Analysis
- max time kernel
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:33
Behavioral task
behavioral1
Sample
2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 933KB
- Sample260715-e6m88sev8z
- SHA256 ab5a4d1365f196a57ccbe2ba10b82045b47db18fbf1ac5356027b8db09a41955
- MD5 99100fe233a2458399239bad299cbe00
- SHA1 2f7a0d23329c29e5e59e3eda10fe6408d3cc8b29
- SHA512 eda920c0b0daf74e3bfbcbe8dbc6255df05be324d833e0f5f9dcc05a05ceaee78706930532fb5c48348daaafd2ea01aeb1210e358d426cc71382c91804300e1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAp:A3k03kB56rf
- TLSH T1A0157B03E6850FA4D00FC1749A964662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/1508-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4d2-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1508-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4580-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018985-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018987-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a65-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-505.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-596.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-712.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-831.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-862.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-881.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-939.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1013.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1056.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1100.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4d2-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-41.dat aspack_v212_v242 behavioral2/files/0x0004000000018985-202.dat aspack_v212_v242 behavioral2/files/0x0004000000018987-209.dat aspack_v212_v242 behavioral2/files/0x0013000000018a65-228.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-229.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-335.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-480.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-505.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-596.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-712.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-743.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-831.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-862.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-881.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-913.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-939.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-959.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1013.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1056.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1100.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1144.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1175.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1188.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1225.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1328.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1347.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1372.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1379.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1386.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1401.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1403.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4580 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1508 2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe 4580 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_99100fe233a2458399239bad299cbe00_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1508
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 ab5a4d1365f196a57ccbe2ba10b82045b47db18fbf1ac5356027b8db09a41955
- MD5 99100fe233a2458399239bad299cbe00
- SHA1 2f7a0d23329c29e5e59e3eda10fe6408d3cc8b29
- SHA512 eda920c0b0daf74e3bfbcbe8dbc6255df05be324d833e0f5f9dcc05a05ceaee78706930532fb5c48348daaafd2ea01aeb1210e358d426cc71382c91804300e1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAp:A3k03kB56rf
- TLSH T1A0157B03E6850FA4D00FC1749A964662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 e2962daf5a71dadf42172876101b838825e7571bf6be15338edb5d65fa48a16f
- MD5 35cbe7ecfc09a7928ca0daf076491804
- SHA1 03c5679f7ffd0a4e2a7ab6a19d414b9f4716136b
- SHA512 a0656b5bd8437862f8a5de3a5386f05e35f1411542bec107e4a1c85191b69149498b63aa3c1d4e8f98d69cdc10706dd33bd305883bbefa8cb319fa8fd752047c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAV0Le5ji0hmxNrM:A3k03kB56rLPji0Aj
- TLSH T1FE656B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 947KB
- SHA256 71f3f6bfbcad1f9a2c5deff9a71eaa7da7b6eb06e984a476ddd4ef2fb9f2fa61
- MD5 ff26ea4eefdbae508a52701940fd42db
- SHA1 388e4809d94b5152e4e9c1d2eaa4c0040d070460
- SHA512 d5f6ad7ad1421f84121bade8fdc24a3f86a809fb82ffadcc6fc113e47662c1d4982633d9bbe9a2ec7433a093f690a321ae19f8a299238f1d13b937921ab6359c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA3a:A3k03kB56r
- TLSH T138257B03E6840FA4D10F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 957KB
- SHA256 b9e2453622f8f37e38318345f14596e4be664812afe1757d8e7091119b982b2b
- MD5 f8f75da1689b28e3659454e41991204f
- SHA1 33dd4a911b4777daa2c926707857419fd24a52fe
- SHA512 0476c4e89eccaab569fb84441e786dcc4c0c0314ac7e1414831d9021e1419385258af2652f5d41c655be9bd4de786683b295f8c131f7437bedddfcf0fcee446a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAHZ:A3k03kB56rv
- TLSH T119258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 957KB
- SHA256 f1abcde16936c0b13d5fb53f4d781288c6c51c1a69b02694f9480554f4f8e705
- MD5 497d402c420ad5e2183cbea0299bd495
- SHA1 c9d78a143e2e1522bbef8492ab74fd768d0d9a5a
- SHA512 d3a17b0295293e12ab74e664532e376f2a59b50d26e6c1d91f2b29e96e7764877c43c802803777fb11af55d664c170e9da1792b27333c2a9443dde7c57ba216d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAc1:A3k03kB56ro
- TLSH T1DF258B03E6850FA4D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 a8c9a6c2377d9d0b0b7eb4228d06b8ded1bce77fd535a0763feec6ec7502edad
- MD5 329e995c30181dde5cb1c2b3bb85c449
- SHA1 53a15d37ab3d880a90bcc7958aeffe0fdb512a83
- SHA512 b9052cc6b964bb9569edcadea3f179b71b75c79ce2d963953010e4e65af6136263e92879764b6c1307bf33896fb02cb5bd7528e417492e2250ad00d1d31e8874
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA26:A3k03kB56rT
- TLSH T189258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 957KB
- SHA256 6981e31dcce90abe90f464b28938fc85c02f57346cadeedc7231006b401fd53a
- MD5 765aee86f06dd4d76789013c3ef07882
- SHA1 5324f0bd85a525d8260c0dcd1657db1be7c45723
- SHA512 3a3592ce0b2e570d0b5257794a741e9eef073338b1b01755e8508527520e14ae1b8388688d899c1eacbe74b33c345df0546678ca5c4b6faac73699fa41dd2285
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAmN:A3k03kB56rO
- TLSH T11D258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 957KB
- SHA256 d72fd79d4d9d561308830cd7061257b43e6b5defa9f4efd5b3570ebccf8a64b1
- MD5 df540bb5c5dabd8af76182703b4ba14c
- SHA1 cf41b0d9e04fe5a42ba9952032c017ce3c5ceb66
- SHA512 9b54e9ee524a6e398598f7dd3b7354e5aaebf7c64dc0b0b025441048bffc884e31f6ed6e177a474654d06306aff3869a18b166ccb5f50815ad4ae19e8ed49a6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAkf:A3k03kB56rC
- TLSH T162258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 e4123756c1e63b7ddca20fbcfa607c169a1957b1c54db047939ebfac0f05f1cd
- MD5 d2e070c84099540f71c9ae7e91e5b458
- SHA1 fbf718608e962b4b6e6732bc4d0642b64c12361c
- SHA512 dab6e4fd0ea7240840f40dd3ce3cd6ba932f10732eb40646e59346b1744944638389d243c2b5614f6f35e48d3ac3fbdeee012baaaeca80627315bf6da0c66f24
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA29:A3k03kB56rY
- TLSH T19B258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 feebf030e4f6eaa967dbc49c71162d3b994d964a8b5d4d24676841b1a50c5811
- MD5 912043b61d32ac66ec0b133af2f1d868
- SHA1 02f4c9bea6fc87812f1a69bb75447c8500ee6d7a
- SHA512 f063905f87c88e5f9a58f10619f378fe4fa8ce2d6a1a66d91e0b660461f433179d521d50067c8cbd8348f04cfd1d35bbb01b2b1d100aba75fdcb4f8f8894cdb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA2c:A3k03kB56rZ
- TLSH T119258B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 fd076670b6af1adc43d4f8062cac6fc68e911687ab7165c9ed947843181bb369
- MD5 ef1001e707d24742059d8a99c88ae0c4
- SHA1 628032cafdadda2a25a5db1a68fb84317ebbacc0
- SHA512 c04b9afc80ac3f28691979bbed649f90ef5a505c15c1c9029957a792fa23fdcfc9225b9c6a857b4c04d3c14e12fb62843331a019d4ee6ae7228147213da0ca3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAvp:A3k03kB56rX
- TLSH T1EC258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 4ca503163f3d564f4587d0a1e772b9340bbaf10641915ff5412a699b2c52bf59
- MD5 e7149d7a98a94d574940e10f3b1cd3b9
- SHA1 d01ec7a1953f60c211d65d9f694e2895d7fdcdf5
- SHA512 71b48aed8b2525e740d73b58c0cdb4c76d6bb9ce59bcfa112ebc65db2da4ea471e8e282f947e29fada3b2781a58cd1571914b2d75cc02a6011fd6e25a8a03e45
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAQN:A3k03kB56r8
- TLSH T181258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 8601f424abcfd9a002f15a84710204d5b11a4c3bcf95b626b2d01e9f77e1782e
- MD5 6a820edd878d2c4247f4b6ae93a4d82f
- SHA1 80043fda2cd6543632c9a90c836125e268fe1481
- SHA512 46c57e8becb04e573dc8e037b06f52e747de350eb6fe47aa8fb163e90b5c82f9fa9c3191f3a2dfaf2df8853dbf0039a6909c8fbb716c2326aa8de495c0fedc30
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAYF:A3k03kB56rK
- TLSH T123258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 18de188d531af372466e7647f500ba32e7d530b5bad93d5caa33849dc14535f7
- MD5 5e09c11648ba09d7cba7b5866810537d
- SHA1 12243977187f0a9b27dedc5c41e05ed79f1d1b83
- SHA512 e90df8a72e1200b1d1af15f958aa3f5a5fa1f89424709a749db9bb66cd2aadcae89925da89c8c3238bcfe9e324c7fa1dfc374807c616b1a0bff1c8944bc9965d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyANC:A3k03kB56re
- TLSH T1EC257B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 cce9d87b46780c4d54c84a0fe6c8a03830561b018b41562dd595b2da708f7109
- MD5 98d1dc903eed087a93f92f4cec58125e
- SHA1 32ff84e2bc6f8abb19edb5d2c7e85ffa71b53567
- SHA512 b5171ba93008c94fa2d861dabccdbbc38762edb1947946936ba481efcaae7ebe8754642ab32c0f598c3365b97cc965bf9583a97be3c7a312b82d2f7998414384
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA2w:A3k03kB56rr
- TLSH T1BF258B03E6850FA4D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 9db65a17eed24feaaa70a10c40ab64390acf58b718754702739bb2409547c801
- MD5 7764559a345a254aa353498dad38b331
- SHA1 73ecdf822002907725e44f4fff6bd1974de104a3
- SHA512 d03d0782601336ce9dba609756ec53e1b23cbfa8890e7a9e920dec2235df57a6ca02bd6d88579e3b170b7ae66a860ffa26535d0d263f66ee4000c81bff5f87dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAlT:A3k03kB56rX
- TLSH T1E5257B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 6f93095d904c1062537b381247b5b134b765bb731b7a1b73f9b77f474e649952
- MD5 a05498045d222486188ee50b5321c5c9
- SHA1 56ec9bad2120a1cff3528ad0776992719cf98608
- SHA512 b26e043f92fd7403c72447fa89cc3356a7439b9e9fe1c6cf6c6707c728ce3a2307604c5ac1874ed1608a3ed16100dc0c4f0073b3c059a56a1c49c96744115dd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA7u:A3k03kB56rY
- TLSH T1AA258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 0de22d597145e1f2d542773a1a46281b51bf355f202b3b91d2b9d36543a73325
- MD5 c64a8986d6341d2b36474ee8828f1a7e
- SHA1 4ebba08ef9261eb570e4208ec48274b7fe30fe5f
- SHA512 a5618656b955026d15c465872595ea52c0639c631405c8d77dd83ae446f92c643aab7a3cf57691d3384e0d7b92adf891d7182fa2c3dcf7c33427c7d9548013fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAfb:A3k03kB56rB
- TLSH T111258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 b65e030ea54966bd67c220350b11653dbd3f4d216b8030ce2daba98c83cafe00
- MD5 26e520aff0f370eb1587bcf4e9e0e1a3
- SHA1 e068051606ad11d331218c092a386af5379c65c1
- SHA512 671237e63bb460d23fcdecf160fd38310a0784015be2778b679dc29c2d7ca44c04d9aea50413c4eb079599e6eee828c108f03c7e36e02f6ec423ceb30d3ef97f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAbf:A3k03kB56rB
- TLSH T186257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 612dc3988576d5994f04b5b487cde84678a0406f5606487efeef4e997d3c9875
- MD5 8d4c5ee303d5183a518f4cb3cbaaa712
- SHA1 545eca7e96b27a3e93828ed66f1567c7ce2f4a66
- SHA512 e6b5fc5473e511ace5803a301202c43d6d191e3dc3d86384334a3ec50b2a7555191b9d3b8e427e9909d873ecee0e43fd3206074d27a64499566319147304c3a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA0K:A3k03kB56rZ
- TLSH T16E257B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 4552869687fd25f2b9b1fe392e21f79d532befc2d78d39f07c1f38edbe851b9d
- MD5 6c7d3c8f541be21824a5b4437a92bb63
- SHA1 2b025746620470ea040b6ec6a40cbafafc793c4d
- SHA512 f667fb941b2c215838769d39973da32b55eeb0585621160cff65369b500a150cb3d6373fa80d27c2af0817cb9ae021e50779f9ea4f17b5199c22758db51010dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyApk:A3k03kB56rQ
- TLSH T189258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 a8096e11420cca6d315b662261f0c533580c23198144825aa08359024dc001a8
- MD5 f8030878dbdb4383a876dfa736ba2406
- SHA1 0342992f39806206a26f873ee76718df4c0ddbe6
- SHA512 6251b53c9c7258f02353f78d18a46b9d0fbb2c2e46cd4cb69db67f7d481d7152a1588ce18d81dfde037ad74ff90fc489a3b36f273c7678c6e580b9566cff85bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAG0:A3k03kB56r5
- TLSH T142258B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 97a1dafce9fe1bc571ae1c790595c7ccb8fbe81e8d45b2864f7c8095d1421f69
- MD5 312fe60c31c176504383df0afe2f0309
- SHA1 69235734e32330c1cba1be69c557bc2c58e73f50
- SHA512 541cb8f3da96f4d7dc58a752b4d136d310483f5437a4f61c401c5436fd7bcee8ba7068c56265e9b7cee8288b3c5e4b92151f9557549734b1fda96bdda54b3f10
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAVg:A3k03kB56ro
- TLSH T10A258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 58ddc91fb07a49983c9756c010e443e5f02e696dbb36d9420c40a5a37588e7c8
- MD5 be50da4a387a46f4e22669ecc186029b
- SHA1 ab87f65d2d6cc7d4997fe2effa6c365595d7033c
- SHA512 dbbb44c0f150a6d3e491eecc603c2adcc983cb8616757fcd9ce75f898f0ea7c799e82b2cd5f9b3e474402ecbaff3f23ce204179cfbae0686222b45e0b949d971
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAkr:A3k03kB56rS
- TLSH T12D258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 ba92814a9cb18e3fbd0fc51ca77212d97b618de2045adaffeb290c869e75cd84
- MD5 8dec2bb7adc96b1ac421eb5bbd978900
- SHA1 1d8c66249ada4b20396925b90cddbc63143e8ac7
- SHA512 ced207eaaca7aa5be08fe6e2b1a4c2d24fd29da1f7bdceb30e4ec67bb71fbbabd0177ebe0e478225c738185543015b6dc9f76b4b968dce14144179edb3bfbb00
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA6n:A3k03kB56rE
- TLSH T13C258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 2f621a619076b9dad1f179106039702513514da5bbfa03a591929b22f4ab727e
- MD5 0d12334e0a9149539da1f0812acc4f10
- SHA1 75dfe85718e785293a335fde1f1d3f18183e4556
- SHA512 6602aaf8c57e543eb5751cce6f944c110945b4c37e7b63f424b94bb82a03b02d022ea55bf2341ba4d1a9edc9a0b3fb3cb4ee5344377487286ce12e0d89ddea0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAQx:A3k03kB56ri
- TLSH T1CB258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 7a836592b31e3ff8d2d4aff2e10a7a1b6c5d733e7f1a5a1ad7fb2a933c394fb6
- MD5 53183c8905ada614d9d52dd0873f6804
- SHA1 be5b51c1d3e9217cbc47bb47c8dbe398dde663ba
- SHA512 f01af6a31c9780b7d386856522d86cc0a5c82f9ad8f63391f46801c75247d87785cc8ec61d668857bf6dbb20df5fcc47441af8c97b6500be9a2c88febc3dda31
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyASA:A3k03kB56rB
- TLSH T134258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 8b81316a49faebfd6c3a07979d5dceedc4d5df719315188cade8f00a1abc2563
- MD5 0b6ecb2014c1512f246db61961d192df
- SHA1 57168749398b151a40a2c680eb1cb0ee56adff5c
- SHA512 ddf7e27de135ccd6eb534c12a9fd869d10e6f6b1ad2895092e213b43015a724ad82d62f652fcd2cee96ac6cb35b3cba8794b64e57128a219a52e74fca1d17409
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAr9Q:A3k03kB56r4
- TLSH T1F6257B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 4f4c1e0a4d752205c5fb505a92a2df9ab3f3485a9d1c9b66af69122fa0e56a59
- MD5 c026c63c0644d4f0d1c0d687a1e9715a
- SHA1 0030307271e4ec3174d1762b6cbbd9d1de6c72a5
- SHA512 2b72cd6dad47897558e18bb5c65e8f7d3130c8d1b3666814738c29f8f3eb9dc474bb2da8e1ac01c77c361299b1dac31dc2e5d18642e0d1968585658a370f4e0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAa4:A3k03kB56rD
- TLSH T10A258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 81348df449512c1d450d525595f60ff48dd6a07a332b5c6078e1438189667cb3
- MD5 ecb9c6525fab2d6227c303aec0c59632
- SHA1 12843e31958435e914e138d24b4af6a729777101
- SHA512 76488d1b996e0e31d48803bb6ec3673a441527c645bb95fd9cd7be8331afd5cdf8eb6c69eac406e19315b9b2aa697b8a8307cfb106fa12f4ad2f5b25590be8c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyABu:A3k03kB56rm
- TLSH T181257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 88b9ece6d7e30f623e4913369e9ce3c0fc9d277007de14b89bf0c1bad3e3357b
- MD5 ee60e6787a714074bbe60b1f18dfba66
- SHA1 d252574cf2e84d09e74e56262c7f6f438a3f6ea2
- SHA512 379700af0e340cd1ac02b18a91c90eb9a73d9051045d4192c65b10f76be92eebad115b45220713661a985a3db5ca4150ad39eb5fe80654de18a3d1ae46383c92
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA0j:A3k03kB56rY
- TLSH T1E3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 c325cb3b1541b47911464d8378e6d38f5b760e5695dd28158f6c3d85d121b33d
- MD5 02a6e0466f7c2d7752ad433f51482d78
- SHA1 f679e3051aeb99e1e2b9252463fb30d6677b1eed
- SHA512 9437daca7c64339e0d306d4272e04efdc1e5a5b5d7deef49cfdca637bcaed28cd594aad4ca91281dbcf050107e4ea694ca64997c55e2692b73aff155fd2250ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA1g:A3k03kB56rg
- TLSH T15E258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 4a9515c7baf4ce1f0c3815b8c738202d0048b9b96a588e308d310e5eb6b2889a
- MD5 b9e33cb74757f373e7d739ab4d5c7abd
- SHA1 bc216c23867afc63235e6e41e6d96d5a15407850
- SHA512 0898964ebcd96314960f6905dd367967a0817d19c2ab8fed73a48ec3f3953ef2173bebe7e66ba8d74c3964dde88dd4c5550994817bab251de5ca0b8a7cf5c346
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA0I:A3k03kB56rh
- TLSH T14D258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 77e5f3e019b207b284589a244e78c792c62ebaa7d8c04bc62a36845510f807f7
- MD5 3b644305d3f31568f29dcc6db39a1440
- SHA1 53b7a09180cc895f4a25a9f71567abea264f5305
- SHA512 275bb78277bef46d0122af381e3c26a8d036fb74eacdf8163eec65f6991f6723e1576fc9be1b712e5407822dbe34fa57ea70646695e73c215f0d4bd7b1805d80
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAmo:A3k03kB56r/
- TLSH T123258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 b89cd0d13107970751db1e680c9e49f1a62af11d7a71ef6aa446a840f1075842
- MD5 0b219e29c2c1810c68fb25a0121b5f3a
- SHA1 3ce5a5a315245b2489091ede688613ad9dc8dfd2
- SHA512 69f495352f16e3fabc6546935602c714ba03d30735987e1cdd126e60021f0262066eb8fe76505e6be8a1ee33220b1a2e14f7b7165381c02b1bd98def0e792af2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAN+:A3k03kB56rK
- TLSH T1F3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 cfe2d88849a0ed035d1b9e85dcbac8eeb84e0f66767916b627dd5e93ea76cd19
- MD5 704f295840998e50c4a3b32a5d1ca0ba
- SHA1 00fab74d6928e2b005b2847d019a86c79e16f8ff
- SHA512 a4dea523c11954175274ddc6f058fc0e1a698789746480d574d277182a5471b2822db048e01b0eaa7838f62536afc4d4b4e3226c5da1ac01e4e0e4fc2de682c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyA7Q:A3k03kB56rO
- TLSH T195257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 5cb64e59122b14da189c4bba2cdbce91bec054516539e86ea47493c5cbf4684a
- MD5 25464b64edc3b7710a6a739bf125e849
- SHA1 6055c2ce3c5c38215e59fdbcc872fae4c74bbe55
- SHA512 e5e5c0ab90043a6dd14dc31c1e2a019e73c9abb3f79ac8d1b96330ccea7895def4493233886af637c3c14ccfdc251b2b4e09748822d8d2c748ba96bbe2e26dbe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAwX:A3k03kB56rO
- TLSH T15E258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 a1488cc5644d7f5b8547259564e9abbad4a24557eef34b5eeb84d47f871c457b
- MD5 be2f5a0582ea328fcf0f5a31ebd3b48e
- SHA1 f1193b4a992c5b3f370d70224157b2c6282779a2
- SHA512 d094edd48321b9a18cf2b46a122503238e1f9bc79f1cbafc88a220c21ad3222415f5635bf5079a9abdbbdf0e72df573235c720ca55975612061f7fe0f233a93f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAGL:A3k03kB56rg
- TLSH T10A258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 2930098b9828f954b5564fa2a57aa220bcfe3954ea58f2ff977921de40b9a2ec
- MD5 06d7949de7d52bd7da95bf36788a540f
- SHA1 f06b0ec4f7b39084b7df282b12427b8ffb86e220
- SHA512 fd352c3bf7aa08e41fc527574cac5c1f81b148071bff3a3e99d8a376ab72d6279f395f5a238be87f6810d77b0130399c911da3e11a6dd72f9c2ee0a6253cffc6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyAaM:A3k03kB56rx
- TLSH T1EF258B03E6840FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 5883c55caa64b199b0f136370c1fca78f7a075c96cce0f12547d437c253436e1
- MD5 b497f55c07f00f0c326256ce4405e71c
- SHA1 337aaa41872290c3b77558bbe3258518e9cee312
- SHA512 4feaed9274eadc4764f84a4aaa7e45bc90deb316dc4c3b1cead2d172084f5263526b47f1a2f1a6927cb33953ebfef7ae0219433c29dfe8d909ae6794a3637442
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyALh:A3k03kB56rD
- TLSH T1AC258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH