Analysis
- max time kernel
109s - max time network
98s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 20:38
Behavioral task
behavioral1
Sample
2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 928KB
- Sample260708-ze7tsagy2k
- SHA256 0d6e61591f768598d11bc262528992b47888b91edef83d3e8651d0a95c168f54
- MD5 4f12c8daa5d166a3abf688ee26bdda71
- SHA1 4670af9794c6c2597f2d92cdbc2cebb0d931b3de
- SHA512 de246b3103386d536423504f1b5fb987078045751f1273544fd9a758c8f1ff015c45a9e9c9f6fa4b08dc457df63c396c115b7f66ac3a4b270210b7795cfec723
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZC:A3k03kHRJi56rf
- TLSH T1EE155A17A6890FA8C11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/2652-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c566-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c567-10.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2652-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1384-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c2-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c83-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018976-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018974-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a53-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019840-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a52-505.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-591.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-751.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-832.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-992.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1029.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1104.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001890b-1495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018911-1538.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00070000000066a9-1866.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c566-6.dat aspack_v212_v242 behavioral2/files/0x000d00000001c567-10.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c2-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c83-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018976-204.dat aspack_v212_v242 behavioral2/files/0x0005000000018974-211.dat aspack_v212_v242 behavioral2/files/0x0005000000018a53-230.dat aspack_v212_v242 behavioral2/files/0x0004000000019840-267.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-394.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-480.dat aspack_v212_v242 behavioral2/files/0x0013000000018a52-505.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-591.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-647.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-751.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-832.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-863.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-942.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-961.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-992.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1029.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1060.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1091.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1104.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1141.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1160.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1193.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1225.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1328.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1341.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1354.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1379.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1386.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1387.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1394.dat aspack_v212_v242 behavioral2/files/0x000800000001890b-1495.dat aspack_v212_v242 behavioral2/files/0x0008000000018911-1538.dat aspack_v212_v242 behavioral2/files/0x00070000000066a9-1866.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1384 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2652 2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe 1384 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_4f12c8daa5d166a3abf688ee26bdda71_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2652
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 928KB
- SHA256 0d6e61591f768598d11bc262528992b47888b91edef83d3e8651d0a95c168f54
- MD5 4f12c8daa5d166a3abf688ee26bdda71
- SHA1 4670af9794c6c2597f2d92cdbc2cebb0d931b3de
- SHA512 de246b3103386d536423504f1b5fb987078045751f1273544fd9a758c8f1ff015c45a9e9c9f6fa4b08dc457df63c396c115b7f66ac3a4b270210b7795cfec723
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZC:A3k03kHRJi56rf
- TLSH T1EE155A17A6890FA8C11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 957KB
- SHA256 fd1513102e75a88ea6665bb5b6678b6fa82cf0ea9422fedcbd0c221d825cdde9
- MD5 5b57e15dcc67f8d8a0344cae4b444c94
- SHA1 e1837c70481a76e7e3d9d04e95ecd7b1bca71fec
- SHA512 2be58ee53288d523619e7043c6865b177e3645ce9fadf2c5716f278deaaa276bd8b803c40a317e2d8062a781a0e601717c799bdf3b64e93e3287664b6224747e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZUP:A3k03kHRJi56r5
- TLSH T1F9256A07A6890FA8D11FC1748A968662E7777C121F2093DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 974KB
- SHA256 e849383c57693f88792d2c997328ef92edb7bf4cd3dadf50c7a63f3b51d1d687
- MD5 728fdfb694c7a0ff157cac4f28833c8d
- SHA1 3f0fa7753f8f396b78afc292490365ded86b1fe6
- SHA512 a107b568aa7ce0364560314a1f86f998e5eccf1fb03ec879717b45e0e953e23f6819bc780d21c3e02392f0e917e69e656c20dcd3b965c45716da414e8c07c4a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZz0:A3k03kHRJi56r20
- TLSH T19D256A07A6990FA8C11FC1748A968A62E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$
- Size 1.1MB
- SHA256 a774aec3f979cc36e1308273ee9f1b742903aa17f83c9f8abbbed4e6b69245f1
- MD5 d0d5889f3073932159143e2c6b114a4a
- SHA1 d5a2e3e0e76f0fc9782b925fb7949247acdd7405
- SHA512 e4892f2da4264fa148317a5730f461486acbc4a0bd7d9acaac21d4f62f7f26474ee78ce73418d1d0e23956e2a2f7ed5166d3ce4bec0ab4c3c017bd4f7d9af62b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ+g:A3k03kHRJi56rk
- TLSH T1E9356A17A6980FE5C05FC1748A958A22F737BC615F208BDB13509E193F32BD06E3A667
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.4MB
- SHA256 f3706cc54c5d9ce757f91e64e2306cd7d99e72aeaeb63952accb85cab3f8458f
- MD5 c04ac71a3aece1c95bc46233ef19af35
- SHA1 4a4f409a976e9eb04a9103262a9df386a8eb4a51
- SHA512 cccb7ded022901dd953f211c64824f58f72520164249cf46bb7e3856de9d39ecfeb7bb8a90ceabaea7578824c6f1835f282c224f6bb713aaf9b12453792a7f40
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZC0Le5ji0hmxNrM:A3k03kHRJi56rLPji0Aj
- TLSH T127655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 942KB
- SHA256 5752c9c212b7ec93a8585d08543df687a8038533ee53268579b35ab58febfb39
- MD5 0c865d61631ff0e58cfc45c4624e6faa
- SHA1 46c67d538881ae5a7c43988eb0a3f3b5b95f1a65
- SHA512 06060bc9aa93503c1159ee40bde2ad611227ea36a72ff355dc0a39fb37bf189c38b65c664706772d84c17dd1e9cb4a38730c69cf3b29459051e910185ff1304b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZMa:A3k03kHRJi56r
- TLSH T1D8255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 976KB
- SHA256 16a6b85e37d8fe824eb13eef4634b0c4e6e0466cf0ab893151223dbc3feed32d
- MD5 afb05988e645666738c171ed9ccb02e4
- SHA1 7daa648d46deb390ee0e08cf5d892a9d5949dd0b
- SHA512 5fb0f0fe41fc004632f7b48e12a5410359e5ddd3b66bba3a9a9b95562627ac9f1eaf32a6822eeeb61d899c30fa14b55810abe6d01db5e740fb129e50392f3580
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZnb:A3k03kHRJi56rub
- TLSH T1DA255A03A6980FA8D11F81749A968622EB777C521F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 951KB
- SHA256 a85db47e0ba958b42ede1e9af94fb0a1a7f0945246c8d37119aecb6b17424662
- MD5 b1a1d7854bf9ba12947790dccad10495
- SHA1 502e5744264913bfdc86cca2fe926fb2a455efea
- SHA512 d725dd20afe7ecbee12fdc84329015c442432ce7df3fb6d81cdae08d2b4081e2ab861ff44bc47e99bf721e5509544658dae5a290bbb55fa360170885900c72cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZGZ:A3k03kHRJi56rv
- TLSH T17D255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 951KB
- SHA256 5469f0aff286f495ff12abfa6aedfd5b2da5300a0812dc5c5d11054d7e113b5d
- MD5 9e21352fdfcc62c7c2e6feafbeeabedc
- SHA1 3bd567f366ff398af7d7105950b769d6e2047294
- SHA512 5f955e29a1fe7b3bbd416f7f74c6ff9e47a401a13704f34ac93eadd2a72f8b42b6eae2ca05698809e2b468e9f41788a7bb3c6af78c8ff766560f607a2cf64e59
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZx1:A3k03kHRJi56ro
- TLSH T134255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 951KB
- SHA256 f61814b796c8bacd3574b8f3f037d3a6f79749ecaf92c94c4173466a9bbc72c3
- MD5 288de07f3703d54ac077a68a82a706a1
- SHA1 4e2a057d3568b3964d5490c4eba26c12f85684ad
- SHA512 d7c04a045ca35f1a8999829b7fdbece7e8620254955fd5674cc2a46cae80c81481fd130b76816c74615a0c55e0b5427b8b7d3cc3f131ae838b206cfa248e6ffd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZl6:A3k03kHRJi56rT
- TLSH T199255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 951KB
- SHA256 fdee372f386421c4847908e50b6369d228cd52dbb29b0689b8e97f127a825a98
- MD5 76223d84d67b15fda22fa38eaa54068a
- SHA1 73e676baa7084e5be8e4af6244ba0106dcb7b2ec
- SHA512 f51871477a14b9610b7e49833cf2f85d4093c0081de2fc95e634b35998dd163bcd8e706cfe187180eb709dda76ce9ba86534bd00cb474da938a44674998965c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ7N:A3k03kHRJi56rO
- TLSH T18F255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 951KB
- SHA256 a697102c5d6c6106db307b7fe05a013a7fa593e27f9ea43a0de05bcf219bfe27
- MD5 6250a93ce9a13b1fcb35b93d6a513548
- SHA1 06d7382778279e16990773e1d08f62033697b8aa
- SHA512 e524798a382c1d1bf2024b1313a69c76a0928679b8d4f2fa54785f75ecdf5a8deac23deedc3acf18dc3fbd20f8886c0733a2b676a2c53aefb7f4a3c82c5d6067
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZZf:A3k03kHRJi56rC
- TLSH T1A2255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 951KB
- SHA256 fc7c14c942790f4bf7aaa4b4bec12d767c3474ba454280467097cbcbd1f51dbd
- MD5 4ed83ca6fc412c0ac07b90b77f7ce851
- SHA1 81f35723c3eff917e888c738a243ff055306f407
- SHA512 0f7b7a7dccad6a34f0b1fa227ba5778ae7f9722f26ff724d9b8d464ec1939a781107ac9159ad6e1be910f352eb45abfd302515f5e70fc9b62ded14e2e846d812
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZbo:A3k03kHRJi56rL
- TLSH T19F255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 951KB
- SHA256 aaec3ae324afa3526571bbfc870d4d2c442ea7fb98498a9e484f9e8baa785fe3
- MD5 e37c23978337ee4f909d056864a17337
- SHA1 1aac68f07592ded06c7cb53711b645295e1dd084
- SHA512 9b46afab582ed0047f85ba039c34047400122d7ca5439b7ed211c202bfa3fc6779799167631af99bb25b6a1d013b81c1b2683ba6d12e8a29e856b6d38da94058
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZPu:A3k03kHRJi56rt
- TLSH T196255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 951KB
- SHA256 ef349cc06850efb9dd569c9863789efa2010ac1336e9afd9082d954cabc25943
- MD5 c410f2caf911e03d057b049c0e3293a8
- SHA1 2b60ab1229d75f406a36745738823eeee9a85a32
- SHA512 4cd8bb4b19296eb34e738ceecece5a9ef7b576f3adbcc90ee60bf0d76006aced491bcb06ce0db92af70070944cf6aae1cd3088ce30147069d708068f9aed5bc6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZd9:A3k03kHRJi56rY
- TLSH T1EF255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 951KB
- SHA256 30df30f59eafe358dd4a61851bc8957660ecc050b576b8a02458214af3ca6f24
- MD5 4450c4db4451edf97d5ddcf9f584aecc
- SHA1 773fa16f524457395a2ba7bab8c504ef1dafbcae
- SHA512 a0696ef086dbeb862b6dfdcc3e2ebfb5f10817043bde2b3859ffa5ab7fca84ac73dea31989600c30ccc7b414e9df9afc68a298910461d932e2c53e04879f400e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ5c:A3k03kHRJi56rZ
- TLSH T1A4255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 951KB
- SHA256 bdcaa92d9682b5a6ee2a3298788219537ece5e981eefb6c6614ba1356de47fac
- MD5 ebfd760c163eac19d98480ada50d8396
- SHA1 77dcd946dd8f5f9269171bde449919ad47b26de8
- SHA512 e143c24140a01ae423576bdf0d843ba219d7dd25b215beabbd85ce1b8d1868bbafa699dd7969a2a7a07e4e60edbb0747c26b0012cd22610769e427f1410e982b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZyp:A3k03kHRJi56rX
- TLSH T1ED255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 951KB
- SHA256 9f8fda6f162ee1e045cc2c167e9a151ad0ff904195a39cf94e6eb94325852943
- MD5 f5c34aafa1bcd927bbbe8aba527b230d
- SHA1 f215ef8ddbd4408884609226f0ca34a93241b443
- SHA512 e2786e7ea7ac332fb8a7cf7d4872d36e51e82b3e18affc3430cd1f2c9d6924b1f8431e239621ad78de11735f01175d24c51aa8de0b0361f0907c20a4e47a04c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZFN:A3k03kHRJi56r8
- TLSH T12A255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 951KB
- SHA256 94eb35d7283e8ee01669fb0fe87ee46435bf442e575487cc8d3ee23f57b9f272
- MD5 35dd0a8853d00533245a8aeefae31af9
- SHA1 c62dbf3d77f3adb78f1cfe44f0e60bd975e6143e
- SHA512 298dad26c338ed6bf8282757f2aed9b03d1c3df82748a43eec5ba0f729b09c6c0e768b94db454a746c5623556865646a8d8d8e5c0b6605547b808efdb1e15a50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZXF:A3k03kHRJi56rK
- TLSH T193255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 951KB
- SHA256 897a8e86748d2cbcfa0190081cf0261680023300c6740755c9e177acfe3f57f7
- MD5 a8283ae4a8cbeed61ab8aeb49ff44100
- SHA1 9c9d73ce3231ed80cafc829f9436312632713adf
- SHA512 fea3a65e08bc34edad1a7a91f337f0c7c0819035e4395d24da6c7bf33900599c6d06c7fc288a454f7270a62a5458add26e39ac0c7f295c40cbecbe2ee3d13288
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZoC:A3k03kHRJi56re
- TLSH T147255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 951KB
- SHA256 eb984e6d1566813584be6f4dd24ce449e9ef020ffa3506fb9520cabb3f13decd
- MD5 5758422a94bc0b22d2c94e21e350fe5c
- SHA1 3d01166eae2c245ef8086f78bb34a3534a0af264
- SHA512 9443fa0a9bf4bbea79c6cebff1672cdd00dfdc37372a79980248e82d478e66047f37d496d583b47cdd368c492fa29cc267120c84f34589961cdfbebeb416ac21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ7w:A3k03kHRJi56rr
- TLSH T122255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 951KB
- SHA256 7a740b24a91c520e7f936fad5b1cf26b77444a805a7af77f69d83bc526f93682
- MD5 66ad16ec2afd289bc8cb679cf89a8640
- SHA1 30e7f5c8d3cf84999e5cdef58697f44799856cea
- SHA512 06e85ecb6cda42fc0516d3276f006b005eeaf511cfda0d52c341bd1ad5a32c4591b9e7ad4c26a099bbf9d32dec38a89760112831e54175b20cf76392615a57e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZCT:A3k03kHRJi56rX
- TLSH T15A255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 951KB
- SHA256 7f2ebf712b5bf5d5281f1368d52e9595fb753b2984d633a0a2a49b9d2b3d9f48
- MD5 21f6384dc2d4611759ac5ecda3394708
- SHA1 e744666bb2785a6a63d8ddd4c87363e7fb17c69a
- SHA512 029d5b9b6ff7c8be4fc321906ef185bad8b9121f6bf7eec241d7c14faca1db09835d3ac19a84412a07fddaf10c26c040a2fcdd45cbb404356016d3e8721a6902
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZSu:A3k03kHRJi56rY
- TLSH T1EB255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 951KB
- SHA256 aa7868f9d8f50b488cc47bff1901f497fafaff96f2d3be3fcab998ffb2ac2fbd
- MD5 546da68acaef9046ff6d2d4f9b165eee
- SHA1 d6c592707f28d87d3e85f473c7df0e23b24cc870
- SHA512 85e0498b3f9b06f05e196a612d9fcd15f281586f26332e3cac18898b7022d87b1d77a2fab0ab4218bf91a8b6434cd7f045a26439e78894c424b81bd80b1e6c51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZMb:A3k03kHRJi56rB
- TLSH T1E2255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 951KB
- SHA256 73326dadb5a09c50096f85663b9b99cd14b6110356f7f74af4b8d3dd43885485
- MD5 872ca6fe35206ba5acd0a3361e0737ce
- SHA1 7c9f1b13f094565d45ba44c93938b4723ee5c421
- SHA512 7273546873a29263ab37fcb79951739314c64a2faa2e38f9f8a68991f6c731ed8f8585aa969d05479a550d1248a8284642e9488b044c5cefdfb03e62dadccf7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZyf:A3k03kHRJi56rB
- TLSH T1D8255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 951KB
- SHA256 d658316edad67b716b7df1471b949943c4c3f51bfa6065d111d2170b1342ff9e
- MD5 e96613d043111ee634ef0c6ef9171e1f
- SHA1 25335c45b117542bbcdd87bd23391edb82626b25
- SHA512 376f2352c15ada13cc4bb26c8100d2b9903a77861f9ef3a192130df416ca008842c91e8eaf97006cd1cb66e01b99c4256fa77b577a37311aa5756fd7dd42a234
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZfK:A3k03kHRJi56rZ
- TLSH T120255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 951KB
- SHA256 02235304de30db6f7dd6c0413e434b7cc02aadec56980a491f167d4a34a9d92a
- MD5 8b4297045599c451397bbcf997328d34
- SHA1 159ce2ff143a4f2701c96f539e223ad6c0b387c5
- SHA512 dd71b0692107504ae739dd063f58eec0cb1a4abf721cbdb498f5eb40c1bf2dda0e39efb31079303bac76b25c708e87af7b8ab8e30e00b10220a980558b4a19c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ4k:A3k03kHRJi56rQ
- TLSH T151255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 951KB
- SHA256 aac0bf5c99b04be886fa9f34b3e43a4d6ad7bc7beff15ae5e67ede93f8e4bbe2
- MD5 ff419c8ad8d13b37218a60f105f1e2b4
- SHA1 222c0da8a7dd243053349ccbb3cc45898efc6bae
- SHA512 f414c2b8aa92c0291b4661548d9236abba38f773246e018bae416e62b5f6ee4a2d58a2793bdb5f04315b9fabd9b27cf99195d824dc62c8de5b0a01c6eb73a5df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ50:A3k03kHRJi56r5
- TLSH T19C255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 951KB
- SHA256 5b52c3ac46251e6a96fe5290ffe59847856245b0f486cbf785ad0e0951384edd
- MD5 a4333f71a90515a139465c83f5ad3d79
- SHA1 ca7df2b6b267b0a7cbbf49041cc53e2a3630678b
- SHA512 8d017a2198b7fcfc4d5dedaba8110c058a57a663dfae0dd090d80663e7ae6dbb2226826c2bd853c405dba130984351b31f5ea1c234c94d97082f62f1c6854175
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZsg:A3k03kHRJi56ro
- TLSH T133255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 951KB
- SHA256 0f00a5c78360bbead78cff8c50e53dfef0f5331227d75df7be40f211fc817bfe
- MD5 f5f57b9d42cac39460fc5265d7b99642
- SHA1 9a68912be10693f72983dca1030138aaf70be0af
- SHA512 d0efd6d42cce8ee3298d5b872c2324a4cbe8216a75452708c322533682dcdbdf217c41f12cbdea2d59df29a9f1bcd3ce6e168475c52efc4aa59f47ced1206a65
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZJr:A3k03kHRJi56rS
- TLSH T154255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 951KB
- SHA256 8b5c5e1dc7cf0332414643bda559ddb7b9e28f886d23a80d7e378ac08c3bfb57
- MD5 b2d140d1c633ddc4c6cca0150fe94b5f
- SHA1 1b19e2908a76fb4b444343d35298319b473b82be
- SHA512 e213b41cb6f77d5b07b06271bb1e8402fddcabcc20c051da3323321f5cdbef45b0d934ee68e30686e2130d728fe7396db962bb671a1ed55cff741142916a8161
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZrn:A3k03kHRJi56rE
- TLSH T14B255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 951KB
- SHA256 9b3cfb95cfcc6e57ce481707e4ef42b376af743a11e49903aa1bdcca25c7dc55
- MD5 175056c756c1350bf2250b418023126a
- SHA1 424f4ed26d5943f5d678663055af4922b1d39f3e
- SHA512 7490dc48190d4b7978beb3842abff152bda633b3baf6086110d354c0af95880f89666df9967a4ce38885d26fe217753789debb2f4c53342fc642170dabc98237
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ3x:A3k03kHRJi56ri
- TLSH T1E6255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 951KB
- SHA256 493cce08725bcb99577bb3cdf7a0746f4466ca1df450ca2308a5593b409acc87
- MD5 902c6322d55374975674aca0a654e3b3
- SHA1 f6a893de0276aacfcb0e2ad9d372b4d193ce28df
- SHA512 7ce31a158b9c30902f425f99b3eb2a666b14069bb6225a9e06279edb8cca8316e2a52ac10c8052f80a92c7c6129aa00cb6d24183fa8f8e575991f343e79c51a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZtA:A3k03kHRJi56rB
- TLSH T1EF255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 951KB
- SHA256 191425c2b4ad393e4b0bdc68904b4d2019383754c3b745627671db58759f5b0e
- MD5 ba242af8a7ec2896a7811f4f84f70810
- SHA1 5431f7a08a36c6b2f8bc8479a7342cc127f8e173
- SHA512 d4b81e5f88091aab2fcba73f95528614e5d151839330566c2fec28e297b5570d42b24f6108449afc9f53086acae897155e087a3494a49f28ffa6633aa3755eac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZm9Q:A3k03kHRJi56r4
- TLSH T1D2255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 951KB
- SHA256 83e270f5516e942164575dfb45a6cab01703c4492e7c49136db8360e73b2fa7e
- MD5 cf74fd6ad056735dc771b66707bf3865
- SHA1 04ac4020370bee8253c166290b50778709d9a32e
- SHA512 c3e16f6db6eca65f8bd99a5cce2e3c35e9e148421d1423511756d9632bfc3b7da980afd75b054f81a0888dd7d0d6cfc3c4ab92bdd32740f23d85f8c7746a2ffb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZD4:A3k03kHRJi56rD
- TLSH T187255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 951KB
- SHA256 1c91464555f891d9577fec3d1349986e9cbb7e814ce1f5d10d07a1a7c56610e0
- MD5 dada1d0716545006642fb74927432c23
- SHA1 08bf4f2ad1841aa05a85e51f4540bb50578d12bc
- SHA512 a7bf644ec24e5b26615196a0e1ed0c2285d008aa1670f2cc3d777ff1b68713130aa02e5fa636be6a628bd266bed7499c27d388bce6931e806823ff4b8c544b2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZqu:A3k03kHRJi56rm
- TLSH T1C7255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 951KB
- SHA256 be27d17f2b901b4850aa91706821999f434c5c9c7c50379b07123f77d76753f0
- MD5 d41964bf72ff4b7e5b66095c33940b14
- SHA1 80f78104212574b2013d1e68b9668076f6b3de60
- SHA512 113b71858111b8a359b1aed4b41b8131766dd67e21f0c5398eaa9363c41d7f753004f7b39e0a6d63e64ba4d27c4f4b6e36222ac7be9b8f2639f6902c0c45e026
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ7j:A3k03kHRJi56rY
- TLSH T10C255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 951KB
- SHA256 04e495362092e7daa4a96a1fad3c6b6808e90e81308ad93f3d8ef97d313912d1
- MD5 fa234096556d62fa0b25a96f6e39e64b
- SHA1 5ae2c1ff5230037c70102ca9dc00dfbe62e5d82b
- SHA512 be2e8278f8418d3236bee767f62f745e3193511074a42e038e629e707641671ea873dae52ac6d91a2df3d2bd8fe611e379135562bd18543600b3c8a9c4c556f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZGg:A3k03kHRJi56rg
- TLSH T14A255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 951KB
- SHA256 76be5514b9d1de2121e63308531da86d05bdc8cf0e0d72c10a2b48561ef281e8
- MD5 00f4d79ebfbdfdbe397953b535818563
- SHA1 b8f4c89347a69d5b068779b00f6d2d843776e9b2
- SHA512 9363a60a6f9526e6a65d10d30e17faa54ca83dc5e4013c4e1500d692ecdf55e2eb9224cd5cd50631b9c78c92078dfae218317b3251eb39b3d25f72fdac9bb045
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZpI:A3k03kHRJi56rh
- TLSH T104255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 951KB
- SHA256 2befb28602b459b5bc6774b36a9a33526e56fc17d9cc0b1048210648cb07326c
- MD5 0467c0862b3daee589ac579106b5a4aa
- SHA1 d539813118a6be7774d990959be9530ca153149f
- SHA512 138df7dc25850a06a37675261b2dd97fb7f35b4e9d3815e0fb7700ae2ccd8f17b0a709288421bb3f6e70f1e63291506c81b29316cfe529d3f1be3ac2a50ed14f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZLo:A3k03kHRJi56r/
- TLSH T1EB255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 951KB
- SHA256 7796c16666198ce9a2bf3184fc8967e0a80cecda0962603e5e33bdb7616ecb8c
- MD5 26595ee9be6deaca4918c8c76b09d48a
- SHA1 c1c68cf884a27910acd579147be2db8586c08668
- SHA512 9acb4bbad6d9584f6f856b8ff8e5d0d49ad1df683c4b1d056ac68363273546c1b0b6b8a1027f0a9a326677d625b651ae8bde96548f345142e921b7dd929a03a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZw+:A3k03kHRJi56rK
- TLSH T1E4255917A6890FA8D10FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 951KB
- SHA256 02c8676a5ed00c1e8f06fa620a3254510b1115e75942d77a67fd759dafa13bc4
- MD5 d29b0dc0939bcfeb1abfd052a23bf454
- SHA1 8aa5e72f7597d6d4128a87b9ad32ebe05ea6833b
- SHA512 b3aacb85407081d21ba74afd24290186576adca28753badad16f9a078704d3f1f5d6fe0eb951f363509973f294a37665e75e82e62995f464af501c4a6f146a20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZIQ:A3k03kHRJi56rO
- TLSH T102255A07A6890FA8D10FC1748A968A62E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 951KB
- SHA256 48a3af84075621de5b5c1605f1df1ade7170ffee0ba29dc0c1f4b97423dc8241
- MD5 ceae42aed97dc83100fbb5f83e8355e4
- SHA1 f369d53b83a478e6773b76abab978e543e7735da
- SHA512 44a638360db22a089b5a2f300e81157c2ac58b4b21b12a3050feb6b07856548f7aabdc2a0834af914628336da6127adf9608b482570002a476b50648d4d1e134
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZBX:A3k03kHRJi56rO
- TLSH T1B4255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 951KB
- SHA256 eae176e4c5eb74491454aa6a2ef72818f46565cd3be239d9802a6c7471f1a2a1
- MD5 053fbb4d30a484303f8398fd7c7772ca
- SHA1 d45e47073d9628b870ea26a79efe59f587854b9f
- SHA512 49d6ebf8bbee814279ccd72c68c1bbe466450ac67387450213e3b500a29affac5626054467f264537cd5441f695d4d40802dddd4fafc8aa8e9d2eb3947c9eca9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZ7L:A3k03kHRJi56rg
- TLSH T1BC255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 951KB
- SHA256 50cda6b91e96859cde493769aa7ce71a72cdd891c7ff0333f92aa388a179e557
- MD5 83200955cc52709ac7d7956edf246edc
- SHA1 724e718c39d50d02b729af5dd32f0f3bcc7fbccd
- SHA512 6587fc3ac4709508f90637cdde6b82c4024afc3650d650c152c58ea3b361f90f7f66981f2618cc41c9d6bdbfb63d33b8836cee7b880eddbd8c364c3955384c52
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZBM:A3k03kHRJi56rx
- TLSH T10A255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 951KB
- SHA256 50e5c73392034f7e8cb4a5b40edda4b5ce0c508d624f08daa8677a246bcae483
- MD5 a7a803db3fd9a52e36773b00503d4b1a
- SHA1 8902e6e5224471de9a330986f4578d5eabf2077c
- SHA512 ccaa4f65fe2082809ed7f180da060d0b28af1d780d77124c9a0efc473e33975880a4a693fa96ab95fc3e392c348d152a44bed471d2ca64ee9ae4270ee1adfd71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCZqh:A3k03kHRJi56rD
- TLSH T124255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH