Analysis
- max time kernel
104s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 16:44
Behavioral task
behavioral1
Sample
2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 933KB
- Sample260728-t811faac72
- SHA256 3fecf0b4a82d39c5a7b7f8be22b041c707b9d16f9082b11ccf3bb0ae023ef4c9
- MD5 e8b32b2558452215c6338afff1276c42
- SHA1 5baceed66802cffbd02f897ba47abec5735a0722
- SHA512 acbc473f40e9e1c4ef86d10c9cdca61ebe13463092e5b4a729fdf1cf35116995d0f72ab3bd8a0a47635d4949aaea3e6d3ed876e1a2ee3e9626b58c7cf333db7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAC:A3k03kB56rL
- TLSH T1CB157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 37 IoCs
resource yara_rule behavioral2/memory/4088-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5c6-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4088-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4960-47-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-278.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198c4-472.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-589.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-693.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-951.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1006.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1086.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1148.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1394.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5c6-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-278.dat aspack_v212_v242 behavioral2/files/0x00040000000198c4-472.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-589.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-620.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-693.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-736.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-853.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-913.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-932.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-951.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1006.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1086.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1129.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1148.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1267.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1328.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1347.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1372.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1379.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1392.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1394.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4960 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe - Drops file in Windows directory 31 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4088 2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe 4960 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_e8b32b2558452215c6338afff1276c42_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4088
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 3fecf0b4a82d39c5a7b7f8be22b041c707b9d16f9082b11ccf3bb0ae023ef4c9
- MD5 e8b32b2558452215c6338afff1276c42
- SHA1 5baceed66802cffbd02f897ba47abec5735a0722
- SHA512 acbc473f40e9e1c4ef86d10c9cdca61ebe13463092e5b4a729fdf1cf35116995d0f72ab3bd8a0a47635d4949aaea3e6d3ed876e1a2ee3e9626b58c7cf333db7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAC:A3k03kB56rL
- TLSH T1CB157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 4fa57913ca2f3d37d3ec126322811c0ff270117c5f7d83acd879f77310e19abf
- MD5 eaf17f3608d2ab85ff35219103d4631a
- SHA1 6c7a2f3a2d356fba5033c74e0e628c2f359d1573
- SHA512 2da1c4bd3edb6fc33efb69388a1291e2c9e6bfc0c1a1856c0193f57006c3764f72432904f622313638ee7eb84562d03425747584822a4fe5cefe54e893d19b4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAC0Le5ji0hmxNrM:A3k03kB56r3Pji0Aj
- TLSH T12B655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 947KB
- SHA256 1e25cd65a2c440d8c5b4464fc2d0b0990c47296513136dcd7d1a53b71ab1810c
- MD5 c289994935885d69d3c15ec9fe010111
- SHA1 19bf0a3741c8bb62b95d984c6c798002ff04785c
- SHA512 1fd4576b495ca5fc1b85ae61c46c73d70ed504ddb48d8299ea6000ed2f8e73809df712f2df53f3b0f9414dcda8760d0f6cacf6ddb044140ada43c55806ca4ef5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAMa:A3k03kB56r
- TLSH T1D0257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 ae6ecc7bc168d0b508791e917985d59706dbaf060c58af6903d9417c3d441b4a
- MD5 898eb10493cb671c5e09cae6321ec040
- SHA1 08098b1c8ea7d5959f60ed0942f3e2e2f6ad6c85
- SHA512 45e1b1e64749e93ab5f881336b9bfb86886825cdba2148bf5887756a663210a44ff4d456206c3180ab8cb13aca1a8fd5af4cfa475ac3d719d8dc7482da5a4a77
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKA5c:A3k03kB56rl
- TLSH T1DF257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 a7d8121d72ca36aef58585b3613fe0afdd00b535bdafd5c1c6bbe8ddf6f8a1fe
- MD5 c3cb7b8dc5312314f8205fb01eeabdf6
- SHA1 34af718e1217193efb8e06b14f1acd2ce82fdc33
- SHA512 f81ab05225a131414c3223639ceadae01464829a113528003e71b083e2f3c059a1819e7d872cbcd0ac4bd432e622adc63f59d64b46898e0676e2ecf276b7884c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAyp:A3k03kB56rL
- TLSH T110257B03E6850FA4D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 071b15ed07cbefbe658286bd8c6b2c396d827fc41e1cdaa4e0f348d850ef0f0f
- MD5 fe57fa2c8b1243ae1650c5685cb1edc1
- SHA1 3a37d30a72a447107d010f0187dae8085fac9259
- SHA512 cc5a0174afcb988e4ad454d40ccd9c5917888ec4ba213103dad88cd572b6a957cd78720b46d97bb4e76c2e8e256b66bec225643bc0734336e9e190958dd8d950
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAFN:A3k03kB56rw
- TLSH T18F257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 766140ca179ef01c1a3deb852fa5811f8e05babdbf7182cfb998bda3eb2a5e80
- MD5 696353d1db4d51c9c135c7b3de8ce571
- SHA1 748f1f62126c59d6931ac16fdee6617a7b276205
- SHA512 c564f10af8149a1e13027f553e1c10554730d8298d4b870b457838e053491edc425e89d6f3437840b65f22b2529ea9b3dbd5bb10b9bafc3e71e8c200d12178bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAXF:A3k03kB56rm
- TLSH T1D1257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 125f7b21ed7fb866b0ac4ce19f909bf26b0a1d3c70e468b8f10ce56b19566b2c
- MD5 1b015d0a5953cab8937d4a4a1fee857a
- SHA1 281b3c0491a985fae37d8a0c8229481b214cf57d
- SHA512 7d20b58439d83b87cf38ef77d52211e071369effd107484ddc9a6b2902d9590a2c3e8f256a0bc5019f70b0434eb2f1ff521494d4d20e4ee0828f36baadf741c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAoC:A3k03kB56ri
- TLSH T18C257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 9285174e7f658574929ac09005525d7b0d2d572ab3319d48a9e9f14533947987
- MD5 1855a26cde9d27aba344f457c2d1c0a9
- SHA1 3c7f1bf22368066f0423a343638f5824a8cc21f4
- SHA512 c8ea048171d38ffa1d7a0deaf5cabe507080c01175eb1a9484c630410d30d5f9328a6cebf1764af33fd71d26e41a834d27e683f2975fd3f78310c600a5403d30
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKA7w:A3k03kB56r3
- TLSH T1BA257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 db7d2bc0942e8943712ae16da34419389d598c238ef062fb301ce9e45f224883
- MD5 5216f2b7eadd2dc3cbe782b31d5ee51f
- SHA1 c807652b55eb67231ff2b007e591f94771f96a61
- SHA512 dea6db28b74527c7d89210276f389da977dc32f6f3c01917b3ee79507b769744ea9c82e39c16f30b9ec8e412ec3d835a0b9c29cf797cfd4d5ae1b73b534e133f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKACT:A3k03kB56rz
- TLSH T131257B03E6850FA5D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 317e608488bbe3d8c22786e49ed96a1506ca38230611283231dfeb7055080422
- MD5 77534a0245bf473773942dc34e18e6cb
- SHA1 ca7d01c4ce19e80ddae5f55bc37e199bb4c900ef
- SHA512 b854d5fcdb4f7f3db14ab3f98fce380841b1486ec612dc43adc0faa7ad074daa2bb5b80fe45fd9ed64f770ba1a3f5681d318dfb033d9d6227ad79543b840b415
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKASu:A3k03kB56rk
- TLSH T178257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 a5d9701be157f743fdaffb809e84d435b67455cc2c084067718711522c0832f8
- MD5 26c92d4dba4e3f68fb543fc5d5531045
- SHA1 9193e6c97f851614337bf8573ef2cc53603153e1
- SHA512 4980623ae322dd45fc6ba581de1dd1542b25f437dc7fe9d2d8a5b860ca4dda3839b7739befb21507e3ab5e79c3f7290ace59c2f27cd8dac450918f64c6a72706
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAMb:A3k03kB56rN
- TLSH T1A3257B03E6850FA5D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 c9d7154011252b22fd4c64c824e6b0df3d60b268466fb2b957ae3598789e791f
- MD5 9bc7c247c24dbab71cec59b2edc87b1d
- SHA1 e432d643994432b89ac971e1e5caaec3ace430b0
- SHA512 e7cf2b45d3851893e71d687d33983619825d91de6ec340dcc414977441019a58b6a9277ae6c8f0b432b94c5bd43cbf004a0da1410d0c89da8341695e77e05a20
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAyf:A3k03kB56r9
- TLSH T1C3257B03E6850FA5D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 c82a7de501f7819fb9faec0de8021cd14b646a0e3120b224f0ec07cd4e7b0cfa
- MD5 619b362550033e6458dfc4c098ab2e35
- SHA1 d39503345e970a6b9ca5f90a4e1df381927a3a83
- SHA512 f7eaddd4b8e7e081dedb584b5ca7d4045cd743a720f90c4806e0ad18ff1be65ee471c6ad5a78be28bfcd408577ae6447e580e0220f0d1438ee21e9a846c28030
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAfK:A3k03kB56r1
- TLSH T1FB257B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 b378fb890a0bf85d9c4e7f128a9ed84bd129c1b6ba7ab2fbee1d4ffeab97c0d6
- MD5 a01b33d46eced87cb6fdb224fd2e8a09
- SHA1 1a1a2b51975c955400d1bc760d15a4bbf7774970
- SHA512 713d00c38517aaa760c4a4784692b242939ce29b185839c944bab48e53738061712a9dcbd7de543dd91644dd508c46db26f388b3ebd6caf814cc0875e2150f58
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKA4k:A3k03kB56rc
- TLSH T1EE257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 4ea2554a23a046e9ca44fed4da1b33821ad7c1209327f9ac6990d76be05a9004
- MD5 cb83ebdc7161e3adfaa5b5e9ccb67bf7
- SHA1 920b22cfb2dfe6876ebc076640dd205a651a525a
- SHA512 60f2594185483e73fd33608b09d03c9ec44d6048a585dc6ef8e2d4d1b515fb4d47812f5cff28d0dd7b720ecb7f45f43815fb7853ecfca32b3be6415d4f45d3c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKA50:A3k03kB56rV
- TLSH T1CF257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 9af72cd5a4b6df898b7da7059ab79afc81a2f726f704d3435aa974f5343d30cc
- MD5 d3420670f0fb86675cf5ad3e8682dd2c
- SHA1 a4911491a9f5a3fdc2f6dbb6a5c0abaa438397fd
- SHA512 71f06d8e4aacc5f9265dd48df1206e9086fc6a420a295870472546266dc012549648b78da14d9493e27cf77f539a65af310cd9cd4036aef08186ba96dd675bf1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAsg:A3k03kB56rU
- TLSH T1A6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 68fcd214332c13a0bccc14b6fb1b091cabce7c95d10265e6ce2d8422dae9ecc1
- MD5 9f3f58376d934b25bc15ad26d40585a6
- SHA1 17fc677056a0d4caf46b3652947f14a80704cbdc
- SHA512 33be86e1aed49aa20e785d619124a689ee8b57b142fb4a9e0d86c4349f4565b868011853002935e4f2a845377080c606599df4839342396e351b9413f70fc228
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAJr:A3k03kB56rm
- TLSH T104257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 a66220a765aff54206e4c71b68d29bcda4f3ef8b75ee59732b8dc6a0bd6ee0c7
- MD5 281500e275306648829f957002ece930
- SHA1 f038d83e4e976fa0722e590bcadc0c4b272c5a23
- SHA512 49704cd80eaf6451a813c40c962a49acbcdeffc1c8ef2912dd906f876263af1b71bd9bc7b15ffabae5f6751bd7fec1d911891e68ebda82344329e3cfdc5499ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKArn:A3k03kB56rA
- TLSH T180257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 3405b3b93771c4f8d05dbc64e2d76c9300cd8ff8ef9b41553bf0323a3d58f7a9
- MD5 a5f1c1de18954d2612413753458045c0
- SHA1 6c8b04dea984f00c9790198349c6b5e59b820dd6
- SHA512 fcb847f989ccc8b57e0611a2261d7854c5ab7d4f5a70a6488a5fdfc559078fd34d464734d8345862dfc19481cc035451c80aa8bfe965805b9bf9af6418e9814c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKA3x:A3k03kB56rG
- TLSH T140257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 487b949a7921d292115ef774c617e33979b95ebdaa09bb2e210c7a50550d1049
- MD5 1aa407d9eb771776aca4ad59e1034deb
- SHA1 71d66245a9dc490fa177cdd627951c930c6e4e65
- SHA512 f18c7d7561cfd7fadbabf76724ec711612713988a23dc4abc75b89bebde4ab4e4a268b47812aaba50ca9ee64134ad53d00779a52f42646896010cc8552ce662b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAtA:A3k03kB56r9
- TLSH T1C0257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 672abc86d410fb7a4a6e5e231c0a7b022e36f907cf94eb7481e5d41be2a70017
- MD5 d6d4140f865914bdac6911ec78e33f67
- SHA1 b986cbaa0b9db5c55160ec686ce2d3b1d72cbd29
- SHA512 632dd9142b7091200f356e92bf6e7c66d9dc064125d48954bc5501d467135cbfbcb50bdd5055d6c2102e03a341ae3fde81eb32d2cb4bd6b8e68fea005f20efab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAm9Q:A3k03kB56rs
- TLSH T19C257B03E6850FA5D00FC1749A954662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 94527dfedb041c4caa1aa21880e983a03a31c17c72e556aacc7dcf7dd92ae6b5
- MD5 de1ffe620f1625e94429e6e71b749dd1
- SHA1 2dc488b0351718717c65760cdc464d0a4f46dc40
- SHA512 9b09afbfcd6e5ec52a054eff3c6b40ed9f875a33f5335582d02bfdc97585a01b82d70803f6f9f9c655ed353fff5e095ff5cf2f0c152302db143cc5b5e9363793
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAD4:A3k03kB56rn
- TLSH T119257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 5189bc84ed3d6865cc64b4d9c3587f48230c2086036ee71692ee7cce5931371b
- MD5 0d38e1f212f8c9e470a9ff1d40310e22
- SHA1 d93ef881893105faa2188b8acfdc2f28e11bc88d
- SHA512 e2c476d7051298161a02a6f5b15043f8d209a2094878978c18aeed85f7dfd1b065c26170ea2bf290a7bdc2d282852e6ced99dd9f6c97f879551ce927b99a095f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAqu:A3k03kB56rq
- TLSH T1ED257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 d7b1c99ff8aae3262eca2adc6f422b6e2ebf3de98897f6c5d02796b568d68f45
- MD5 96ffc97e4ef0d00246c7fba5c5aa3e14
- SHA1 9adeb41ca5d542c4a2ef91288e90cdd2ac0d2a54
- SHA512 a06f359c6cbcfc1239903d13153c224d5bd221d95a97f4d11f632ab4f264902becdbd89d47395efc45caa3579d8b4e1fdb8173fb494c5979d31c43c307e3ad86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKA7j:A3k03kB56rk
- TLSH T173257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 3b2a745db1a6ebee75a2a8f084d925c6c3340dad29541e0a872b075a93a1e648
- MD5 fcad74180c070e4047053e71bc867bd6
- SHA1 55f9216051b9e4145913c5856a1e2d194160253b
- SHA512 7ec4a6aaace55719b8bb790039e265df6118315f84d7f5944dec9026586642eca13294088115c318b89e3821dd29afdedf4a6cb404215ea1a5c1af405971fac1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAGg:A3k03kB56rs
- TLSH T19F257B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 d6b68be0ab22f4b57155ef105490fc291659b5810620f21f682b5a89aab2ea74
- MD5 55286e47f8e09c99eab1732175af7fd5
- SHA1 49585f7c231ab35309dd4078ca55e6df017984a2
- SHA512 f9a4c8dce6180ce89115d594dff9d243c2c36e9da587914330826478a5345342642b4e9aeddb8180117d236e578cd2f31c0092f7994ae5c6f59ba1d453df9e27
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKApI:A3k03kB56rl
- TLSH T129257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 311419caeb19e3bbf91ec6ca69068c555445f84270911ef1483a88444d1dab52
- MD5 51293a0f747c0aff43322df8c1e26c7d
- SHA1 ffdf69d586ea01079916263f1d6f3b6afcf81954
- SHA512 37ca261567a356ea945f78af3dda3a1ff6a7eb4742ebff2b35c4ada7da209317b60db851cd3401869956a8ad3fdbf76cbb9a60b566b91b34c7a5be092f14db60
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKALo:A3k03kB56rT
- TLSH T125257B03E6850FA5D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 711c3e033fc09abf37fee008e728d5bc272f1cfaa751f7ae643a30235fe3644c
- MD5 085f947a54aeee739d5ee19c29c2d1aa
- SHA1 24b90cba56f7ed80f41faf52fe8c1af8e8fb904d
- SHA512 7dc4c5166adeabe4ae6cc30445d799cdb7d7832e19d0a68de396e65798971ca708424e6c11fd22e2d19dcb116f1463d1a724f991ea7abe3032600915df7b83cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAw+:A3k03kB56r2
- TLSH T102257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 f7ee93554be21d67bdf73c9ef99860ae17a6f94231511434fd3e2799fbebbb4c
- MD5 bf3192f6e4b24ce4fac61b556b497b88
- SHA1 b6aac82f7979d33aac3f183c20109cde8780deb9
- SHA512 48306932352a2ebaad6bde07f0690cd31ba15d5399f4ef330fb6e65ed10949228fd04fc7fc97f1b31376e14f12d80b27a462099715dc7327871056d4c0c67717
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAIQ:A3k03kB56ry
- TLSH T110257B03E6850FA5D00FC1749A954662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 bd7c145ffa0ff55d8c50624af3ee628764defa8b74690fbb3fae82a17fc3bae5
- MD5 7d79bf4c7b521f501c6c48d43386982a
- SHA1 de266474cff34dd2c548e9b08ec6fb06a488888e
- SHA512 0b2086940d3bf52174b2eef298f8a2c06cd502ba9adb5cc25f29971d60270b13616b55307975ba38a5f5b52e890a221e52c0cc966a9dba7fb1b895eee57466cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKABX:A3k03kB56ri
- TLSH T17D257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 0701b3bb2d2a062d8e2674c54310afde69b8d15f632b4685f13ac9afafe63c3d
- MD5 a5fbc2e5231911c703726f0437ef3e4f
- SHA1 918a0af7321accc90ad37056f95be7a3761eb857
- SHA512 52f8ba7d3e8cf0cb23976614c2900aa8e1d9d6582c1222a8f9277e6d855feccd4e1c4318e9443a0da590c38b55c4e2eb948631786bc9fd93e96940386119bad4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKA7L:A3k03kB56rM
- TLSH T11A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 58af697ebacfd5a577c055cabd838550114a0c7eb29675b05049564cf0ec392d
- MD5 bc762c49ce01ced08e57efa9fa13abaf
- SHA1 97bab9b73f05cd3ac179b9c16ccd80a6b7cd0870
- SHA512 0e11062a03351f55d0f319149ebdc1c9a69db54a84310411c12edd9daa325a10ea84097ceea382baba19a3380cdb668acb8f9d10a48065a4383f53d97b0eb8b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKABM:A3k03kB56r9
- TLSH T102257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 b62789e35b2736d7c00098bf945f2eb7d37faf3f8c74241da9d6050df3fef796
- MD5 37b6f4844cbf9600d0d8ff8bb58d38bd
- SHA1 580b79245e5cac68349440a8aa90927e4525d5c2
- SHA512 3927a6f3cb9cf8d5cfaa9f1ea9e5acc163658ddc0476bc9b4b80e8898fb71f65813be84734c26d3f12dc8726cf2d7395bf5caf57cb06dd6961337e46b6356693
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmKAqh:A3k03kB56rX
- TLSH T1C4257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH