Analysis
- max time kernel
101s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 01:37
Behavioral task
behavioral1
Sample
2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 850KB
- Sample260714-b15dsaev5s
- SHA256 07be6a3224fd01d6122dc47c61aeaad85445bac19e17b794d50896c710ac6405
- MD5 2fdea2559a16d77b434c5bc2bb81aec2
- SHA1 8d92862a9617e3084f53cc5fc732ac756c5579b4
- SHA512 f56e9baa5156202e18583b085b6b938cca5419c36d41a2371ef1d66d7574d1d88884854b5d04a0b64f836cfa8df9ecc7776113c44956cc38cfbdedd55e4a31ca
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSc:t/sCv7rTiw2RYwZCUsjwSc
- TLSH T188052A1767EC4895E467A13489B58606EB72F8551B31C3CF12788B2D1E63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/4140-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b7e2-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000016cc0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4140-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3424-34-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198be-280.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c1-443.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198bf-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c2-559.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-608.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-724.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-788.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-825.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-875.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-914.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-989.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-1044.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-1158.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000006548-1984.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000400000001b7e2-5.dat aspack_v212_v242 behavioral2/files/0x0006000000016cc0-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e6-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6b-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198be-280.dat aspack_v212_v242 behavioral2/files/0x00030000000198c1-443.dat aspack_v212_v242 behavioral2/files/0x00040000000198bf-492.dat aspack_v212_v242 behavioral2/files/0x00030000000198c2-559.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-608.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-724.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-788.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-825.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-856.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-875.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-914.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-989.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-1044.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1096.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1139.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-1158.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1177.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1221.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1324.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1368.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1375.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1383.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1396.dat aspack_v212_v242 behavioral2/files/0x0004000000006548-1984.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3424 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4140 2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe 3424 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_2fdea2559a16d77b434c5bc2bb81aec2_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4140
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 850KB
- SHA256 07be6a3224fd01d6122dc47c61aeaad85445bac19e17b794d50896c710ac6405
- MD5 2fdea2559a16d77b434c5bc2bb81aec2
- SHA1 8d92862a9617e3084f53cc5fc732ac756c5579b4
- SHA512 f56e9baa5156202e18583b085b6b938cca5419c36d41a2371ef1d66d7574d1d88884854b5d04a0b64f836cfa8df9ecc7776113c44956cc38cfbdedd55e4a31ca
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSc:t/sCv7rTiw2RYwZCUsjwSc
- TLSH T188052A1767EC4895E467A13489B58606EB72F8551B31C3CF12788B2D1E63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe
- Size 967KB
- SHA256 a42a2530dccd869ea5b00af3150a9e3d80d83a65682c8ffd986a90d82621a4f7
- MD5 156f6980c730e7654c737796bd1691a3
- SHA1 4dde69eabae254bd6d667ea1378114005bda99ea
- SHA512 5d97ccfd2494cefa9341b6a553fa12e18d0e10d82bfb7860d830f46d7c26a1442447880c5392154ae04c2089c2ac5393469db76d0b19779c42d2e913bec634ff
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSEUBUjn8CxoFi:t/sCv7rTiw2RYwZCUsjwSEv7MFi
- TLSH T139252A5767EC4895E463A13489B58606EB72F8551B30C3CF12788B2D1E63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 5d922fb1f954b1c354e9965774e22915820ddf9c9d982969e7904a657b8950a1
- MD5 79e3f4cdd76830d21869ac07a5caad7b
- SHA1 198df616bc821478761ef4a81fb9d97c0e6e94d1
- SHA512 90d34698e1c9fb72f766fcfbcd8e8210d5f00cc6f32733ca3aee5e3948d10cd102595d2b4c8942635986c20df5ade5d96e6d89c0ccb3ff73372be18705dfc3aa
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwSk0Le5ji0hmxNrM:x7iw2T7Pji0Aj
- TLSH T122654A17B6A84661E073D174C5E6964AEA72B4461B3087CF02A8C73C2F63BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 864KB
- SHA256 df8b9099736b1239dc4d5e6b87c52a11de8a8ecf54b1cfebfc39a76dcf788e35
- MD5 9e6e6a0cb9a865b85040cfdeb1de93db
- SHA1 5f28bdd20d605b5b4e04f5a5b61187a15fcb7d8f
- SHA512 fb90b7ad6f9fbd87c698c88299e842daacbaf6940ba67c315398574f11c6649ec87ed507ec9812e603b65ec4cdf31666fcf98544df1d51472ebc6823ca6db2b2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSOa:t/sCv7rTiw2RYwZCUsjwSOa
- TLSH T154152A1767EC4895E4A6613489B58606EB72F8551B31C3CF12788B2D1E73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 897KB
- SHA256 85a8ec5c84346751dfa1f3ad878a4c5ebe20165165e4ba617441bc14f605658d
- MD5 540a7b6d33bb79d0aa4e36f185e4b751
- SHA1 4fa9f408bcacf9a409a96358b3d895075cc0129a
- SHA512 c5e0b13c6b18f3119875e7af662bfac1d7e905444168aa177c31c536f5d8396ada772e8199d6817261d28cc5419b1396042fe726c42c566408d87c01605833fd
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSNb:t/sCv7rTiw2RYwZCUsjwSNb
- TLSH T1BF152A1767EC4895E4A7653089B58606EB76F8551B30C3CF12788B2D1E63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 873KB
- SHA256 e3d4bfd0f068eae4cafe1b5ecc872dcd0ed62fc93c2b93f09c37aff005625918
- MD5 2ad22e586bc755c6ba8a98d90e7b0d9a
- SHA1 4e7a251c6588757ffa7130060846566bd7597b53
- SHA512 f5182ebd3ba499330e05e4ef92c9267a6cd1a520a0e4d6f8a8783dcea0a84a8851f5229968461367695e08e47638884c0283578902c499f089a336ea4aa585b8
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS/9:t/sCv7rTiw2RYwZCUsjwS/9
- TLSH T1D5152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 873KB
- SHA256 d1905c0bb42dc96a68dd026d61fdbb51dc64d950beab6b384234a96ddcc3e43c
- MD5 65c16727f593770858141cd96e5c8a39
- SHA1 51abfb296856e03f6585a391bfaf921ee8ad2aa7
- SHA512 447d9abfdf70cd3899b6ec79ad0a163492693c9e125ed90efc17bc423b2340c5ecadff949e72707446c9c39f6b738e564bf2f1a24338a510e6fb3469320581d2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSbc:t/sCv7rTiw2RYwZCUsjwSbc
- TLSH T13D152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 873KB
- SHA256 18f7e7e16f273cd1f42002f2b9979c21bce25536949ed6ff67cfb3f51e8d2673
- MD5 64d5e862dcb085fa8a70a26f893fcdb4
- SHA1 daaf73c3ce78f5d865835279f5b4dc65b8541141
- SHA512 e24b5d3b531bd79fe638db1bce205db21c0275b9e6b33c04692e13208864c2c8c108a4d934961e2738b6f0f5738b62ad6e5b9fdc2318239354da2cc5d3762f80
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSEp:t/sCv7rTiw2RYwZCUsjwSEp
- TLSH T146152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 873KB
- SHA256 6c4b019f552b08437ad841a093f0487d52cbf144cbd5154d09ac2546ca4c2705
- MD5 41e96f5d369e09a61c4f27d5da612007
- SHA1 641ba6e6f158165e90ce057e3b3fcb41c76bd058
- SHA512 a6086b8b5281da94e074a30c36ce6e1306b315fdc17f3c2f470dc41d34fee1a20b50eb9d771b6706cac7cb0bb85793bc1fd96df07ae4ee4b3f2f9d76025621aa
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSL0a:t/sCv7rTiw2RYwZCUsjwSLN
- TLSH T184152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 873KB
- SHA256 947e9cc7d725a0ef4c67a7a8932a4735d7b02b6cb8298d83584096cc470f3dfe
- MD5 7f9f1fe2c24f423e54d33d0fb61e1273
- SHA1 a14decdb6a673507514fe895b9d66e4c6cf2bce2
- SHA512 de6c30119a52e6915a79c9d7b2355ad6ff663084d18edd713451cbddc456d3a92f967e91f3942d22a40852a8762a62de9ba7df393418258221a0b9c1b93a3976
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZF:t/sCv7rTiw2RYwZCUsjwSZF
- TLSH T12B152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 873KB
- SHA256 e9e34ba2eb3026b766186222bbb737f91e4270e7abac401b97f83d9fa5e2c8d7
- MD5 1af7f93ed84aa40d68bfe08f7d85efd8
- SHA1 68ecafa596ce2dce9f9235853eba42e86965882b
- SHA512 66e4fa74897ec99b20a2085ab673d9cceeb0ac0763c4f8eae0079ff722912d731bc1a72df10f1939218392f3a2af017e285bf0c9f8ab4fc110f29a05d61b62f6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSyC:t/sCv7rTiw2RYwZCUsjwSyC
- TLSH T1F3152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 873KB
- SHA256 9f757895794cbe3cde6c9812ed51a0caaafe4d2d6229baf28a5c19c812313c36
- MD5 0c592c88cf9b3c9b13159a3ca454c109
- SHA1 f159da9160423c7776e1ef7d79bdbcf8f6de3a22
- SHA512 5eb810d3b1d54bc9e88093d2e70b14f17886bffc8b497266547f421ef7e0bbfef29f6b332fb8f62332f7051c2a0bc1018d4e655c7749356ae417f466679e2fb2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwStw:t/sCv7rTiw2RYwZCUsjwStw
- TLSH T184152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 873KB
- SHA256 211182cca6e933ecb6ffcf3624cefa4f226d1d4d7f73a29d30fcbff73a453681
- MD5 b5858f1e92da957b72fc7e93dbc32012
- SHA1 6c913e2af0127f497e617a1f208f4e0e5963cb40
- SHA512 2beec549b159b7e4983d80d04230a7dfb373c4dbc507ff34eb496bcdb294ef8b1b9ecb20dcf528be3354838bebfb9802eb20f8dc71226a195f2431c18934a996
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwScT:t/sCv7rTiw2RYwZCUsjwScT
- TLSH T1DF152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 873KB
- SHA256 49e7da6f6b28a509c6df91cf7657440a4659a7fda95f38bb182923073fced32a
- MD5 c23b0e1c3ceeb45debbd122a46486bb4
- SHA1 f2e3bda68e79e91a31739c01327bc84832e0081e
- SHA512 d51c2c9dbe7c2ff947bfdcc85dab7455ee636dcabba635747029683f19e67f36c6fe4eedf47b7b97f4f2b3bc67398e61f7d7a55ddfc5cc3fb76c638aeb9cca75
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSwu:t/sCv7rTiw2RYwZCUsjwSwu
- TLSH T135152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 873KB
- SHA256 165c7ea703176837474e1c563d1c4b964c5a1e525252497247d5fe0eb0bceb1e
- MD5 9382642a2c878f5369a8033fbe037ef8
- SHA1 6714a012409c530546250f0566a3831ba98eb528
- SHA512 05ab59b880741bb96859da33cb8cac6f20e4cf27f8e88c58b2b2e5eafe225956bb73c5bb2402c5b4594471922648f3d64dbc706832bb07f33baf19d07ef7d3d0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSOb:t/sCv7rTiw2RYwZCUsjwSOb
- TLSH T10A152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 873KB
- SHA256 c834d331251281367a08932b3d87196ca9a883b3d8a7b4b030e29e0703d2d33a
- MD5 eaa616a448cf71fea444a173404c8b28
- SHA1 f118464133e398910b7b4f3bf3a1d01539fe3e2d
- SHA512 6dd0e26c80506f2b08bb9310b6ed127135392c29d1312196c5204a789dddb125a0c3a01f464c0bbeb877fbd240b963d4871e68884c52847ebcbf4b62d6f75e2f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS4f:t/sCv7rTiw2RYwZCUsjwS4f
- TLSH T132152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 873KB
- SHA256 d8217f73a2521827f0ae790ae623c56d445d814273239fc26ca30e72fba38ff7
- MD5 411214e9e357677ea6c1fff0de9207a5
- SHA1 ac6195abf2d80ffaf490b72dd37cf46dac0450ab
- SHA512 02c18e7b1bf8ab6948aafad26bcac9794dbae9d6a0d0ef87c09d4f7fbb2add74fa0060b826fbc9ad785d8edd17095755c392a262c06a02bac32a89a83a71b4a6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS1K:t/sCv7rTiw2RYwZCUsjwS1K
- TLSH T1EF152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 873KB
- SHA256 4e78160ab7d53465eb5a68877856ba56e0a5b9cda2c2aa0994be44e42c7a04cd
- MD5 c79a331a0e8ef7c579a16f1c75c7264f
- SHA1 d807247957021afcc9c1df198a8a170aa2231c66
- SHA512 786f749fea143a03637f4c0865e2796c6b68a51fac9a151987abb0abfd68b39d25537a1ee9ddba3fb23e6fa1d48a574f37e2052880430c8ff9af4d38cf894a14
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS2k:t/sCv7rTiw2RYwZCUsjwS2k
- TLSH T1B9152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 873KB
- SHA256 e02c24235129ac91bead1f12b908c61edb87cad86ab25bf359166474a77c58e4
- MD5 5c43f18228fea5b1a41ab3f7ce5ce5ce
- SHA1 77d20e6cbc9e84dabc1755fa05c181aeea9ec96b
- SHA512 8d6e5d9347036b5d3125b10c76d463b8491b129e16af2d02b2d411cb15bd3e095ad1e5ddea5738d1e49bf5f5e2a4f7217cb80d2a2eab57b29d626f654f6095b7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwST0:t/sCv7rTiw2RYwZCUsjwST0
- TLSH T1E1152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 873KB
- SHA256 faea2b94b3bdeed95e38c65fbbd3ab50cb46e6f15897c203b7871557be175474
- MD5 c0152d20306c9d5656c323419121abf2
- SHA1 a3c6e5b6851824a518f2c93fcbc19dcb74a381fd
- SHA512 de6472d980713c206b7dac6cf85e3c46534b8ce97aa360f3c2a8c69916554f6647d595e402d77e2c25682e501bf43faf9a26daa12f48a75cc2b1d387695a11dc
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSi70:t/sCv7rTiw2RYwZCUsjwSig
- TLSH T18C152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 873KB
- SHA256 fdde06f8d538623ee6a83b96fa25d6387c595303ab05056ae9f2bd00ca993870
- MD5 f63382ae99264105c41b1a1d2789f652
- SHA1 94a29735e3ed9d1b62450de5c7d9b260e0f9b9ec
- SHA512 464615457de9a1f4eeb4c246fbab5ee83659683bd79ba151e40d79b3f349f3d091660c67da0a9db4c8d8c09071d0b9e62f9cca31c8fc0d633b428236b837cac6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSDr:t/sCv7rTiw2RYwZCUsjwSDr
- TLSH T144152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 873KB
- SHA256 53bb8025c5c063057a2b1e679d0b42cb0c70a292c247a8c42d27d2648efe9a7a
- MD5 a57db8748b187c126dcd6f81d965314b
- SHA1 b43ecd3380739be128a99d964e86eec63a12fbed
- SHA512 62005893b1d08bc9bfe63fd19fd1be6f49f8b07e3f90f8ee30d7a3a8d387c914215643a9017496431c71041a1234081bb74fa7eaa6bff40c8b1eb2fea271cf38
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSln:t/sCv7rTiw2RYwZCUsjwSln
- TLSH T168152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 873KB
- SHA256 9a4b94ce7feb33d8fde55bd20b6ab758ae07efad1a4593b6cca23b874b961a4a
- MD5 cec9b31f966b3b47a28975037c4a9b4f
- SHA1 b3e0e8447517f7d0ac253f2cb856e75ccc8b1464
- SHA512 7a3c9ebc6f776ac709c6356c5c9369768123499e5efdedf12a2af14eae609a40d0d272aab904f46f72e73b90208e1bb4b627d651ae48441be33596348c8ab680
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSRx:t/sCv7rTiw2RYwZCUsjwSRx
- TLSH T1C4152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 873KB
- SHA256 3cfc230333de486542c1f88ca641213b5dcbee20923d16e180207325a0dd8329
- MD5 51fa7403dc9c2025f24d1e0600f65383
- SHA1 1967a365190847060a7f287ad21a79f1c5732943
- SHA512 8e2af75fb3aee9ddd3f413157a047d3b5779d8542d74c5e4159e130ba3aaab9814c8b465d069331b73e5323c0354c680f58f46f80f4b6fe6ab636099e9552ff0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS/A:t/sCv7rTiw2RYwZCUsjwS/A
- TLSH T1DC152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 873KB
- SHA256 ac0c8c89aae9177d04933f1863331e740c39937658038fb155110b22650428fe
- MD5 5b66ed5f55873500964469bc4f3495ab
- SHA1 73dd79416e1922887aaa62039823f7e262554873
- SHA512 f9af1d55992e70231c61d770831db4b7217ccbee28bd1421e64ba055afe34823c31938c409025b23f18366742d32686ae6689212247db658da8d2af3d23478fb
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSQ9Q:t/sCv7rTiw2RYwZCUsjwSQ9Q
- TLSH T11E152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 873KB
- SHA256 11e17b9c229b02b99237db81cf7b22743f6d0b3e98da1ec5d2d1ba7868f2aeae
- MD5 2b94ec06e0c2421e7617c5be7fd40178
- SHA1 2f52117aecf7bc63b8ab041a63e019b5d64cac3b
- SHA512 64aec96038a44f99702fb3df9adf01a28aae93775b117c93a3416735bbe603b49a8e067bbc5d8d2b13b94dd6007c431b83b7acf907d92a15bba9d3f2d94f5be0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSx4:t/sCv7rTiw2RYwZCUsjwSx4
- TLSH T1E0152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 873KB
- SHA256 1cb7ba90242471c7b1dae06c80a6e2168448597534ec5ab50e390f3e907e6a7c
- MD5 1834dd61387321967facaf4b8391a25d
- SHA1 52d98442955a2468d29d59a277591d6710770c34
- SHA512 d5568e82f99a93e0299fe2659787374410495e08baed2f95d36fb20befc6849c00ffc936107cda4f5fc84ad8fa2fd2e039808b4f30d54c547d2ff706112d6dce
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS0u:t/sCv7rTiw2RYwZCUsjwS0u
- TLSH T149152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 873KB
- SHA256 e03a1db56ed1280b27505d6d4d0c0a8044209950e0ef4caebfd36e8abf372730
- MD5 3dff6eafc2f6aaf269bb381f335eccaf
- SHA1 1f96cc9d875a7e3f26ff1c92b27c4d865752fd20
- SHA512 62c21bcf8d1a6151639efc5b216ffc225211769fe7d329ec2808db21474463d4b37ef603765ab27968bff2017d3adeead94a2ffd1a2a20c583383666c6df2136
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSFj:t/sCv7rTiw2RYwZCUsjwSFj
- TLSH T1F3152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 873KB
- SHA256 15074a7b34346891bd38642737bb3d07ef8443834cbd538ede741dacea1417b2
- MD5 d0c051ba8607841a85b0deb673208eb2
- SHA1 c8eeb4f94460c20b6d50b4c7aa8a0be8cda6d9c6
- SHA512 a00ff2220c9a0f132bb710997ec65b2bd96c6b796c0628daed2320ef50bfa2242ea7fe54eab62801c86603b7f13e9cee35464e26bf9aefff74878c27473d0644
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSMg:t/sCv7rTiw2RYwZCUsjwSMg
- TLSH T1A6152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 873KB
- SHA256 b2045e858d1b7436dd61adfebb91d1fa9a8f1daca7f900e3c03e776a026ea16d
- MD5 1a358c327d488dccb1716bfbdc76c393
- SHA1 918c30d0598034fccb7da6bfd05aad7a6449adba
- SHA512 84caa8f108faf8fcd9f68bb625cd30cab3f260a9b3dc964384ea06e95a4363e2fb2bb27ae77f5f4029960ca5c9dfd23298fa6f7103b56d0d06e6b83801259b86
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTI:t/sCv7rTiw2RYwZCUsjwSTI
- TLSH T1C9152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 873KB
- SHA256 587824baec462c2d7034304cfe3589e6a503187ecf08a68062ade7bd31d90ee8
- MD5 a21e13394a95150a635e8ac3b99c01e2
- SHA1 e6950e082ef0a07ae131e059358e3d6956f46324
- SHA512 25ca827de10f4f01031ed5b4597dc837221808f5e2fd79a0c755febed551b5d0dfdf1d4c5a5c2f360042acf59e93498ae9aa76a7a950b006ac12f4739c3ea962
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSpo:t/sCv7rTiw2RYwZCUsjwSpo
- TLSH T12F152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 873KB
- SHA256 4583d48b51097709825c0b1f8319a3dbbd6a3c19ebe6a8853fc27eee44712d9f
- MD5 dea9670b774145ccf47884fe96ebb90e
- SHA1 f2f8755911d5fad0987b26ff7ac9a7ddf3b9c39b
- SHA512 3de226323993f9eeca4741ef57d50f72b77acdda81df108a1d7d5a200c580353b8cbcc3cd9a02fddaa7beb3c716a821add749d5baae61eb69dafa2820e0087a5
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSa+:t/sCv7rTiw2RYwZCUsjwSa+
- TLSH T1CF152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 873KB
- SHA256 33f4ced2109d25989f6f6d1496199fa030f1d2fff33d3c1ed80dc808beaeb831
- MD5 aafaae7435546b43434a0e3e4c8a928c
- SHA1 8b423432429684ed60ed32e59332713d08d45785
- SHA512 3edf69b273755de457dbe822c4a3c080d0cac934d56e1a456e82f27dc7ba1fc444f49544f391c99cdb3557f394087e5c561eecab02caac2202839a7e1d0a7311
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSaQ:t/sCv7rTiw2RYwZCUsjwSaQ
- TLSH T17A152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 873KB
- SHA256 f2b1c5d112f01015ae760e87fb4f530c666835c5260116a0ccc4f76da8b00d31
- MD5 792d7ace9a00d2382b4e128526e54934
- SHA1 d38f5779ce662b646119fa00d2e444a232c9600a
- SHA512 6d2082ed2838fb00b8803a6049b0f21d429c3aff4f14ade12750b9155bbaace0098bfd1c356132dc5bb58538ed16dbc9a258e2511e6bdfd5741eb35a573e2672
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSrX:t/sCv7rTiw2RYwZCUsjwSrX
- TLSH T19C152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 873KB
- SHA256 7c2ec206971ff01ad3180b2c112ac673ba281a82e461e8f0975aff1a9cd92183
- MD5 5e90ec26c2be3b78a7e176b5dd104661
- SHA1 4b9d6485b6658fed9b681f55c44b8ba674872f01
- SHA512 62ab1c334429188df40df087927dfafa1ad531b83975ca66e2fddb05f7062367f72d3d310c33756def4fd4fcb6a6c84d49e3cd4e0210f39c41a5ecfa0ff0e273
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS5L:t/sCv7rTiw2RYwZCUsjwS5L
- TLSH T10C152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 873KB
- SHA256 2eb11180760db27733a1b63def5be4c8b7d824cb7f15949995a6b9523a24f0a6
- MD5 218e059db9c0c48fc18b89d6f6cd46d1
- SHA1 db305969dd3581cbeff61bc71e76d78e82ee03c8
- SHA512 2b789a04a2c1060b391f931ad5331eed8fbdd8bbc8e5c4afcb03cd5597b9dc0434f15ba784f3143639fb446b8fafb3b179d5e17b8a8a868bef915e87e330595f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSnFC:t/sCv7rTiw2RYwZCUsjwSnM
- TLSH T197152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 873KB
- SHA256 8d642a51e1c1a859b405ed8f4ba50730e8467b5b449a534e4f8350d3424bc0be
- MD5 e497f31ac30a6f980a9e980216353008
- SHA1 d98f39247cf954b764c44fccd258f027e0a1c603
- SHA512 c8c32a4906c4a6bd8f9b5b714bfc49f8a657a47e6fb87b60c5850aa433775658ef5539e5547a2ee43f18e260cc1cdc426fc84105b76050b8e4ed25c40fee5dc1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSQh:t/sCv7rTiw2RYwZCUsjwSQh
- TLSH T1DA152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH