Analysis
- max time kernel
96s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 10:06
Behavioral task
behavioral1
Sample
2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 933KB
- Sample260727-l5bmdacp9w
- SHA256 ec14032a0cf8d85d3eea2564061e66f11ebb90caa77debdf6e2fe317a3b42ae7
- MD5 d613a0209b0b6342a29eb83061ca2aec
- SHA1 0fa75b8085ac515a0ce347bdfd7297486ab9d61e
- SHA512 74536a7bc9a0e99c7eb86b2713f8d3e312b56e2d6aa70c7f80d95ba1988aeca000722a92e9da2261420718ea773d1c73e6cd3adad8d0fb4f14c7bda135134377
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9M:A3k03kB56rp
- TLSH T199157B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/4996-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5f8-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000008f19-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4996-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6920-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018965-200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001897e-255.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a42-328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001982f-473.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bf-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-589.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3f-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-711.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-824.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-951.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-1088.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1150.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1402.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5f8-5.dat aspack_v212_v242 behavioral2/files/0x0003000000008f19-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x0004000000018965-200.dat aspack_v212_v242 behavioral2/files/0x000400000001897e-255.dat aspack_v212_v242 behavioral2/files/0x0005000000018a42-328.dat aspack_v212_v242 behavioral2/files/0x000400000001982f-473.dat aspack_v212_v242 behavioral2/files/0x00030000000198bf-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-589.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3f-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-711.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-737.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-824.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-919.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-932.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-951.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-1051.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-1088.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-1137.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1150.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1175.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1182.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1231.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1328.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1341.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1372.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1380.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1401.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1402.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6920 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4996 2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe 6920 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_d613a0209b0b6342a29eb83061ca2aec_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4996
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6920
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 ec14032a0cf8d85d3eea2564061e66f11ebb90caa77debdf6e2fe317a3b42ae7
- MD5 d613a0209b0b6342a29eb83061ca2aec
- SHA1 0fa75b8085ac515a0ce347bdfd7297486ab9d61e
- SHA512 74536a7bc9a0e99c7eb86b2713f8d3e312b56e2d6aa70c7f80d95ba1988aeca000722a92e9da2261420718ea773d1c73e6cd3adad8d0fb4f14c7bda135134377
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9M:A3k03kB56rp
- TLSH T199157B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 81f780a63b76ca2bbca26545c8091858e636e366ea25d25b24f44cb3162c1768
- MD5 885b65befcb7135f04e97cb2978ff505
- SHA1 8ae794f8c9d65a70c93f886ff4d1a185fce2673f
- SHA512 6c70d87d1833f47ba6f99a3b6ad9a1b265e731cbc8ee690edd62b71d132f7d7c01fb223b28d129ea35e7856e0714884f33c8b73dc5940cd0f98bb3474ac3d096
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9U0Le5ji0hmxNrM:A3k03kB56rVPji0Aj
- TLSH T126655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 947KB
- SHA256 47105e75b4084bde5dddac14d3a25f619ead99bffe71dfeca0d9b82c43b0b3ad
- MD5 65bea1813a3edb9f2ae5c5b577d116c9
- SHA1 3f888c544cc80b23805bd2235f3829f51c0f1902
- SHA512 c2baf4402f36db2d1014bf6589ad6dfbeb59124a7fe540ede4f0c182727621da9640f80710d6062c8c966fde0be62ebb4de75578fffcb48d5f1f3062c73a053c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9ea:A3k03kB56r
- TLSH T125257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 957KB
- SHA256 83889ed52e813c159d35d40ca54aadf8fc35a537eb8606371b4ec8b8aa0dcff1
- MD5 594a96e8e07b9eb41d5d9b673569e2b2
- SHA1 6c18201bb6aa311d7bd2129e2bc5ba872d26bb0b
- SHA512 2511eaa2796f3af0f0fedb6f0e3f62322042564a3dd9a658bdad26f0b73f7facf42065f0eb0f061b1eeea1045f0c97c6eec3e401bf269717f9f8f263edc89e9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9AZ:A3k03kB56r5
- TLSH T1AE257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 957KB
- SHA256 9082ddc87672f9fb3510f2ffe43fc04629a0c27382478647b08d5dbc449d3172
- MD5 fe89a37e9d4125aa4947b392c738e2d3
- SHA1 1e5a5275bdc1078f583901a96b2e393e04dd6281
- SHA512 3aebd43e4b296c61ec6e3443bcb890b51533964dde9c7942267370a1d02b9c3e7ff98e0f5cda315f4a256910ee63b553e5a1e179c2172814e87d97a7929bd261
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9n1:A3k03kB56rG
- TLSH T1B7258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 6f8b75d4393d695a51903993753ab32b2edd0a6aca0bb5f5426f5f524eb36e43
- MD5 d6293056cd5d3fdd831a50ba844249bd
- SHA1 7ba57311afe60dcafc812a1b8b63a998872ef28f
- SHA512 58a236deaa4db8323d6f1ddfdd93088a2a12a2edce812bfdeac868d32d359cbe5bc1cc18b5149072ca3aac9337312321ee3baf58ea97b6e9a635cf15eb0f3be4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9f6:A3k03kB56rR
- TLSH T121258B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 957KB
- SHA256 749753505de2f9161ccfee1ba92bf97713f1de7682de250ccbe9406f6126feb7
- MD5 2a09a5040f1ceb032e2f2b757b6007ff
- SHA1 0c967bccf9bc7efdc897b7a2a06d8b58a7ec8a09
- SHA512 de01e90b25adfb8f1a8dd5d32ef2965f64de17a29e57809a8d66f3932d1fc27486b12f54d9dd878c8686fc8099327f91365a1fa5e91de3391c0a8376f6ae745e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9BN:A3k03kB56ro
- TLSH T118258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 957KB
- SHA256 b6cbd7f440c4ae4177010c8e6cf3fc6c1ea3f47b22ad55265815dcfa1b598656
- MD5 3a12bed716721bc74ae6dfd6a1fa3bf8
- SHA1 802ac051cbe7df2835862715d35ecc6b870b05f3
- SHA512 10df6957a1f3bde5a5f5b53288fec76381b0b350f0ba7d95a2b9cd04dcae288f433f0bd9be97f9a71bd7a440dbac04fc977eddfa52e92f41b1477f4f171a334d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m93f:A3k03kB56rA
- TLSH T1DF258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 5dc6a5b0c0f4ce3036d3a48ceb0d746ed2e0573a1785cbb64e18c2068462a3be
- MD5 5d965b7bc897ae1c276c12c7fe9cdd9b
- SHA1 ec55acacd052556af3a911bf93dc342cb615135b
- SHA512 8515f2a6f7f2b6dd78ce4dcd6eb92b42d542f84b6156c6acbec6903d466d779854d90d1e86f0479cebcc989955f7be4cca74d071f3d60f5baaa87b8b5890ccb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m95o:A3k03kB56rN
- TLSH T1FD258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 a1507e12c6465c830cbc120989bb543283702ec299faed43713f4c98588e309a
- MD5 4f0cdd442a5419fa4c4086ada7c0600b
- SHA1 c7b39d849c889c06163bdbb15b9933b34255d0da
- SHA512 20cc9fbf2e86cd25299146ee939932705d6945b6eb43a453abe021e30b0cc4f00e568edd24962a6846848f8baea13b32317f310db5bb1772de68fd9d5ab953a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9pu:A3k03kB56r/
- TLSH T1DF258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 ef2b78364fc13c6132f46e7c0cdf5955a0da8c435603069bb9443897b710fe38
- MD5 5be1b5506324b4a4a8d40d8b167079e2
- SHA1 39de7e524612dc0794a9cfc3b09d1333d79d3dd7
- SHA512 3c50ac54bae28a1eb3e619c446a79f330436ee20750a828b485bc890302ab54cacc6203575ea84dcf4f0b2a1fc4c5226d27c87beb0d0ae5687b6535ae099cf65
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9P9:A3k03kB56r+
- TLSH T12C258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 8147450c22cd931bdcfea922fcdaa13984f6c50010232c7268bd233044c0464f
- MD5 0f2ed1947bcefa323ac296a7986bcb0f
- SHA1 1e117498c03e42483c728cd9e65bb7d29eb4adda
- SHA512 b2be0a6ca92e314aca57f0014082cf21ef23084a1c2dea62980ee0305ccbfd307f8dbeeca9570daef57075c459002b3a104a9aa0021b69fa1915ec0ef672f9c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9rc:A3k03kB56rT
- TLSH T14A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 1edc2792393a01532c7aa88131ec7d20ecb838f88754415b672d5c555158fad9
- MD5 79a488bbc9bd8bd231c373e59a0cee51
- SHA1 f577741999a90737d5d08b950cb37745feff1bfa
- SHA512 439c5380be10c8e73e0df60742bca98488338630e1d6f6b743eb3151b031304ca91a8f7fb18c74a26fe365f332f33034500206910707eee21785c4a7e3edf001
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9Up:A3k03kB56rx
- TLSH T12E258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 034f64a8861eb3f422298a141fdfcc72994c5f306d3bed1a6527685c8ea3573d
- MD5 1383cddc768eac88921e87ef3e156590
- SHA1 ed1d3f64c1879b0cf029dcecb3731fb64b050049
- SHA512 85519e1e2788dc5ba7e5a49bb8324e739ecaabdf2eb3d21fbfaec6e82e838d7abfa766d1fd3c356d255dd7f51078cda80193a95f23faa751206d5643a2e13e50
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9bN:A3k03kB56rq
- TLSH T1B2258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 fb9e797266c8a0dd34dfb8f6262203e03786146a19f57a9937cb3c05876dff16
- MD5 7e831bf9c973cd6a297f6365e040d71f
- SHA1 898316a0ce53b53e2b4d43513716c6a92559cbc6
- SHA512 25f18ba6c453f41135525bde88b4917b1dbbc403cf3b83ad515506956528b1b87430f5908f9c8df6fc5e111a6518716ff026fad9caf1212c63b8996b6fda1002
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9pF:A3k03kB56rw
- TLSH T164257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 b5e21acd53315bfd1453333e89e4fd7e8912cf0c582bc1451c5b219c7fe45c43
- MD5 b4bd422de0aba5aa526dc13a6872add2
- SHA1 2b365dae44069d66cf0e0f131b44ef1b3d18abc4
- SHA512 76914aa7a51082634f4208e15f24780e561f4903a258254d64c22ccdae9a5748bd8632194b1505d8371236794bae0d834199eaea884a0aa35df716b601a08bc5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9CC:A3k03kB56rE
- TLSH T17A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 a7fa3be4fee4b923f8f36a73dfb3e30be3a183eacf8e44105b598e75e1d66519
- MD5 30f69bf8d5431e555d52fbea0fb9fa2a
- SHA1 b7bbdf6a95f4de8c9f1b8794c0b9f2f889d44718
- SHA512 1aec5292931acff1e84ca26860456845c0703fee828f88f47d80acdbd049e8ed3302859a68af5b0561bd2b3be69602342b4ab1b298eb28c3e4359570380cd2d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9dw:A3k03kB56rZ
- TLSH T118257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 21d64aba263a864d956a03e4a44d92b7808ca0a1756709c84853ed0862c1a693
- MD5 43d5a26c456d1c35ff26459970139f9b
- SHA1 aaf52e5d26126968977587b6c5a1755a3ed056a1
- SHA512 01ece3e025ca6c6061fb2b2f74cdd9ae4b6811340075fb6e85d9190031e7cc7ee73feac277b0aae83479a68b85c2ec96f9a5cba05298e4db814a465206ca5ef0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9MT:A3k03kB56rN
- TLSH T1BD257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 48d0d0ddb92d3f6101b40d8da2dcf7cae0566e32a355efc7b077b2bb08c608b2
- MD5 de6cfc5f61a467639d3d909106312e70
- SHA1 c1dabf51657e635eb017cad04e4598acbc30c659
- SHA512 9d839e10e1ac008980d7071763a11c33e46cd23e2566e712cf6893262b22e76e7b2b7e9511786ab7303d594f2377b4b232f3cf3008256c4be079a08d3967a31d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9gu:A3k03kB56rS
- TLSH T1A7258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 347a2d1f847813d2c4ce3421986f0eced2ee10faa89ca5c9b203711afdb67157
- MD5 c0492f8c81022cfdcda06541b62085e4
- SHA1 55bf8417bb1f729db6c63debff14c3bf154b4a5e
- SHA512 392a9e84d27651743e24743b897e8498ed4ae31e90b4994fe8f3ea701421824c0061b7353d4dc2a1f744f451b150d49d6f64a693352a0e7b7e11e108eafb38e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9+b:A3k03kB56rD
- TLSH T16A257B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 a180e0cb7c9debc4c0ea4c5134b998e1b570312678306c0ba7000e7ee7b93e3c
- MD5 a7319e44f69a6daa95a2710d511a9a0e
- SHA1 8aae67273f97e31c630fdf211a9fd3f0ccb93ebc
- SHA512 86a7388b66de5b1412d663dbd7c6672ecaee9a0d5104be44cc8ac828c2fe1638869214972dbfa53c1f5f2ced6887efb4c092670a5e1d4b7936ed2520b37ce9e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9of:A3k03kB56r7
- TLSH T19C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 ba4ecd61392a4e8b1664a1fa9e096193174630436bffbd9c6b45a4b57f530321
- MD5 93962146a768c53fdbc6ce6eddb393ca
- SHA1 3af1deef304a18ddbea34855d2fc71ad35bfbc99
- SHA512 0074fa97c4d301d15201e79de76bb69d188d846fa1329bb17a42aa51260c80ab80d33beaf57979e458f489e9a6081ca135296d0c78e0ab58bf5c4f002c40fd5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9FK:A3k03kB56rr
- TLSH T15C258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 eccb6cc0d22681bfcf0f4f27d311da4cc9a1a871f35ae145508cea61990957d3
- MD5 a4840451dbb18203b47412929a5b7532
- SHA1 8fdbca478f5d53f0a879d8253db9696d3309778c
- SHA512 0ae5e3439d0ecc994c63718487c48309e68dc7f76a3d5788a37ec951941327c161a15a3673380b0a88b0137053339a8e8375772011765746c90d01205679d066
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9Gk:A3k03kB56rm
- TLSH T17C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 fac72be2c03d96fb5dcc81c28331f2252c23e2ad38c8a8dd451d8ad1b0672590
- MD5 7730e94f1ba173c24f0aa2f4ef3a9100
- SHA1 3f235b934252d9c7c4bbc01b7e5cb1108762a7de
- SHA512 8561dd1786ac9398e19a122f49d460512396468ad9195c1907347dcba41d89f4f50cdb1976359a1bcd5a0613d6d6eee33078b788f58d70ae62f425bfdcbabf0e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9D0:A3k03kB56rb
- TLSH T14E257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 c624aa8f9c76c93c058f10b1a717e9a5dc98ed4aea50af9de04322b17b70362f
- MD5 b0a26c93597ca14192069466f4884a84
- SHA1 8caf18d711a7de319fdb2a781f904bfb2736b062
- SHA512 c08639dd5809a4b7445564bba74241aaac25d9b14b320281010829613d628057a92629bcf40c39fdd0a820290678461eef51d62099a82510ea7673819c48fd37
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9Sg:A3k03kB56ru
- TLSH T112257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 48aea5ba2685fed9cbddfd8777bfe79f1e43c48d3897e2e16fb4bc049e676722
- MD5 f1aee0d8b83581d43398684eeb7ec261
- SHA1 9f59fbe34674cad861170b67df7764670f1fd794
- SHA512 26fc2fefeb2feae17f245d7cc89da30c211b4ba533a6a6d3f5d3d2049734d8da8a7d48f4760a14c71c34a996c2da76b6e05b7ebcc5e77dc38051815e463331f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9zr:A3k03kB56rw
- TLSH T126258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 ac567063744fe5b9d9ba47b5a9c0d3aae402718149316537c411c29975571311
- MD5 9785fe387b044211fcf80e8b0a980eaa
- SHA1 72c55e394ed3503674df5946b806acac3a08fb92
- SHA512 03fc2071922634c72fa85ef553dfdbb5d70bff799327ac8651e20ec9688fabf5b0dd26d1a2fc5e3edf00f8f8de5da3751ec2f2e30172ea38840f9ece768fd05b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9Vn:A3k03kB56ri
- TLSH T189258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 5f610d7b2bc59e98e6aac753115cd47113ff58f1246b3373b7eb7a645198c7b8
- MD5 6a4927a463294bf71170655c3df0e5b0
- SHA1 c16c27682b21470b926dfa0d0e70cd9abbe53c7e
- SHA512 67850eb8965cb03f560e8b63a28c91938a0f01945c07de2b0754762996a53536069c54d686513bda7f480b6132f5a13b9e80ca9bf5dc80aa08ceb69fa715d555
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9hx:A3k03kB56rQ
- TLSH T185258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 e687051723af6e338c1df7bb3a2300b6d933feece6e6951489077163e98690cc
- MD5 61237f9e2dffb41240ae32b86e9a941d
- SHA1 3dfacca453c2b133f7d4f047c59e8e1adadf6b4e
- SHA512 6b66be679528c56df2190a21e867ad35c2b2f93aa75c080025fc318946e1eb1d2abb46cf892d795762866f1cc1ac839d8cda9cc7d8895cb8fd63b3d87a5b3be3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9PA:A3k03kB56rz
- TLSH T1F4257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 608f081cae82fc7b3cd3e995ab33570dfef2ffd3ddb3ff6baab034de958ba6ae
- MD5 8be74b5065ebfe0b7e68fe1b332b5aa5
- SHA1 059433673346cada9e5f918907ac8f92b18c339c
- SHA512 377d80fe285d4f6829be835cb6c62eb51500f9ceb9b3d3102e3ce27d33ae06634ace4a4e3667837f466fe169efa26bd535ed38031a073eac0ca61cc321578aca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9A9Q:A3k03kB56re
- TLSH T1E7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 97b123064c063c97b6c16dad1b1cf3dd1d4e858be62cff143af8c036ae87707e
- MD5 2956467f868bbadbfcf7c8dd2ed4dde4
- SHA1 4b55018331bdde8288d60d68ac1c6838280464c0
- SHA512 f86f65155f9f6aafa89630acdaa122ac11aec5ec87c96e758bee9425f65f28c8dbe9df738e1604787a95bad36d33f7616a85b07ad7c89d40026a09e4eba6d0a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9B4:A3k03kB56rd
- TLSH T141258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 3708a5342f842f478f95e8f6f57fa34cc62aa759b13f33a269a8d84750181c6a
- MD5 986d7d191ce54ff2b564495e3d39ca95
- SHA1 e00c0df61b886c31fe220b6ad57dfdf97507862e
- SHA512 ab4a73470b51544dffccf46600e7be9d56f543c12aec48da82dfb0aed4dc69eafa14cce97760a94d64ed74bf8a92bc5be45c95cdde5b33ac079b26b771ffeb25
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9ku:A3k03kB56r4
- TLSH T14B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 5dfab9b5d06b5132231bd4d65ca08a4b699570d3f8d23ff8a589651e36effa44
- MD5 ae31c51278847552ccfb04d8a4a1a633
- SHA1 5f2aa86f18ec3c133a55b3b1cfd51d6ead243297
- SHA512 8cdbf53bb5a05416382eb428d373afd8b88f5d52b3642c503581c8f00997a81321deea4fb2166a03eefd4d1b33a116195933e29915b7bd2111e58e826d899374
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9Vj:A3k03kB56rS
- TLSH T1D0258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 01a17420add8dd174f4e7037a257419f92dd954ad9656f6457bfb3f356e25f81
- MD5 2749ce7fe9031aa4da22cf8adfbe16bd
- SHA1 44b3562223d32d87b7c7d40e243db14155de7806
- SHA512 0be97f8b6c306846dcad6187186f3fd1260dd6a5f87a371d27c83039b41eb3ecf730335fbfb93f14b9f085467933f7acf146760028a70f7336583d7b8ca32d24
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m98g:A3k03kB56rW
- TLSH T10D258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 f8beb07c0d6a8e4ceb88706f6174d35e8970f64d10393e8d44dde1a729298fe4
- MD5 6e295936eb11855b67322b6e137558a5
- SHA1 63cbc1cf4ad2478393385ab79da9f03daec3af1c
- SHA512 c1602d7eda26dd91c6a321dc701668455d87aa759fe3b85b4c059a305f454f764214365d2436333f7c3c280b49870607a7f33fe9fbc2a67703041c4f08f040f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9jI:A3k03kB56r/
- TLSH T1F3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 ee72a79f18062cfde498c68b1494b2066d446dcdeae823bbd850eff91d193c28
- MD5 5bd11c347c24fdfda23ac3fce70754fe
- SHA1 269964bd70f5527ca17ac0ac5eed74fef433fda2
- SHA512 c14a96ebb676bcb1c8953b9effacacbcdcdbe5e05201f5043dd23aee9e343632757911b2eb3a30f0518bb4f658e7fd59158e5938471e06f4d177b9bcc9d9883d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m95o:A3k03kB56rp
- TLSH T1DA258B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 b4d7696dcf770ae3d86ba58a246a938a38b522fe942df0b67fc053d3e318dab5
- MD5 88c76737e6da505412b6c46f3e0e9563
- SHA1 ceed2ddcaf06d3530a304ca970ceecf4d5f02d6d
- SHA512 7c7e17b2dedacda5ad4bb6d0393f39649584793c853908aea0900176726b9aa9657d477ca06e6e15da03b2f0e5745e01d0e7337f0c8558751b04f2e5ee772a34
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9q+:A3k03kB56rM
- TLSH T1EE258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 7aa3183a8ff765e8e22bb9e6c9e38959d9d4975f5afa701145ebf37fd5ea1b43
- MD5 513a57134d5a9dbd0fab41190723c43d
- SHA1 387903bba40889fa8c1b6609d92de2cb1a49fec8
- SHA512 90056758d3dfd2b7c32c4a4cade0edc0c632b5158a8dfd854f8b754503b81b02e44ab922610e03fb0d318d8929466c3d5b7b7895c1fa21bb189ba6e72573dc52
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9qQ:A3k03kB56rk
- TLSH T107257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 e7af3e7bfc503404d9dd23385c56405a8788bed8f1f4c794463010e421d21239
- MD5 7ac07eb1c26ceaea62012b4f4a83eb0f
- SHA1 d6113e27cc52957cb15985d335503ec2b6fefcc9
- SHA512 98b3681d24248a11cf2b8008aced9c7d5c88a4bb74f685c317322b1aa5495debfe2401453bbe54ec8dab3b1645904a54b40b64018c647c6d6699fca25da075dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m97X:A3k03kB56rE
- TLSH T1E4257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 7bd9817e167404df882fef6475fe34b18378d8a1549b950e7100c9b5bc1daf67
- MD5 c2fe0eba04ccfad931ec4748283a12b2
- SHA1 28940fe267c056b7627d1b8a9bd5b73d7b0d95d2
- SHA512 d744352b93575d3de19af4c86f159b4a5c7219478468920df2d4d5e975a75e1a334173caec75cdbe33a1aaabfe0489b8dc44f04db5876e089c627da82f0b2849
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9pL:A3k03kB56re
- TLSH T129258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 b90a953d060f7bf568adfa9f031de97439bbb9ec1121af12c1587c02094c2a6f
- MD5 079b8c4974c269b324ad5215d8ca7cd7
- SHA1 899118428d3991f06968737e22b9e9255ddceb5f
- SHA512 7331378ef7370a627230191784a27361ed5912055477e82d5c128282e2136ddfda710b2418732307340f72839b5e2486b0cab11c4e74291c49b5acdf0d05de62
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9XM:A3k03kB56rr
- TLSH T113257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 95beec6ab17a92a3a5b640d590644fbadda5782769888fc3724a099d876de4ab
- MD5 939ebe4a532c6becc337f2e18fb25596
- SHA1 5c0a0cdad68cc3257a91dc17602ec8b96dd4d805
- SHA512 08c4f48327c21373f95e1cbbed28c2da4c5c3c5fb242b5319bd55ac7ed81c3fd7aea44668b4fec4de78476a3ef682baba80275e1c9dc0b771a1ee379f53c9e9b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m9gh:A3k03kB56rl
- TLSH T1BA258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH