T18F157B03E6850FA4D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 933KB
- SHA256 bd5a8709783c6704b20fa8fc4db5473af3653b73efb7088476335a202753d952
- MD5 8c81d560a919511b7b7c256b9ea23210
- SHA1 7bbff733744e4028570cbc1a7bf207c2f449ba2f
- SHA512 e3d4e2321e266aaef5c044c0c475bef5a75fb8405dd78187543920d75f29eb5d57302dd59b7b1bd2700786f2064e81ebdf83f0e0f6c32af2e44a8e13ba8528d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYtb:A3k03kB56ry
- TLSH T127157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 933KB
- SHA256 fc070422eeb8c15eeb6e8fa1ef7335e724f4610137258b671f43ac915a2b2d79
- MD5 f9e1726b8c2221f4afa82a157d9bc477
- SHA1 6177985220bdb675fa5d83d78affdad372ffa99f
- SHA512 85f3ff646a08f79abb38ea9c086eac1df4383529e8e0ce193d854bb913745566e171cb85379830a05f1f7e6784e7d785f5b136d2893a5a9986b0cf468f397a44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYdf:A3k03kB56rS
- TLSH T17B157B13E6850FA4D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 933KB
- SHA256 9afb5ff7275a58aeeb2d3f16ee914f8c050ed64bef9ad4a211a570711132ff6f
- MD5 0e0a3fcc8d1d428063c7b7da96da7be3
- SHA1 8bc27ec96220fbc40e8a2c0bc2cc8bbe751c89fc
- SHA512 ba7a443aec3431e54c6c9b53c9be11e20f6cafdfd6982dd0d893ce8003538f2e1a482d88855c2ec57390159b4b9d49aa046d4ccbbb54de30138f75bd0010e5ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYGK:A3k03kB56ry
- TLSH T164157B13E6850FA4D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 933KB
- SHA256 c5a75e9f70da0209d5aa873471115a9536b14c7bdb8fa8857a570c5014ae1968
- MD5 e18d0d394b249035370b7893ce2cc890
- SHA1 17bacd14abc81f94853cb32a5fcd71afcfbdcb40
- SHA512 196e1b4fa685f4e8d72e551d64923e23906944f82beed53da890344b05cb8d1af995f75ffb32523bbecc4e91f3dfd938436587de55d81ebdf6532d8d709e671f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYzk:A3k03kB56rH
- TLSH T142157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 933KB
- SHA256 0cd26d2f35dbd7ff5ca2182ebd2448a4e6d5e6c546d52c934c7d85ab6cbdc46b
- MD5 747d59d8da8a80fbf31b2e8c9f732d2e
- SHA1 8e81bd98ae38276e3bba70131598273f6b086fe2
- SHA512 aeb9140c4aa00bb1f4d3263195de4f638683ac57930dda99bd40f1840beb5ab9bd8cbff0ee665064afe059e056e5f4a4f98f82e97d437fdaf4742a816675acac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYE0:A3k03kB56rG
- TLSH T184157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 933KB
- SHA256 1981019aa16033e23157eed6af35b5ba932e45046d4d680b3774dc7e34a91df9
- MD5 d01a9cc8ff5f5acb4bb91f78b60afda0
- SHA1 6ffb4306595f651991b10b128aee7a1ac9a042db
- SHA512 82a9e95bd2a3b159b456a5aecb3ecf4ad3b730a48fa035a91c383319ef33d7d1fb17cd49c6bb50d046cdc8e9cb05b5e6402813d97c13a97b6a6632d96816da18
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFY/g:A3k03kB56r/
- TLSH T160157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 933KB
- SHA256 2c117f6ef29ea9c92e704b861bd9d6fe626c098b05d6dc65ab65fb5418a2e2da
- MD5 90e2117ef13123b9e31776ef4d893879
- SHA1 39965a67012b2e981335b060ef545cdb0bdbf5f0
- SHA512 80f70c389059743571a5df5b33d1f58d78387c472fee79bd4e058063e0943f02e7f9e45cd0738c5309b49d9782bd46c795519a57614f75b146ee705e70d78ef8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYSr:A3k03kB56rZ
- TLSH T1F2157B03E6850FA5D00FC1749A964662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 933KB
- SHA256 81edd1df5bd19ad3425a554f0ee7d210f0f2aa0724072080182ff308f0c43df7
- MD5 f695d0ac5002fc5ab71f218cde711c1a
- SHA1 bae203f69a7e6ffe32bff12675191fd097bdb869
- SHA512 96441b63c6ea671c2161991e7ce0db458b71fba8b4eda01edfd6ef083e471a77bb849ec291cc0971ee319370ca5b1f1dbd3e24cfbabc38221ef15a6cf7af1dfd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYwn:A3k03kB56rT
- TLSH T19B157B03E6850FA5D00FC1749A958662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 933KB
- SHA256 78f62d757b2691a974c8c9a7786754e3f08114905066b7c352296f94d8174177
- MD5 cc547fa050417d28711ba33fa4d88934
- SHA1 5024b2e376b1e3983f2cc621c312a90c44795ca8
- SHA512 1e25b23a14ffa145b0950adbb17986267f05aef58ec9d9631f4aadb2df45a15a826e68917f585791ab030441db77aa7a4a2b3affbb43f0dc45134249138fa7e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYOx:A3k03kB56rR
- TLSH T16E157B03E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 933KB
- SHA256 7b72e800007abca87c9c7d9a8a467cc03badbc1f59f1edd219972d21eb13ad2f
- MD5 b93c9bffbd1a2a4a2afb43f2e55d3619
- SHA1 3797393e56b8e9a18efff007b872e0881033b77d
- SHA512 c24e35a816f50c771dcc7f323fb8025086bcdbd95a111a6ce2535094479caa412be332b8dd9fd13b26e05d90468553ad9dcabe9922ec5e602e77aabce8250051
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYoA:A3k03kB56r+
- TLSH T141157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 933KB
- SHA256 804fe7e8f3866c77a47123d8eb04e8bc8fcad213ce9be3aa759474801b10e6f8
- MD5 9b0ca9f0d27a2feb8f187239780b9a37
- SHA1 700ac7164643ee37879f72687a925f652cf6b97f
- SHA512 dad0efd2e46ead166172523e2cd285a25650786eb97d58f305cc0ed3d03345516e1f9b0a11c2267b72c06227533a0da81349fb5500158923d03ab244b0d5a24a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYB9Q:A3k03kB56rj
- TLSH T12F157B13E6850FA4D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 933KB
- SHA256 bfddd7266e30b6836544db814df0308034f81001e9220cbc1c2600ebe1863d14
- MD5 08591f8670235ca0e16aab9300ec38bb
- SHA1 2cc1a8fa25a5d509da7a8ea35bc5e053f59f3d28
- SHA512 f268bfbafd8a352e97a054e6ddabe4f735324d137a46cf29eb791d1f4edffd9dc3a5d94f70ffe85ccb53a8bf10f8cf5d5f207b3cb23b0f5f9f2f89ce136a6285
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFY04:A3k03kB56rE
- TLSH T1D5157B03E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 933KB
- SHA256 6bb73b34455cbae755bb174bf5a758d909e6e0f485a54406e6d5a8973fe0d161
- MD5 47b4cf01772f74ca77738bc23cca84fb
- SHA1 0d5cb3cc5d2c00edfee57e62610bb9f07564fd63
- SHA512 4f410866486a9432039e6d0b7e2ca7a66e6c677d67877bc369d1c6fa6ba2ea6048159683443cbecaf39059e38e29f9d770ea3b5e4919641621cfb59facf78e37
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYfu:A3k03kB56r1
- TLSH T1DC157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 933KB
- SHA256 57dfd27895659b2ffd8d8c64dd7cba1711503555b6b7d4eca96e5a02006e1f17
- MD5 90d3551ab313047c5878cbdda9a178da
- SHA1 49f9d7854196db3d3a479493c990d60b892361c4
- SHA512 4a18d3a5c0d8b6ee71658fe4491e29372c0dbdec0d5250dad127706de04ee4ef3332b7b661e6c359e7eafe0dc2ce19449384798581a851684491f82fd871bf24
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFY6j:A3k03kB56rX
- TLSH T112157B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 933KB
- SHA256 e6c735359a8a4f387dd462637e9ffbab36a79270310ed43866d78f36f30e388f
- MD5 0a9da9a0cbf043ed4e6de8cb63e98205
- SHA1 823ede7d8ab8c6ff7d09bd75bf24c9e482b3f327
- SHA512 bd67654f29d0592a820afc778bf6df3bdce411ff9732cecdb62f3005c3a064d9ecdf36eb7bb328b17aef8cfc0934144a42bc85c0db1992c07ebc492dad7b9311
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYng:A3k03kB56r/
- TLSH T16A157B03E6850FA5D00F81749A958662EA777C465F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 933KB
- SHA256 445876088839ee7f4e2d1f6a439189e1ecdf7ae532e19940d2e10e9139863918
- MD5 b4f5ff811d650b62773315c84f64bf99
- SHA1 15a21efdf4500fccd9cba70303029967f09bdbc5
- SHA512 9bc783504a85a5f1a8dfa396182ee902f83f082b65c8c603fe8aa16246f25d782c13462dcaef520503af6a510cfff796aac5330554e770a53c0738cc1d6d4f70
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFY6I:A3k03kB56ru
- TLSH T18B157B03E6850FA5D00FC1749A958662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 933KB
- SHA256 c7b2fca34451e30eac21e5c7e063f63e6efd01cebe02af99a05634072b43164f
- MD5 f3a55df2ed0891fc9111b4c22397462f
- SHA1 4c384df7a3dfe381f525dd5c84943878f6cf0ac8
- SHA512 1f19c19c7e32b1461ea407622ca82e9317d9263e9869781f18125b5238a4daae9db53e641e6af576fd11c532622ae8857854b1d20a1ff9e224db0dac25c81ee3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFY4o:A3k03kB56rs
- TLSH T144157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 933KB
- SHA256 b501529be8e889b454affa8305079cf67cf7de1d9e598cc5a49357439bd8b4cd
- MD5 63159fd938dadc5b25edabfa7a7fdb13
- SHA1 e77b9b19ab1248f80e51e6664ebec11def3a6113
- SHA512 240cb1167884091fa553be002c4cc04f1e898e1a9331169f7ac56c04750d53f6f3e12faf7a35914dff7b5e9858d4216aed65c48800b18dfe03cc2cc5926cd8db
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYL+:A3k03kB56rB
- TLSH T1CD157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 933KB
- SHA256 51db0aaa39bf64855340dc7e3aef5debbfdf650b770b4a3479710a2eb0b037da
- MD5 2a3e3cc6df910546a4c44ab67fad78a9
- SHA1 3ad3135c50627767f360143e20898c69bf34b411
- SHA512 0b9df59c42a2add248601db6e438e2a173c8c663f2105126e8b435f1f329f62732eafc0eec4e504a41f58d3a7b8ee8211ad227541f7c00285e3bc862f7d17ef0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYBQ:A3k03kB56rB
- TLSH T192157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 933KB
- SHA256 e25525c60582dda101e2663d645000da43151e7b286fb8dc5aceb9c7c6696486
- MD5 513ab03710e8f3395e6d428f2df3d31b
- SHA1 1b27183e7a551e8a15f27e45d2f3ee61243bbc57
- SHA512 b391b0937fcc69b1655527ff298efac44c5c55b519a65c9bc91ebde35c0d0a44edee992e6c101a13aa511aa52b6c459b46de7a035199858c3a5c45743f48e300
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYGX:A3k03kB56rt
- TLSH T1FC157B03E6850FA5D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 933KB
- SHA256 e94e74a822856c9d36af76c6efafe1fb5f566e87f44127b0e19dc4bdbfec7dc5
- MD5 75323c7c79f8b7fcf8978d6100fc9121
- SHA1 b487106e0534bebc7251430fa2cd61ed7ba717e8
- SHA512 04a1eb98538af2988ddc10de563f58021921188bd893e804b5a5c318616027749ffb7d5b0e0409707fd94f7b79cac68a59ea06b7e066279fe32da48903a01597
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYAL:A3k03kB56rv
- TLSH T14E157B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 933KB
- SHA256 4de277c86f1aee41c34bf9364a1f5105716a6fe5a4a5bd9e4b7b3a67498932be
- MD5 11ab8e87f0b7f6e779a1d7cf2df628d1
- SHA1 e2d61633cc23b04fa8a379b0ae3716bf7243821e
- SHA512 4c4bc065722d1eb49de0254f56d9e5c643a8436783d905b52e3d47dbdc7f1b13d74995b5d88edcfed7ae984dae143195cf92525c619ed635aea846c01fce33c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYsM:A3k03kB56ra
- TLSH T132157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 933KB
- SHA256 df6d47a23aa7b6c680826cb03b7b5758e09f0962ddbe71d3296cebb11d4c83fe
- MD5 21c1c891cabe064087a23b75af7af1c0
- SHA1 79d820b12e7639dca26f145e2347b03731edbe72
- SHA512 af3a6e23aaa4ead6f78869976b5bf31a4d0db388190026e48513387fe09f202fbd7d53ed3a63c44862a773581935ddc5cffc5705d15423532df323de9455bde3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFY1h:A3k03kB56rU
- TLSH T1B1157B13E6850FA5D00FC1749A964662EA777C425F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 914KB
- SHA256 82471c9e47512ec46b693f1a870943ee3a2876cfe9bd913ab471c6bd5d9c6560
- MD5 b0ce5204c1cc7d999f33537739021557
- SHA1 019505e7c09fcf1d74eca2c8bdb4d6efc6a77894
- SHA512 e3a89ce30a914ced41180fed3b8d2629e0371f5d0c0f2747be7958310a0ac0cdb41523841c7d4073438a8a5a3dea306380863cf0703c0b5d6a425359b15d24d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFYcBl:A3k03kB56r
- TLSH T107157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH