Analysis
- max time kernel
95s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 06:56
Behavioral task
behavioral1
Sample
2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 933KB
- Sample260730-hqrhhawwft
- SHA256 7ea4df01025c205f2d34e4cce5f399016d439fbef0484b12a977173c794110d0
- MD5 598a73a0567da48ecbf8445e6c81b76d
- SHA1 c175c0d61f7dd83db70c3167a31c46342aa8762e
- SHA512 a0511eaa42fda51305d10cd2a40c5e4e01b0ea8ff0a4b04bb2f4aa3830cd161b1a3dc691768027cdd0c0a68ee9ca5d3dff2d5d75714766030ca1d80a62387d8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCo:A3k03kB56rg
- TLSH T119157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4068-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5f1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f9-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4068-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4960-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-276.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-463.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-585.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-701.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-782.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-960.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1002.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1045.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1164.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1214.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1317.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1393.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5f1-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f9-57.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-276.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-463.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-585.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-701.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-782.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-820.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-851.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-928.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-960.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1002.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1045.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1089.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1133.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1164.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1177.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1214.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1317.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1336.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1361.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1368.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1382.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1389.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1391.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1392.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1393.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4960 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{78329DD2-943A-47BA-B763-81DEA89FE76C}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4068 2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe 4960 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_598a73a0567da48ecbf8445e6c81b76d_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4068
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 7ea4df01025c205f2d34e4cce5f399016d439fbef0484b12a977173c794110d0
- MD5 598a73a0567da48ecbf8445e6c81b76d
- SHA1 c175c0d61f7dd83db70c3167a31c46342aa8762e
- SHA512 a0511eaa42fda51305d10cd2a40c5e4e01b0ea8ff0a4b04bb2f4aa3830cd161b1a3dc691768027cdd0c0a68ee9ca5d3dff2d5d75714766030ca1d80a62387d8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCo:A3k03kB56rg
- TLSH T119157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 5ca444aa14f8ab3bef4285505ae8596fb53d988bb4dcd9a70aac874562fe895d
- MD5 2bc95943bec93cf8c073dc8be5166b42
- SHA1 813195b582f2528a4f06025cdd6736dfa331549b
- SHA512 b5c230083da0710b637402c37d22250e451c979339a781a78d2aec4a5fb2200e47da9a1ce352805d2fd4db16f6ea59e5cf5e3bd902957db71e8ece842adbc23a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCw0Le5ji0hmxNrM:A3k03kB56r4Pji0Aj
- TLSH T1C7656B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 947KB
- SHA256 0163877f32eb22a1e12322f68713bf5ca28c472abba75d3b1dbdfb79d5f72b1a
- MD5 73090daa903e8cf60e5e6596e7c46034
- SHA1 dae985ac8d3795ae1df04fa026dea53b7e608668
- SHA512 f573aeb2d33721b39dde0c8d0ccd5650823c4aa8f32a4591acfa74e849d42d610dc0bcbb795ed76c65a9f4e40455b83104d39cd845f2f35b1ffd615981be3297
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCKa:A3k03kB56r
- TLSH T19D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 476f1e3b6ee546e90c38bb84d8c8700c71f0a98b0832f8610d5ec9caf1ac7deb
- MD5 20ae82d29fbc36f2ce6c62b8745fd2dc
- SHA1 449ba567be2db918325c9a822bfe6b16afb67344
- SHA512 4a590a319d6ece82e6c83d92f2bb02e1b4a6a28eb975387a61c3ea777bf0eaef1c5d7b9d5288ce18cd1e2b151fbc69d816c5a09275ebd2bc2e8b33a43cee7816
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCr9:A3k03kB56rx
- TLSH T1B5258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 19fec937f71919c0069fb0ddbf4d9cf1cdfb303f8256dffdb8452d38daeb3fe7
- MD5 8f5e3a64802f5212f5e91b438d1f110e
- SHA1 32bb09be9551a3df2a6f3006541813164a481900
- SHA512 3883c1200d31b6ece3be96a2c5ac0e2cbf646a63f39d50e06cd7ebffb180527dea8e828a633361c2aff38520dc70e1ef87e981aa4b256cba3f7d85d3aa7ee517
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aC3c:A3k03kB56rE
- TLSH T1E3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 1a156ca8158fbb5fca3f686840f506dbf6643ab388d58858f17ae26efa7b79c3
- MD5 3b6fb441f10c7e3276284c65b34add06
- SHA1 c8fa3196e52dcc34b65fcc401e1fc9fce7a7a148
- SHA512 9f28f7ff844344c6c32b8f5330311d8e1b970f3f54cf66db10f9e58266bc39d942ba84d526cc9fa120fbd3ffa70138bbdbaa0aa9e19f46d4dc30b99f4564544d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCAp:A3k03kB56rS
- TLSH T18A258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 7e823e1900d3a7aec5877adc89f63236e4b296ef205ab9e8c390175990d075c0
- MD5 05f60dfeffdc02948843a95d50bf16d6
- SHA1 90e8577658d3baf5f5c4e497e26cdc6d1f9df4ab
- SHA512 87320d49b7509302fe35106c9a2bc7009f3d14bcf34cbd2c738daa9f9c32a6873cbb1ede561f93f42f1523b879546f6f08945c6bd0392f4f5f45aa7a6b8319de
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCHN:A3k03kB56rV
- TLSH T1F9258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 aa1b275ed8f17506649fdc2a54e45d199c2e92dfbdfd7d45e74d39850db19a59
- MD5 f4175ce18be0077aead1103eac6f6804
- SHA1 6e0f26f697dbc443290344a040c3820140d19db9
- SHA512 ee00fba77bd330e91a97e38e15514d6b7468526876671bf22ceaab33b9cca12d04a064bf82878b0eb89909b4dfbe666de5be3f6139b22d9b5e7cb13e04a439bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aClF:A3k03kB56rf
- TLSH T129258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 1e652e9ba51f76080e4229efdf91f7cebb6e9e3ae89b774517fbbecbbfc8a7a0
- MD5 11e379cb46a1806ef9388d9c4f51705c
- SHA1 fc8c3b7bb1dbdf739c2d3fcfcc557ed8d711e8ce
- SHA512 3ba9ab941642a1bc206820c2b0f2bf56e15c0d489f1b21c9185e64c46826d9e39f9fd80c40d39b5144c5291cefa7f0ac3bc95cfc7d1b639f00ffc6c0ef44d80c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCGC:A3k03kB56rT
- TLSH T120257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 63993ab2fa6b6a809f2fd7366126a45c756aa7cd7d75de96ff28a45d14014eb5
- MD5 14d1a6fc064b174f993d45232189f40a
- SHA1 b7c28ea432e1968c655f8b6f996f1ac2dbf13696
- SHA512 a035f9b0818a590af97413476a66efdabbfcefda8c762ee101edc5e3937ff836bf2d2f7fd799a262dcbd7aa159a9bdb75051b65ee445b8db607879ed0a7fcdd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCJw:A3k03kB56rW
- TLSH T187258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 017025621bdf967fc3fd24b600feb78ae9360ce2f378eb4cf8eedc8fdbab9cfb
- MD5 6696af4cf9a80ee98d039999df10fb66
- SHA1 3ed38fa110c8f8f50ea4f7b751323b0e5243bdac
- SHA512 322f00476675d5fb716738385588d70496d6330bd631d4ffe306c30e69f02354b97492f93b46760468893c02c90d19afd957a9ad0b11f4e09ac8626b4751ed46
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCQT:A3k03kB56rW
- TLSH T18F258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 40e84d6f4d900a9c6eb98f63224c28bf20792561d6bff1171d16c383363148ba
- MD5 1d75d6573a9040e9f087aa6a61a916ed
- SHA1 253f58b9ddcebc446e09c5cc2cb03dcc9fd7e5e8
- SHA512 5ed6b34ebde082af10212d4076b76c56597287a56571ab79cf568e1b72e203ebf5a5b14f68a6b6684e42f0fc445fed7ad0361911aaddc776fc6956115e4df257
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aC8u:A3k03kB56rx
- TLSH T190258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 876b4c046b4515012e24d1ed8bda045af490d5a6e7755a7124673aa90bd4b40f
- MD5 8d804ed09d53ecec8acec442b08ef4cb
- SHA1 062294017dd39f8032186d85c51d20591c1af0c4
- SHA512 dc81292a645b5b8240b52fd17605cda086d42f7740c4885575ea772fe14014d55af1fa7ccbdc586595b265291c9cbfab0b32cfaea2c32ef794d74387981cfb16
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCab:A3k03kB56rQ
- TLSH T13A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 71fd37e0056712b6b5e9ad14bad7b9eaff1fa639af6d07d8a444a247f9101091
- MD5 972ddd5596a32997a5e959e689f4460a
- SHA1 57a7dd839fa83305018673993573ac950dd67461
- SHA512 3c00af3a1817ec977215469293828f85d58f2eda8ceae5a49d7f4c92e64bfe1e3f7d7ba202cc989d0618e414bc2716de3413e755a059a9cdf3bc819489f569fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCcf:A3k03kB56rA
- TLSH T1CC258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 a01ef77b969e414ac49a490248c58db639a206ac4dae02c31b1a0f10883b07ee
- MD5 fd95175bf92ae34664d7c109a21744b8
- SHA1 f522692dbd8e868cfe9470973ab0ca3559fb6142
- SHA512 cf5921b9ac51a82404fd681c788b3e5542802b6f64280474c7329dd8f6ce753da078b0b73172f95d5779c7080911def5819046f4c527ac25cf0effa072982727
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aC5K:A3k03kB56rg
- TLSH T1B3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 90748a766c154e570b7e30f6111d34cf77a8272b295891dab0b77d78c762c62f
- MD5 6bea2ed3133c7e13a732cf0cbd14bdea
- SHA1 4104a97c2238a2cddab82ea82bd7d98012c4042c
- SHA512 f78307447d32d6d05416c586dbd3d053ada57a9dcca75f5e211674fd6d11fc906679ae4f9b12225ac7ca16622e560982adeef4dbe430e164450a17ea80851f84
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCik:A3k03kB56rJ
- TLSH T1DA258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 e1f241bf491bcd03cf2b42eadc8c99329434ea132605338410ab6eccaf5e5a9b
- MD5 2fcd21051b5591445065ddde4eced712
- SHA1 10b10fbb55189d4c10c7f7610bf94052255cd6f6
- SHA512 2fec8c45b01161617c07de8c25218c1228fe9d756d60d7e38437e03dec27592ee3cc5a3659b02ec862f2faa4068d8b1a3f4cc1876ea8c78f2d84f773e128bfe2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aC30:A3k03kB56r8
- TLSH T100258B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 9c43f4ca90c93c57ffdac165e35b31e4a1a8d2ca87e3814a7acd9c14e06c8f7d
- MD5 583afe4f7d2f70b4b6f98b186914cafe
- SHA1 92bc124b7f6d5b6451896096330f7020300a926e
- SHA512 45fc04efe7280e0143c7b2e6533807c0caf652c3f0a99ced7ab1a72edb9a42f235d0608b59ceb755b8bc70669034712ccf4abb34332378485a5b42e2f4b0d464
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCmg:A3k03kB56rB
- TLSH T1FE258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 8a62ee942e341f9a257fab408671abe0ac57aca676c45a73da19082926606fef
- MD5 22d116ad515592a5bcd4ea2a83a41b09
- SHA1 43882ebfd25edd757f6bf8f5692e37c507ba3bdd
- SHA512 ca782403be304770c547249cb6da69c42f9fcb2fcfff8b5c403d2d75f4594338d0af17464d9d2dd6d2139b346bab4853fd4cd8fa705dd488d4a7915fb1501b87
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCvr:A3k03kB56rr
- TLSH T196258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 af8bb99570836e21ef885481b85403417937534659abd09afbfe881277096e5c
- MD5 5d672651c4592c84e3e0d8798f53aa52
- SHA1 bbed266cf371d342df1eed775c44d003a69b7da4
- SHA512 2be1205bdcb6ac7dc31dd3d39720f6a99be30e53fbb04a2e91b793c9c8cdde4b3b98dc378a3bac9b7ff48e336ad0acbd4a8a18ef6f978781aae6f5785e07b175
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aC5n:A3k03kB56rd
- TLSH T1B4258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 6a009f9510e0af5e1299f057e44425e075ff6cc919f3b95e281eb3f2cf0133f7
- MD5 bef7ef2f06eb496c45d576d6e22501f8
- SHA1 87f02e0839da9504d482e56b338c0aa83eda3d8c
- SHA512 88e4ec56d14a2fe773fb7f3b44194f54c24ad4a1fa0e09a5e314ab390246c719acd40969301f1147982b9e9ee12a0823f6060b7204a6ebd451599cc543dc86a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCVx:A3k03kB56rj
- TLSH T19A258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 ebb520398131b72cbef58b6cbbe7c4dfd71e142393491f019f83214189880d5b
- MD5 a7572a8d6b42e3d53ec41bd5099ceb84
- SHA1 dcb87471d989091f68d74635e2364171cb7aedbe
- SHA512 f56945a3710580e64c9d13d8cf3b3d3c6acc007c156b048ba724a28081dbc23faeaf4aa392f8d4cfab43099cac4e6fa49310800c0b7b29a2ea422e9103af5fcc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCLA:A3k03kB56r8
- TLSH T1A8258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 655a401b6ef047f21f5ffcb5e3a278281609d3664bb8d32620d2e074fbcfb040
- MD5 ab8975e0f065c5bb90f461946dd089a8
- SHA1 d12428f487c56ff44c3caa7f265b397912d09b2a
- SHA512 385dd0361d238b6530f6b8a37d00b06098eecabbceee2636568fd247fc236debdc1d7b7eb3cf5bbb7c3bc98fcc9ff076ba583e39ec3d6cecd9366ba8c5aaf5c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCc9Q:A3k03kB56r9
- TLSH T170257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 728a5abc21b232ab66c6a546848c914274b0b01065b17b09338274e4a1d97b40
- MD5 27e5b33ce35cdd9be029b26a769fe2ed
- SHA1 7082abb1078ac1678a95a1edd7736efb19132297
- SHA512 6825fa9b7f9abfdf2ab91b6616f80d3db0e0cf3e4ae62081864cfd6115781fd13a65fe5d6714467ed420b9547a95962c606e5ec1e93f96b36746413f665c2fc0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCF4:A3k03kB56ri
- TLSH T102258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 556906ba9a371e0709e748ac7be73534ed203c9995bad7cdb255e7586cb07138
- MD5 a8861b774938a0f61fc503c9250075e2
- SHA1 1896f362566bbb38121a241882e2b38d608db6e2
- SHA512 9356c635647402ce772860cb8fa7bd5c6f041f0e033770d3b4e24edee855f37c87eb6d80bd2482fd13399318342fb4c99dafa48979e5759c2125bf4c5ad5bfc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCQu:A3k03kB56rT
- TLSH T11B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 f382c51ceee9ef7a44d4af3e668f49ff26a905980f31970b4bb2ae72b4fbad5b
- MD5 65c36bbb67e1e6749e9ffc0d5a5eacfb
- SHA1 8e34ba1504713fb768057edff7fbe893cfab8933
- SHA512 07dafee3e7b309770a4b08ba41bccf95d7ee85e8f31edd6c4849d65786d9dd04e295fd410e5dd9338b20623c35f395c5bee014673c1e6c62f9a66affc54de88f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCRj:A3k03kB56rd
- TLSH T1AA258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 2161b201a19b90da8c1c7f7aab8e04c2eb3054c6661e3dd0d70e0ccaa81fd767
- MD5 2bd2cc8b2c0db6116ac41267ee8d95fa
- SHA1 b099ed83d3cc4fe15551e924ff18d5ad37638b39
- SHA512 beb0f943806faa36c6f13ca2ba255f9aa0dbd9fd2d59da1f8c8e2aea51e5795b3d5f59fe235e45d5c59c60b07850c7e943db65b6c54311b57338d48da7b4ae33
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aC4g:A3k03kB56rh
- TLSH T1C9258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 f9e49984ec952953acf7b2369529fd017e9fee040f82813482bfe5efa97f7471
- MD5 73066851433b578bd7a4f2d96a41c274
- SHA1 ad637f48c9f3e673e5a48a329f6012d5d8575914
- SHA512 9b8323cc1b804247b455acdc52b88e40d2702891f35c2cf00662a3c84e29d21c2a0225ac4eca57354dfad9b9f60099aa6791c0cdab569a00da47b45d03a66edd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCXI:A3k03kB56rw
- TLSH T157258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 12217ddb649ba3ac49c75b734f7d0868d779b65fa8b119d6f5897e70c27210b3
- MD5 7661afc3e648aa0028c1bc6ff20432d4
- SHA1 3c08f20bd39dad4247aa2ccb69ee800ded38721a
- SHA512 1285659a79c48df31735083cbb5c0dbf0fb28604f77add7754afe9e9933a5d236d055a4041ca9282d8b1e5191679cbd0b198976e15121d01ba3aa7446f71f50f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCdo:A3k03kB56rS
- TLSH T1C0258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 1974d73bda81fb0ed1035832e93724400cdc8de88f6df2500b9664f2adcb4e41
- MD5 4e372d8b81501c6a6aa825b3367728c3
- SHA1 62eeaf73165b8d291fee166806e219fc8123ab8d
- SHA512 32c19e87593be6965089f883b66686207acc44a84745fd885622f0c1c2cc273f0cc43e035c6f746729781085cee9090d9a380af73367ff90b563705ce1f5f971
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCO+:A3k03kB56rX
- TLSH T115258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 84dd8232bbad69e33643380f3a97bbbb7c375944834817fdd0fb20e645271344
- MD5 e708dc566ca93086c8dba20c508d6bb5
- SHA1 f2c36bf11283837e5af04abaa9eb36115e6e5d19
- SHA512 206faec53be6cc2b9577c59704dbbd0982566677a97a3868871168875bb426abedbe4a2c5be94c3a659e009cb3cfd63199f718e5432da3a3e215898229cc0590
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCOQ:A3k03kB56rD
- TLSH T1D3257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 f82c238d0a116e38ef491743959edd9b9c8b73c2f2e3cb62c86748a576cb724d
- MD5 d39947743a9f81d4474f360cc202e0c5
- SHA1 065bcc302ee6a2728e3ad7687153d1ba4869b0cc
- SHA512 5159bb0e944b251146e3706808eb05f30c2e89115a132582ad25496bd80fac2b229199f1496ab7567f3e1ecec2932f189511d7819857ea604341c0869f24f147
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCvX:A3k03kB56rX
- TLSH T1B9257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 77aacd324ed88fc6b1a08f0179bf80756f5ae8cddb6ca37d757d3eb05abaecfb
- MD5 ea315cb580124440989ad0f810a1a6dd
- SHA1 7a2101fbafae39921ed465b282eb216a6b8dd77e
- SHA512 d733f5b5ea961a2d8a28cd050dda1effd3a8068549d884cdb11a186c14fa0323a821d94e60bf6a34ac9d59ab0e5516b9f43a94a4a03e95bfa0ba70e7e0f74c99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aClL:A3k03kB56r5
- TLSH T1F3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 ff202b9bb67424096d0d7a5f8c5bd75f622a0df6b02640d6fd5e1d9ac3a5c437
- MD5 a2d56c8fddcdfc84e6231425b18c38fd
- SHA1 2b7288f51b44f464422b155ef58c7c18849242fe
- SHA512 9fdfec1d16ef896deede671d285dfd8c44b8285bb76167e39c873c6c77d9f752de2507c2d592b95b1e7ae911dd084337d5e6c83d1d9c2a48d1ad77ad037b8a2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCDM:A3k03kB56rA
- TLSH T1B2258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 be04c94b91f8e219e4da6781782d61abf9945b2a6ffd6f54aebed131b4f2a6c8
- MD5 4beb229a281705ce945b8cda4d96bcfb
- SHA1 9b0df6fc140b9675490630f2f4adc96ca2d0d0e5
- SHA512 89dba86f97ae029beaaef5efa7f05c7357375e3fa4c222d64af853143dbce16d298acbd043916eeb4f80c068dd886fa38717c419cf9b09cb05248ed8cc32db5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00aCEh:A3k03kB56ry
- TLSH T154258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH