Analysis
- max time kernel
95s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 16:23
Behavioral task
behavioral1
Sample
2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 809KB
- Sample260709-tv528sdv3m
- SHA256 9e2ebc64c4609a91e3916153302dace3e003e83621b3aa240c83ec8ac45e3c55
- MD5 d3bc65db80f1edcc4b3bd8bfd5cd00ec
- SHA1 7f9f51fc6f55a4acd041e0bc55facd693788666d
- SHA512 798c72ab6c3ba2e4bdb565984c9bf29c658dde02b9189556c16de789647b5f6844daf8896fbcac4c54ea8a50f320790537d99530c053cd6eeefc986a04c94bae
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxN:A3mnXoZ643mnXoZ6i6cMJliLmelRHxN
- TLSH T1F105AD13E79500E9D00AC1749AA69A23FB75BC561730A3DF2368C6152F63BD06F3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/1040-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c54e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-33.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000019c46-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1040-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1216-109-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-424.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-627.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-824.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1138.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c54e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-33.dat aspack_v212_v242 behavioral2/files/0x0006000000019c46-59.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-224.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-424.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-491.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-516.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-601.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-627.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-824.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-984.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1009.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1089.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1138.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1151.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1176.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1183.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1220.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1325.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1344.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1376.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1383.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1401.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1403.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1216 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1040 2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe 1216 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d3bc65db80f1edcc4b3bd8bfd5cd00ec_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1040
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 809KB
- SHA256 9e2ebc64c4609a91e3916153302dace3e003e83621b3aa240c83ec8ac45e3c55
- MD5 d3bc65db80f1edcc4b3bd8bfd5cd00ec
- SHA1 7f9f51fc6f55a4acd041e0bc55facd693788666d
- SHA512 798c72ab6c3ba2e4bdb565984c9bf29c658dde02b9189556c16de789647b5f6844daf8896fbcac4c54ea8a50f320790537d99530c053cd6eeefc986a04c94bae
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxN:A3mnXoZ643mnXoZ6i6cMJliLmelRHxN
- TLSH T1F105AD13E79500E9D00AC1749AA69A23FB75BC561730A3DF2368C6152F63BD06F3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 9c81082b2333bfb899786461ba25b4161433c93f06d70cc5247f931fdc5e78f8
- MD5 88beeae2fce9ddf24cea4631c83a2854
- SHA1 a3b7e65a2c032dc9d12d1132975a10e97338c91b
- SHA512 c99722a7a588bce064a984449f8326946772ef1679f89e48c50777294004dfe2bb486fa03d405281e6fb7352c541df105e2b40bbb8f8af27dcfa4e624d375aba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLmelRHxZ0Le5ji0hmxNrM:A3k03kHRJOPji0Aj
- TLSH T1DE558C17F6A402B5D027C0B9C6D2965AFA713882173096CF1399C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 824KB
- SHA256 fdc959f25d44c85c81fceeb09bbdb7c9f984a01c65b332ac39ab35cead133a15
- MD5 bca308571139594f17d71fb5a5ec1e88
- SHA1 d54f80cb6e015c4f67c7169c0b32f729c80caba7
- SHA512 ebf1667459a8b1f3c8a2979cca377b9eb816f0c1c3fb50eac44c795424e5c2d8d463c96c447ac71dc59f86465985dd6b41d9d055e826d0674270823232918744
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLmelRHxLa:A3k03kHRJ
- TLSH T1BA059D13E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$
- Size 1.1MB
- SHA256 21ffec2843eba7ae694d4213ea428d2a1f20dca3e58d3a369d8cbc6ac893cd88
- MD5 c0a056430026d3c23a564adaef5484a9
- SHA1 a21c804170da16e754ecda90a056ff70d4d4156f
- SHA512 9616950938154a565999e4fa529cabf2c50f04456d195f6193a1c2d9b1d16f350b4503cd3344d59ccfb9a96ec48ef4b61220b1fb3b17848d3e5e1725a8d6cfc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLmelRHxWaewsAju:A3k03kHRJelju
- TLSH T12445BF23FBA480B5C16B85745BA5C723FA397C110B2057CBA3A8CA192F727D06B3E755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 833KB
- SHA256 c18f3b6e6934fc1fb51bed99b8e3ab248bf007084d7540f265958e54e795ec36
- MD5 554a8563fae06ba02f603d886e854777
- SHA1 8467e96a6b1658c7c0753b9e82c87c449cb8f333
- SHA512 43f4e500a7ad8019c0bfbce2bc81ade91ab05372d64ef2c857be73e9d3bbde1ce03f03bb2419226a7f47e0fb338c98d83b50eae75117a513ee8f5125a5029883
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxK6:A3mnXoZ643mnXoZ6i6cMJliLmelRHxK6
- TLSH T149059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 833KB
- SHA256 f8eb3a153aedabb7190b528256e610e633ad7ee8c4af81c7cd211058a8de9cff
- MD5 323ebc88a838aeb2d56cfb4c975725a7
- SHA1 ad14a4136b478a8874e8184bd02d22332b39082a
- SHA512 c1eaae898a5b6f73674c2525a30fe85c5ebe910b4d758b32610222ee719412d31095dc5257f483924705111d9dc3c67a2f2f609e41c3be4cb333be3c40cd1960
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxiN:A3mnXoZ643mnXoZ6i6cMJliLmelRHxiN
- TLSH T1D6059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 833KB
- SHA256 5b39009ae3174e802fb624699f53bf135be24eef72251d219f1a2fe4eb945e61
- MD5 ec7e2ec9f6c1d4db1014bdac9117c3d9
- SHA1 adf783f7e9050a923ad9a6fbb909df6e60c4ae80
- SHA512 f2d9dce89fa74906f865b70100b1bf4ab0be4c67871c15799e4346dca59087439000c618cf23066889442214b36d847bf0288f0050058abeea2788b57fec5e2c
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxYf:A3mnXoZ643mnXoZ6i6cMJliLmelRHxYf
- TLSH T1EB059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 971KB
- SHA256 0128fd0487a7f65868c74302e3dae151b687c5396dddd4350a56e21bbc5b89b4
- MD5 a9b94f148f76b5ebd124c28824f133c2
- SHA1 e498c689ce4d635566285ff8312ec2463e6aa364
- SHA512 e3a4deb3e88fba4e71366e5237ab86c7568c556ffa6df5f2e99de6fb37f92a5d25120176bbf11ecc367897040820a2f35b699f2967403339ec723038d33dd635
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLmelRHxbzy7:A3k03kHRJIs
- TLSH T17B25AE07E79500F9D01AC1748A969A22FB75BC62173097DF2368C6162F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 833KB
- SHA256 e63f3968e25c6696e613a774c09d968466c83891f51643339d885bd23b0aa4a2
- MD5 209098110b63cff6406077a678cb8805
- SHA1 730eb4c369699dabba421d21001f468df68a46cf
- SHA512 a28e6e1a58c652dc1b9d166c0bdbc4cee7a934f853912be7687d4b29d2c49babb33fdcd9343f86b681589589a4b7e73238685e11cd723cfdbfcdd594b008fa8b
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxyo:A3mnXoZ643mnXoZ6i6cMJliLmelRHxyo
- TLSH T1CF059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 833KB
- SHA256 eac9dc2697ca6d1ec34433d18a2472f05e06bded4b825bbf3cd09b6b8193c9c6
- MD5 5ae2114a3c7e36be27ad2a9494771f11
- SHA1 ccc91774ea41f5857dddc1186e3f1b233dc201a3
- SHA512 a738dbad9206224f03c7a1f62fd6c64f38fce89348cfb91252ca49e40c23423f08d400ec73fb7940c5d86a8c1fc3a407ccb8986eb9e89d0c5795f02e27812f67
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxmu:A3mnXoZ643mnXoZ6i6cMJliLmelRHxmu
- TLSH T13A059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 971KB
- SHA256 46787bb085219a81510422826af2eef8108319ac13719de860a0e8ca466d9661
- MD5 067c3791a70827dccbb1015aae682fd8
- SHA1 8c2b3db38cebf90233f2da844f91c8a9d3462ff8
- SHA512 3448e80701160ff2ffed96607a5e42efb6c73fdb5ed47e6da3d034fd0827afa45d9a20c06864e5882ce48c54c77b0981a5c865fe4eed68e8f877ecc5c1e08f0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLmelRHxOzy8:A3k03kHRJ5T
- TLSH T13325AE07E79500F9D01AC1748A969A22FB75BC62173097DF2368C6162F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 833KB
- SHA256 18cc822a40235f2f0968d9be95402579da4543621590741472b10d86188d69f3
- MD5 f52ef72fa8a72b2b8e55a937e1c80fb0
- SHA1 01c2568f2f0108366627053640b1ae7040ca9d27
- SHA512 40384098bbe54b7d3bff5c2b5cd6eb0d77db497ffc8d26f8d3d92230691c219153deaea2371fe4cf983d7fad6be25614428d1e6ce0f201a839b65de25761c918
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxa9:A3mnXoZ643mnXoZ6i6cMJliLmelRHxa9
- TLSH T1E6059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 833KB
- SHA256 27740315bafcc5eae786de8299f7ac076bc6c17f6079ba038f4b739be5aae10e
- MD5 9addfd2118c116bc3ddeae5a78860208
- SHA1 e286993d6449ba4e4a77d9894c304e8434cc583a
- SHA512 888539e63327f64b8ddeb09e853f0d7e70ee9583be0297b45cfbfae07eac77fb9c62fd8c9c7cc3d181b7128fb7c3a35d735c5b8320b5716ac5a635b5a91d461d
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxac:A3mnXoZ643mnXoZ6i6cMJliLmelRHxac
- TLSH T148059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 833KB
- SHA256 6e886df1141b52efc5916b8cfe7d6fd2fb618ebfbc22b7c688c44b1fba437741
- MD5 a386fcbc055d53315d3999abec449154
- SHA1 45e3547d5daea86d5aaefebefaf1dcf18611a904
- SHA512 41598750b9d6ec6cdd9ff9ea17f1968c9117d341c193ab2097f2d7f527fc4e897ac39061312026feb4714630f13414af318b375a6ee58cd3e00b294d6267362d
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxTp:A3mnXoZ643mnXoZ6i6cMJliLmelRHxTp
- TLSH T125059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 833KB
- SHA256 c5059b00e7a4770c666d5952e0d5c6f4517faad33f53aca20def3df6c48df638
- MD5 a218dc3557a74ba75a8f5221564a5be6
- SHA1 2f73de307afe7f005cdb5673c991914679b19ba5
- SHA512 b3ae689dbce84c86ff877ce13998465f2822ea593c00e58d6adac9b8564a4c7858d0e48ff8b326eecf10396f8a79a9ad269010b767e2e64e8216e0962164722f
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHx00a:A3mnXoZ643mnXoZ6i6cMJliLmelRHx0N
- TLSH T19F059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 833KB
- SHA256 2ed71ebc79da09dba4915b3b95281629c38f8a048131fb1c9ba8ed63c0287dc8
- MD5 943b220271b7331ff1bc8eed232daac4
- SHA1 1dfe60209ef2992d680341d897299a67be8bcb93
- SHA512 44648c191c2d4e9a84af8fcb520a7e37ae3571331d5f6ad7d842579490868724db6fd0c8eccddd38b53195641748572b579df324ee4b07b31f755fce546a4e46
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxcF:A3mnXoZ643mnXoZ6i6cMJliLmelRHxcF
- TLSH T150059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 833KB
- SHA256 3abf3f38efde359167f23c9f3b88bf97bd47c1ad3a102639de4cbd4c5cf8fe44
- MD5 f426c39a9a3e6b5f4cd602113703114f
- SHA1 e3f063bdb2599accfd30bb4dc5006e92c37bb875
- SHA512 e4064119a68402b406b463feea4ae8857fcc970b87039c74cc1acad036aa1d8a296ccda65308994e724e4a7cde2c7690fbe3bd0d1023b4f25de9a7de254c7e5c
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxJC:A3mnXoZ643mnXoZ6i6cMJliLmelRHxJC
- TLSH T188059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 833KB
- SHA256 9920c84b597c94f55dc4dbcd0cea233b9c7e201442d818411a60aaae7b29d0b6
- MD5 6d23759c36dfbe8b1351ca5708920385
- SHA1 c3a60116c1edebcb22d28833a738261cc40ec07b
- SHA512 d9797ce88992042cab20727e397abac7f43839eb8f375948d3d5fe5b67ce6c9eb38527fb6330bffb6c95a898f778b2a05647223d98fcb46fc2da7f22068f2888
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxqw:A3mnXoZ643mnXoZ6i6cMJliLmelRHxqw
- TLSH T108059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 833KB
- SHA256 c99c00dad5e147df12ce6a6b726325a90acfa573524e6e534dcd8309660c7240
- MD5 17d4c57b81ce7823e7582f07c96d19f8
- SHA1 5912c989760318f789a1b7c5d2092c0ad02faf6f
- SHA512 6b2dc7a65db5f5535f3b9d51716b0e55bec78ea798fb704a7475880cb28da3360a1dfa8e0af4ca421b8703fdd6de7d8f2edd874277c9c79ac859e35ab7c4d2d4
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxxT:A3mnXoZ643mnXoZ6i6cMJliLmelRHxxT
- TLSH T16A059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 833KB
- SHA256 605bc9141889ac7478c8237a7a3dcda8e28203ec2550b2b57d7afa8877ff6b68
- MD5 09dc33650eefe5e991a4a773725123fc
- SHA1 dfff12671567ef6f95921c99c288322237e6b369
- SHA512 c2a373b613d8f3062b3d23b6215ddc70fe33b81832cde9f97cc44d52fc7e55fa1990010235a696ee685628d30c8f572695b219f603a3748c0a4da02bf3b780ef
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxfu:A3mnXoZ643mnXoZ6i6cMJliLmelRHxfu
- TLSH T15B059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 833KB
- SHA256 2168971cbfdea2c2fef693bfa9f08214f3768d3cc2287303e5bfa89bc6b317ab
- MD5 ea35ab268a547af1a954b2932d30acdd
- SHA1 c1772cd8614d798a39445812906b6284e4db0711
- SHA512 46d2ce7f5a358d3c2e10c0955dca0f11060178badbbff3d4a6783d6a882a66bcd207ee111a2c26ea3fed5c2232a87e76c267f2aa06048ab928eaef5f8e8bb46a
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxDb:A3mnXoZ643mnXoZ6i6cMJliLmelRHxDb
- TLSH T128059D13EB9500E9D00AC1749A969A23FB75BC561730A3DF2368C6152F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 833KB
- SHA256 5526ee5fae175e98966df872e01f4977676425d4f7201fef91313c13a92f9358
- MD5 3b258d9633051a5a0f08c88cad4bfc9a
- SHA1 97a4cabaaff62e900295472ab0617062b8cae5f8
- SHA512 0e8450dce73ce9dbc201b4db18a4c1126e5059a1222818e2b2f7bb6b126424aef1280ce8472bafd8c266ee412eb8e31227e0da01e99c5855ba94aa34e09ffcd5
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxXf:A3mnXoZ643mnXoZ6i6cMJliLmelRHxXf
- TLSH T1BD059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 833KB
- SHA256 b474402d177a387a5ba177b8e4fd90e02062046b8dd883f51ada10d010f8dde2
- MD5 e7f16c6ed8602596f2b10c6af56100a9
- SHA1 08927399b2bc05163cc4b8322bcf54f5f1fce609
- SHA512 595cfaa88893e5100a6b581f98a23930a21c4a1a314792fedc5a58b88a33e486317aa15d9e7fba11a3fe159de8fcc28d780bed3c53f222fb496abf7b1b6196d5
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxgK:A3mnXoZ643mnXoZ6i6cMJliLmelRHxgK
- TLSH T169059D13EB9500E9D00AC1749AD69A22FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 833KB
- SHA256 bead1b9189105330fa701845977dcc7a904e6732643a5eae6deca4cb24bec72e
- MD5 456d523b1536dbe491f0e703a786a299
- SHA1 aeef9bc0c962cc3cdb8f3c96560760accc77f926
- SHA512 41089069fcc14e23548b41b92581d103daf06d650877903dba1d0dc136d4aa18c483f297423a9271e8995222421d56b2519c367013f6cacea93d734d4261d70f
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxdk:A3mnXoZ643mnXoZ6i6cMJliLmelRHxdk
- TLSH T182059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 833KB
- SHA256 c6f0a86250b6a15371f883af541b4556c0e6190361aeb8a20c5dc6d2b4d38379
- MD5 f63ff95e35678b305fa728fa00aa3061
- SHA1 6ea57e56358f5e456447d12c467e8faef154c629
- SHA512 c05cbc577307bdad1ccf172674546c7e6c39b8682d9b9584c4d1076c2ee67036500fe60f883d9b1f7b1dfa5da901f20a2fc5dac321a45c004213679d884759df
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxC0:A3mnXoZ643mnXoZ6i6cMJliLmelRHxC0
- TLSH T11F059D13EB9500E9D00AC1749A969A23FB75BC561730A3DF2368C6152F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 833KB
- SHA256 e682965195def2ab54bbc8f7328335fc6c65677562536dc7c4366b00a5cc42d2
- MD5 21a537dbe2bc77385c9c7ad24b96b89f
- SHA1 025ff3d4e22e63726ee733a0dcc3dff2bfc0db9c
- SHA512 c5960f2050a2c168f03529855911804304296e8845f54b497188b454fd9e38a3df03bd189e08acb763bfce4c5548f78cb85630f26105ab2f19c64cd7ff0679a7
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxR70:A3mnXoZ643mnXoZ6i6cMJliLmelRHxRg
- TLSH T129059D13E79500E9D00AC1749A969A23FB75BC561730A3DF2368C6152F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 833KB
- SHA256 c05e75d6063ad236adf03bf40f6e0dee04e6c050176866ecd4bc515b054b7278
- MD5 457d95846079322ebf1e77a4d5243fe1
- SHA1 85d82d6220abaa3c4f4f7eb9ea28f3b3f8723e81
- SHA512 b85a073bf5b8950f24aec1bf4e9e38f7f9586db5819cd494e4d3cb433ee0a7475d0cb968c3ea3bd74272f82ae81535cb43791f69b9b6a72812d23d86647270ee
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHx4r:A3mnXoZ643mnXoZ6i6cMJliLmelRHx4r
- TLSH T1ED059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 833KB
- SHA256 b74f6bcb3ce9967431782d9f968c1deb749a22fb9b70d8c11001117942ee4b9e
- MD5 0830c7e2d17df8b98977ba52680a2f25
- SHA1 182e2971c99998a13c821edbf736d24026e11621
- SHA512 fdff0caf2d8b4e78665bf9f60b61961e6107754f7e555d8f988827d103fce93edc18621e6e35aa9b3fe050df9bf7379b7e377f330851f0207a64f8d0992ca0b5
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxWn:A3mnXoZ643mnXoZ6i6cMJliLmelRHxWn
- TLSH T1A0059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 833KB
- SHA256 1177809fe286044dcbaad40279a9c17e31f587e3c1b656099860043b35e512e1
- MD5 ace4dcb824b92272e03cd664e9181a71
- SHA1 a9232d5b2aaf5c97960fffd2b84ed92c3ee2f17c
- SHA512 2a98460a0f10415afb2b038a257cb7ca1b861425e8c870a8a7cf59fb89603abd712c0f0be99b42604dc762a1d31296b40b18b0dec2eaeacf2416e40ac1507af4
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHx8x:A3mnXoZ643mnXoZ6i6cMJliLmelRHx8x
- TLSH T158059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 833KB
- SHA256 b314e3ddcb40c3e403703f35f726c52d9353531b19310f30d892cb2b029d6ebc
- MD5 bef061ac25b1df832b8a49ebc2e1180a
- SHA1 fc45d6cbbdcc54f7aaca8d12c0cd53affbc15685
- SHA512 79f801dcf8d05de48a5241bbf590a39427e1f74c23f33b794f09c0b948f8e87a351c1ce924b1e51fc66b55ec396b5ed9a33051a2204c11648d4769d2d97466ad
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHx2A:A3mnXoZ643mnXoZ6i6cMJliLmelRHx2A
- TLSH T12B059D13EB9500E9D00AC1749A969A23FB75BC561730A3DF2368C6152F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 833KB
- SHA256 d48ec35f1e9039dd378e79b544fc27382cf88a15e78b8158430882bce3e6bde0
- MD5 f28f2f7ad4c717e9aa90339b8068b44b
- SHA1 7b6339bdd0d8281184a4fbb5a606b72550e9f3aa
- SHA512 aa47b9d3d9b23932624e2ff7231f1aac53bfbfa9d1f9d99b2d452956a73e060f0b5c0db4225899d278fa3caf0ed3c1e2ac96d60964736d9a97a32bd3344fdd9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLmelRHxv9Q:A3k03kHRJ3
- TLSH T1A4059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 833KB
- SHA256 e4e4cd2283b3e3056bad9006402546d62f770dc37f4f488760ae3fbe00bc96d0
- MD5 80dc8996a1ed5223dbe00656616d889b
- SHA1 ae63541a42d0b276e1edaf8eb81cb46c1c989204
- SHA512 e11c652fe2d44949c8d7b2bb3e409077bc7243ac7516456eb4715342a6ee968afb9349e22182ce435e2d898f40424fdb58766c4448044728e5f8b7c14541f1e8
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxG4:A3mnXoZ643mnXoZ6i6cMJliLmelRHxG4
- TLSH T1C9059D13EB9500E9D00AC1749A969A23FB75BC561730A3DF2368C6152F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 833KB
- SHA256 5cbacd5a15f5a184d047723b01decfa1304daac07f572d23702b9e2a6271eaad
- MD5 8f0123d999936a1e2496f1764b80f4aa
- SHA1 ddbbc1bba0d53c3e1a69d99abb8b438acccc1b1c
- SHA512 d6170dcc3d36721464cffaa6550d90174eebced7dc88fbea065ce0b73d9fa4587ff37caf81c0e8880c078da021017a1141dc1c5da009792b10b47e20ea6cda5f
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxVu:A3mnXoZ643mnXoZ6i6cMJliLmelRHxVu
- TLSH T165059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 833KB
- SHA256 93237f1c6dbb7ea8c7d52d37a327dab1c186dfa1183fbb91fa9bd134fe5c408c
- MD5 1fb295087c67b4605f362a113e9860f6
- SHA1 9a9d76a2cf418674ccd7b5139956825918933943
- SHA512 ee6754f13a0e2c5c05a74a751aa52875c869a69ffe5e2415f94e7d5aefbb48a7aaacd05c13db0f621f6befa541aaa2bb455e2af503cb25f214d8d3242bd4a892
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxIj:A3mnXoZ643mnXoZ6i6cMJliLmelRHxIj
- TLSH T1E8059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 833KB
- SHA256 8cbf86645675054e2559a1d53b36dc1570dffca3713cb96ae95a964a5348f61d
- MD5 b3f062e222237f41c00e2fe09de8b3e3
- SHA1 890bf945b90a28a892b95b23a24044530c443408
- SHA512 7d70e0a432691363a5bef50fea9e11490677a8e067b02c0229dd516fda42eab99250e7366f94a3046f967498c492b65aa93ab02b7feb718ec3a6319a33161d19
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHx5g:A3mnXoZ643mnXoZ6i6cMJliLmelRHx5g
- TLSH T17D059D13E79500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 833KB
- SHA256 dfb55308f44a390dfdb5ca82db6961c188871c2f5f26bb86158a2cdf1d2f78de
- MD5 31ca7807abf0b3de1bfac755f5704525
- SHA1 7931295d8140ee92fc87a304f60d59bc5d53955c
- SHA512 6858017a58e1fd206fb5137ea1d089afd4361c398674dee62bd15ad7910631240b08a56fdb3f7accf5b1ecb08c2353a82147840a1256c0b063af44a2fccd86e2
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxgI:A3mnXoZ643mnXoZ6i6cMJliLmelRHxgI
- TLSH T13B059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 833KB
- SHA256 108d0d1512f7705363bdbc1588640c10dafa8b9573ab3fcc2db332ce2dbb9800
- MD5 bda8b72dc02a215cb0b858c28441726d
- SHA1 59c564e210773da7a64f18931d2e0640ecb2ad07
- SHA512 fcdfba4330f3279ccb5a7cac42041e84cd409e52c16eac97fa65064ff5ca593dd59293447ce47992b41fb6c4b43b67dd041401bc1c858c344a29de980d3dd829
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxio:A3mnXoZ643mnXoZ6i6cMJliLmelRHxio
- TLSH T1DE059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 833KB
- SHA256 f28f6cf696fd456e9ee8b037bdee419b7934961b8592b9610e38a11ecaa6417a
- MD5 5e5db7f657c07d83bde0a8543d914ff9
- SHA1 12c6e3f71700fd7caba1561fe7327bb2e378e698
- SHA512 a63e76da48892f1109459fe83af8041d477a40e1ba82ac07d363d57ffe54488595da3409296382838034b4636034fe323291ea2dbb97ff8211ac5010f4ad5bbb
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxZ+:A3mnXoZ643mnXoZ6i6cMJliLmelRHxZ+
- TLSH T194059D13EB9500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 833KB
- SHA256 e7f65481d7b268468ba5a52dc44849cc05b2ca714e98cc03155a30c33745f237
- MD5 72e12f1525ab2d27c52e6c285d1b7ea3
- SHA1 af9170cd56253e816cab90bb03a8e7da5afe5c74
- SHA512 e6dc73f30fad2047af30306dd578de6f29a4087d40b55d26c56e21930241a7084f53816ac0b1c7698d3592a95674c9585a4fdac338031607bace45dceb4cd8e8
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxHQ:A3mnXoZ643mnXoZ6i6cMJliLmelRHxHQ
- TLSH T164059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 833KB
- SHA256 4c5ddd4184b48acc0f27ef99943f42caddb43561cbc0481d27adc3c01aefd9c4
- MD5 d78d096fb418a91b56997e908faf1ae0
- SHA1 5d545ff131d63af5bfc69f07604721683a98935d
- SHA512 c252afd30e5ab44831a7856fbf87eb1d511a055687421e0d6d8c85d653f4c67e6147514914a732a782485fb5b65a1c029cc338f12fe88c079c5bfdb9722d09e7
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxcX:A3mnXoZ643mnXoZ6i6cMJliLmelRHxcX
- TLSH T140059D13EB9500E9D00AC1749AD69A22FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 833KB
- SHA256 07c386a4e8eeb5983e5c133048179cb428806a2bd0c89f96de85e875254f28dc
- MD5 e639dd7b6a6f074e186d2da7dfb76853
- SHA1 3af8b64df7bfd418004fc44356e9499ff1aab77b
- SHA512 dd4d4091a48fb92928af217b6ebae4f8d2aeb127348d8bd533ec1cb0e92f2e66a1465e0400cdadd1c2c3db95b1046582093a004ddc0222dd3bf283572eb62a22
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxaL:A3mnXoZ643mnXoZ6i6cMJliLmelRHxaL
- TLSH T10F059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 833KB
- SHA256 ab7ae6a534a657270b05f5e5ec3c6053d2c89247cb66f188387ca4f86f0031d2
- MD5 40ff46e19bb0061a6993b50568a9b727
- SHA1 6df5926d993028eaeab883c40fa5743aebb66da4
- SHA512 02dcaf445b86346fb9901b615296478bbaf8b2d904a0b6d0ded9ec1c279830a214c88b6f1790c3cf8c8b055fd79c315ded42859138f2005db208b1c7464a4e16
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHx+FC:A3mnXoZ643mnXoZ6i6cMJliLmelRHx+M
- TLSH T143059D13E79500E9D00AC1749AA69A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 833KB
- SHA256 357557869a72e1269eaaa1159bffa39cfcbf941942b1f38e16e7bf46d85f5c0b
- MD5 f0991491ecdf6e3eea92b5b613201e6d
- SHA1 955322c22b365b828edf034c0f9fe1e9cde76162
- SHA512 da737a558b5074eac0c2ab71cb576d1abad83beb42a8c87057349ee8d47fc5b81e5e7256fe6c689343782ffa1ca4c31cdf76f49d2f1a7a5e6681292acf1cc521
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0Xel5fHxnh:A3mnXoZ643mnXoZ6i6cMJliLmelRHxnh
- TLSH T185059D13E79500E9D00AC1749A969A23FB75BC561770A3DF2368C6152F63BD06F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH