Analysis
- max time kernel
100s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 16:01
Behavioral task
behavioral1
Sample
2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 933KB
- Sample260731-tf7brada54
- SHA256 80f621ac10cbab9d43e3452e8255bb3b639f777cc974b2dab27d2617393cb3bb
- MD5 fe999d3bcf96577630fab107804fdf62
- SHA1 4bc5910aed1a0d0e7782ad80567e9e89d94bd86a
- SHA512 3b856c79fd5d4451d1a99ebc3dcc2d85385fc75a1b79e9d26d52ad187edb04c209f7a85c5b58d1916ece8d2bc02d8ed9c1bbee77eb8eb74206e53c94345f8ae3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOf:A3k03kB56rU
- TLSH T157157B03E6850FA5D00FC1749A968662EA777C465F2093DF2358AE153F72BC06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/6076-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b815-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6076-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4556-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-546.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-607.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-638.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-729.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-760.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1087.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1167.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1217.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1402.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b815-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-222.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-442.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-491.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-546.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-607.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-638.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-729.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-760.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-912.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1005.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1049.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1087.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1136.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1167.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1180.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1217.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1320.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1339.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1365.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1373.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1380.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1393.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1395.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1396.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1400.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1402.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4556 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe - Drops file in Windows directory 31 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6076 2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe 4556 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_fe999d3bcf96577630fab107804fdf62_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6076
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 80f621ac10cbab9d43e3452e8255bb3b639f777cc974b2dab27d2617393cb3bb
- MD5 fe999d3bcf96577630fab107804fdf62
- SHA1 4bc5910aed1a0d0e7782ad80567e9e89d94bd86a
- SHA512 3b856c79fd5d4451d1a99ebc3dcc2d85385fc75a1b79e9d26d52ad187edb04c209f7a85c5b58d1916ece8d2bc02d8ed9c1bbee77eb8eb74206e53c94345f8ae3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOf:A3k03kB56rU
- TLSH T157157B03E6850FA5D00FC1749A968662EA777C465F2093DF2358AE153F72BC06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 1ac654848885fe850fa62da667d91075bdf095e01b02ac1ee4ee1e387abfc0f2
- MD5 eedef48f19b6f4864ede521a64a49e2e
- SHA1 d23bc701bf236bbe04ca13599bdf4439c6639c49
- SHA512 08d73a746d9d72e6c198952e01a94bb42381221dad4030b3af5872d673543f1683d797031c8f4a02016c31bae5da00f06a51d268e4f00e276876bb7a39af6789
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOL0Le5ji0hmxNrM:A3k03kB56rMPji0Aj
- TLSH T14D655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 947KB
- SHA256 58d7dcbc77612957a4c8e924d6033dcbcf184cc594df5cbb7ce6de14d6863468
- MD5 c828f1f03c62e226f74ac0230d8d8b20
- SHA1 fe04543ef94a5949689d7170c8f22f3cabc1ebe9
- SHA512 53072ab12965a656bfbe6b7ea14bf134001dad65e2478910f83e3f040977a033249f4ff780a2233b768a778db9653fc5d7f4cc9b6d6950222844e8260a412694
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYONa:A3k03kB56r
- TLSH T199257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 5cbce5dcab02c8a75faa11a962041ac0f32ce0ced18105b406ed94b7be38d391
- MD5 ff3a4259a7721a8d4b58e0428e509b5e
- SHA1 4e5a432277a5373367def60ce7abdbb213063b95
- SHA512 a1ef9306ab3fb813fe6bd603c4f39e04e799d1e7944eb8fcb15b1b62b9c0560b3ca333343ed28fdaa6b051de24bef57c6a2834637f7d4d5e7dd27a8fdf64d26a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOE6:A3k03kB56r6
- TLSH T174257B03E6840FA5D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 957KB
- SHA256 5d6eed94c7d63b4e3c5ecf945bbdba686e31a917d590f1dc9f46f87b54487c9f
- MD5 19a20a0633ba385ad03c522011af28c5
- SHA1 a1d5ba357119a455ea113f9ff27133168ec84b97
- SHA512 b1b9d808ca161266e9196de7640234fccdb4b1dea239363cd3583bd3e6ebb14a1ea334037ab053e388bd333cf122078dc0d2c1292223863467527b37f0c05191
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOgN:A3k03kB56rz
- TLSH T163257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 957KB
- SHA256 870bfea943c78f881547ca29f7bfe26f84d216e475a83749d900d554486a0453
- MD5 a1e6ab480a66cfbba43bf788bcaf6b52
- SHA1 aa405288848dc29f5dbdfc833c37fa47ee2cd521
- SHA512 3e041a93b106b66287c22e9937c2d5f32c10846a4dc14f928efd272d395eb750c175cb43b066efb72ea589a61b6b11828d8f7ac7263188aa566e7aff9cbb170a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOOf:A3k03kB56rX
- TLSH T1E0257B03E6840FA5D00F81749A954662EA777C466F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 4a1fdf7654cebfbdc2d1882b869faadafb6f25f512dfcb96523cbf6d22d47404
- MD5 26415c94a21b9426265be0995647c9b5
- SHA1 cfb20785e4c9992e521108f12caef925cb370cb7
- SHA512 775d1276bfb6d8e0818b86232dd90d758611106ff8e1199c14dccbacf9e03277b7705523244047639e467c33aa29aa202e55051c2d18687fa3c208dbc70ab8ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYO4o:A3k03kB56rO
- TLSH T188257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 5a85f55d065a56a5212f84555fee9c82ec15226e0838f3ae2c5b20de65880e8c
- MD5 0ea9bf52e84f30d51c870597828911f1
- SHA1 d9e4ba7a774c7d23b2a5f45e6939f2d63799a4a9
- SHA512 766f99b0f3b25f661b1b09aaf02bbb1a2be67e63e9030979e31a11610906e9a75213196759acf9fa276b6452bc23be0e3d6598b396797756186eb61e6652b42d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOIu:A3k03kB56ro
- TLSH T1DA257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 6213818b74e6332fe06c936ff7696d13d5a66b0c1e80dd8288b9f0158bb9c8de
- MD5 db26b577a823ef4032d64b8f224c94c1
- SHA1 df6da6fad27b111c6b52d19a0c807c8a816107db
- SHA512 3915f90058cc67dd8d0e1253f1e211ceec0aa7db943c9f82303b9cfaa5d7c50135cf4e8dbbce405a335fcb6dbdffe6ef74e59db7bfe7107dbaf4346d30dd5c4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOc9:A3k03kB56r9
- TLSH T157257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 c611a09f2380cd8b66c56e4802c0e56312e323d907af4e640c6419e4525a73c0
- MD5 75ccc2425bec1a4a40fae928b9bc2fa6
- SHA1 9c660d5c06c76fbe487f48a79c1c84f7249d4e5e
- SHA512 36f9caf7170d74d0eae4c4d3ab2d5b2fccd7f575e02e86a07662f7b87808ffd688d0be282f1fef75cb2e78729254ee098290371bd12cafd7261dbd78268e1dbc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOEc:A3k03kB56ro
- TLSH T15B257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 2aee9c349ee0bace52a8f93ad6ff4325a61775e06c69783b781b3ed37bbf043f
- MD5 f60c492154b6f3e577ff2ee234b81954
- SHA1 898a86fd9ffee27fd45eb3a54d49116d907e0d08
- SHA512 df0f18b5f250ba792022f11664a324b8dd36f33566b81b508a90b011b051d00533d564894fcbccc0614c64e642278d7fe1167814f6676d4b182520fb5ecaa3ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOdp:A3k03kB56r+
- TLSH T1B3257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 b7cfe68a6a3d5d101991995e7a3037885d560eb55d6a06ff3fab9dba75ca9c28
- MD5 f01ffd2bf59e773c58d035e8fce68689
- SHA1 fef7bacfe74f745e8eb9505c819d03ac10959d82
- SHA512 c37d19de35c49ac5ec8c35a75b556ae2675c4d11d8fa4740acef446595627c03fd18f754fb34e445aae9d5022f6d8972254461888dec1daf13776a011ff1af0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOiN:A3k03kB56rx
- TLSH T1FB257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 86339e88e5e274cc4c76607b8dc1180027b26eb8762c040cb3b45a3af205c4bf
- MD5 d7c3deee380c1983b2882870ec3fc4d6
- SHA1 b94349e63c156ed77fca8114c7a17c7a51c31a36
- SHA512 33bd7c00c77d9cf291e8c039fac17d4cbf7eacc1175d38f63cc6a4c79619d794f96f838a8eba3a98414d4306cd84106264238c95206aee29e90139ad5e9f465d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOGF:A3k03kB56rD
- TLSH T14A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 4e9913c745cd962ec2a5ea0f1ce777d86b16613e00b067eaad0d0fb7a9dc39bd
- MD5 14e3ac8551ac736ef254cf56bee5cdb0
- SHA1 2d3d4077515c43840a63e3c26670be4bc4a35cda
- SHA512 61d1b10478ecaffd2620e0a8ff805a97bd871eb544dddd7317f8bd274a5016885d7ec57d0103920e1a21e020f5ce5bfb971e4af202e1ea2bba7eacd08b80f9cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOTC:A3k03kB56r/
- TLSH T154257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 e79812df503e5a6ffe28269c33759ee3549549fa13593768699ee5d9c36b4e1d
- MD5 5f6de9981e143b44f45d05b9fb21f446
- SHA1 e6a7593790bea6727a74d83a05566bb844da247a
- SHA512 bd7e79d80989e00da881ae66091be02a718f238da9fd307261acf3dcbc637a156c1396d517ac8a433c1464aa3d3ea87283eccfcbf26cf89648d7b53c12ba9476
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOcw:A3k03kB56ra
- TLSH T196257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 084bcafb76dfba8169d7398edaf5bfbe235d29ca5de1fcf6d349c01cf6ce30db
- MD5 abef14910977d05a05aacebb3c93cb5c
- SHA1 dbf88604c8731ffeaa4971b314ff153a70d1e453
- SHA512 660bad7aef69186c7f3ed146fc1831a8c5ff665fcc3ae137c57af29a7eec2dc7e8909fa18483fcf6b99713ff9585e6c533819ddbfec75b71a91a6f6177067b72
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOTT:A3k03kB56rK
- TLSH T130257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 3fbdea1e319daba9fff1a15c53af62752eb31e69edd06af68c0729880a101744
- MD5 b47201698520386d088f816646b3998c
- SHA1 27f8a12835b75ede10ff888866178c269a9f98de
- SHA512 362c8b25545f3a3f6b85f563a5e52d199d05401bb110da2e99319f3cf4b5e6c54b8648888101505cab8d7a3f57bf3c60ce98fbc8fc17e89f04caf6ff3e3f24a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOlu:A3k03kB56rF
- TLSH T1F8257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 672e8939ebecef7bb1b90a5a73550aaf3916cd19185793bd2f2f175dd8e4aad5
- MD5 88f1711812169be5b648a422a6f9da48
- SHA1 71dd571b6d49554bee862244ac167c0bf8806efd
- SHA512 8733cc45ace7ee0d2a64cb2ebaa64e59efa30c86665cb526f00c1aa0eddf21304651048ca0dffed14134322113e41dfc4dbecfc512d2859e2771e09aaccd27e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOtb:A3k03kB56rk
- TLSH T1B6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 6ad74543866670ea2209fbeb5d6871203364ae3739446ad4ba19d639fabb321d
- MD5 51bc27ce3fbcc9a78c73eac0df9853e5
- SHA1 6ea7464981eb034176214d3bdad1533639de0651
- SHA512 8554a5cd6d725206d849f274622431268a6af7e87558cee4d2d17d5d31ce9c7b949f5ddaa8ffa6cf3aa14f4778575ff6ce4060790bc0e759da406d69aa85b042
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOdf:A3k03kB56r0
- TLSH T1D2257B03E6840FA5D00F81749A954662EA777C466F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 c714edce81cff81cbf0055658d7f2060ec30196e11a9180f9a349603f79fbeed
- MD5 bfa45c829c98441bbb3b4c10d9904856
- SHA1 ed8e06cf1a93ed1abb991259498683a251207e4e
- SHA512 c54a2d661d67bde5b6f16aef96b471522c62a7a66f9f196241433efef9da8c5f899623e928db742a7517b078ea4b6543425ba9549085ed3e7a4d0d490e438cc4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOGK:A3k03kB56rk
- TLSH T116257B03E6840FA5D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 3b5a05ff3855920dd373dd4ea46a261cfba9ee3369d9c1e0eb961578c2c1eef3
- MD5 6297370b8f02355220b888898620d831
- SHA1 5712579d8df2ea1452205bc49e2506997c298d81
- SHA512 58e623760f5b68282c0d9bf3abd02c2100cc4c3dfc1bde7c4249d21a65b6dd4424a3446a0246ecd7d66a183306e201c66ac70803e96d63e25f926fdeda713627
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOzk:A3k03kB56r9
- TLSH T102257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 ced0c55c5d70831a3397d90ffbdb1dbcceae63711877e0839965599eb545ac8c
- MD5 a83775730c72dd2bf94dccab57f840fc
- SHA1 1e766f730fe3f0810f358cf7d5b46911ed0a2e5b
- SHA512 22abd7c70a5aa525495900fd2b1310ea75036c1129b98e1c273f0bbd63548b47a6d724ae9f92f81dc050d11548fbb1e0647a3bcf271a0d2183b044cc61bdf85f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOE0:A3k03kB56rA
- TLSH T1E8257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 7bf914673293251ad9fbdcffc0dfcd316c693e144abd0a959883d20fe65a6157
- MD5 1027e7cb5ed098318ec3b051b9399f96
- SHA1 c5033444b023b8f3182ead3933d70f616890be7f
- SHA512 481be0c85ea4a47f71ec82969509caeeb46e20c016cb4aff66eb8ec2ef9cb90919f98b4324e0c797bb8a1334c6f8427491183270fac5ef7414f486393eb863b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYO/g:A3k03kB56r1
- TLSH T1D6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 3023ef1b1758ab035492de3dbaf4db18519fe45af48078e29bd4d9a3c841577b
- MD5 80173d9ba93ce0f73c9adc982e5d6d5b
- SHA1 50df92b1aab634ba8e4b8a5acf42382902827144
- SHA512 3486a8062e0f0097a376da977839a1b3b4c11c0f0574f1bca9731c7c47082184454b0625fbbe1f52d8b989dbe8fcac28964f449edc7bbaf920f6149b2c3f56fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOSr:A3k03kB56r3
- TLSH T191257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 3829bc203cf2893bdf820c9cdd557bd0334674458447064c9bd850137be38a17
- MD5 5527a4350f0f5b3abf2e51b4e9f2519e
- SHA1 6351db50404603c7d1426c1726c527bd7011f1fd
- SHA512 2d650a4ff0cb3dd9d02abbb8f7090354aeb4e78e9a8e53fa273a6ff6325ae6c093498435a8e1352adf52570ea526e3200bc3b36a3fd81324af3c2587ccad6d99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOwn:A3k03kB56rB
- TLSH T135257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 b4cb78d92404ad05334b4c7e8efa07656e78315a54c6064d533e7feaccd35e29
- MD5 4c7b02306a3fefee79efe716645fc0a4
- SHA1 e476336f4a01edb0299c98bc278959edeb9377e8
- SHA512 1d2e6e86ec107ac49115736f4a0657fa5fc5f83911b621152a5616480e407ff790a084d161e8357e2fdb536e15d2451c652625598cfefc96b00055469207ed25
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOOx:A3k03kB56rv
- TLSH T174257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 4e2e5005a03442d2617f4179ccb1885636e80675e436cd7ced34a3b8be6ecf99
- MD5 a210329d2f4da8074886f4d744aeed87
- SHA1 452682a7e4e4a92d5ba6a55ba650c6756804d7b7
- SHA512 de7ef2212eaba804a492b70e8569617d078d6dc99426fe781af317b19dee1313683b6bdcf2131911b6a322c0a4ac028143d985fbbfa87f6504ee19e2634beb44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOoA:A3k03kB56rw
- TLSH T1E0257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 5715d7018ce1a1f9441b2ae806fb44c60a4433d29e22ae332d96774ecea00706
- MD5 d1c6095354a4597c6df5aff4b9c3f334
- SHA1 cadd5a25aa6b90031e060e39a12e38cbc425981a
- SHA512 fd313764200524255415ca221e9eb82487a63b106b3eecad1ab1859386aa057ffc2d5ad53967145941a6e139cc84f2a7481b6eb788e896b7cc9bdcb5df79145e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOB9Q:A3k03kB56rJ
- TLSH T123257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 9d4b9f6bda0a7a631b7e2ab66a77600a1819235ced856772ba02245de99211c5
- MD5 8f2968b1cbdc0d955096a8c588d7474c
- SHA1 37af9b26c94101a1cca1ea507948308416f57ccc
- SHA512 b84c9c9c7dadefef7adfd67df7ab6ed03b3f879c0b8b79d580d91da1bd5d09a4b404c29fa0d496d8ac979949d1b85a7ab347fe7f7af9aa9d148d1ce0f063aa7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYO04:A3k03kB56re
- TLSH T1E2257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 598c184cfc1440df44bfee417fedc43ddcd78906b56112cb397f502b2a53a945
- MD5 3e4e7d40260c0c6c841a3f452c685526
- SHA1 b9b96a43e87c3dc394814e26a3b4df60ac2265fa
- SHA512 55321f6d3485e896a45e08b74aea5eed6deb2593a1862410db4ac1019c8f47ddb5d37bcb8aa952e3ed859e3bac1fbfcead53d1a1f0d0daac52efcaa4fd08e212
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOfu:A3k03kB56r/
- TLSH T1DF257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 6429c94e41a168972935581e74fa716b0037e82d0923a46d72c3739fbb4f5335
- MD5 a74f5a88c034fdb95d58122f5441fcb9
- SHA1 9161991f4c3531f4dbac208e9faaa44922d8f31a
- SHA512 655f08890a154c67134277587ba9403208a9edfe566d6d28a63a343f7b2903bbfb7336e0d78f0a484e1efe1e56e09b6b57955b3384a5daf988b34e24c2881b49
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYO6j:A3k03kB56rh
- TLSH T1DA257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 ff3c3faa5a648441acef67f38d2a8aa5096e70c4aecf5e2a4bb5bbae8dc4e56a
- MD5 62d2f647fca34644509ee934cc4f0bb4
- SHA1 ec898de4ce91515bd425fc7915ce895aeb148343
- SHA512 cee73a4d4a47ac463ae6205c93d4728943648fc44942f07086d4e95f4cfddbc6ad13d0fadf51890d34aed834d36aa70e68fcd870640be8aa559560cc628c0f68
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOng:A3k03kB56rl
- TLSH T1A8257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 d9cf095b529fb294dc7da9bd9ae574548217455593801ede4dacca5e2e65adbd
- MD5 e57843fd53bf2fc0f33e674b0480bca9
- SHA1 bc88d9a5ad47b467dfd8026c6d52d7c5e9d2969d
- SHA512 ca0eb16e2e096301161b5213c9b22103f651395ed65e858c3cb915f4acb38907f96b85dad1be60a628bddc6acf1c3584195c4d0f6b4ce52f45f31de34ecf9936
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYO6I:A3k03kB56rM
- TLSH T14C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 50a48c7696d41d5698104b7fc572814b20e589c50d090fce69ec9efc787066d5
- MD5 b9fae5cfdc08850a60dfd7065843ac5e
- SHA1 930cd7354939eacad16f17977e22b5d34875e13e
- SHA512 800f8363849a66e0bd113c26019eeb0fb822296222940720b1226da50599208e172bdb05951314e1ec03cf1c0d3143ad6831d79871a94f2d815703ce0e31a356
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYO4o:A3k03kB56rO
- TLSH T136257B03E6840FA5D00F81749A954662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 a7a43bcd61d23d785ec8db5e75932d2105d80bdbcd59f68b1b8bf9cec0041b57
- MD5 25d553f648eec3fe31ff753b0723eda5
- SHA1 1eb842193fbff7b843417897e303615504d8cf8d
- SHA512 93a8362c0a11d3f8ac74157e4793a859b259add9d0b14e5062e1cac94109d5972c4bdfad11c7c18e6b68722eac2637909f67a04bf39f532b3090bac11d5b8283
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOL+:A3k03kB56rb
- TLSH T155257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 e1fad57d87d3fcf9bbc827c64822a91163e92c0def02f9f486120e71c855769f
- MD5 5e4c5c7af7499fd61b461cc7c681deef
- SHA1 bd807c986200377f932ccf4848f8a3e84fd0d1a8
- SHA512 6edff8b9cd4b83f2d31f454d27edc25a79cee236204579ea9685f9b3d10621c29abf8203815bdac5c9cc6c29dc472e5c9ded61a7c097349047f26c13b4557dc8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOBQ:A3k03kB56rf
- TLSH T11D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 07ff1766cfd1688446ac73cae6c6c333de85f425c08d5d1e648c87cc5ef5799e
- MD5 24cc563de5ccf3f23ab784618a4c9090
- SHA1 77904cfea214ae8321d361f4cde485757ac022a2
- SHA512 07cb40bbfe8af9a18940c6beaa183416e3c96a6c3aab3900a204fdbaec57c1784665b1a69400efc37b34496d85242be505f7fe551c3f6322fe67a42581c2b95f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOGX:A3k03kB56rz
- TLSH T10A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 c39be26ea797c170b9dfe6a62acd1355566eb8980767bdeecd3720d615bc9af6
- MD5 c007a73fc21aa2b31ca3404718401ec5
- SHA1 7c3effde9606cdc7543f4440b2d29acd674f87cf
- SHA512 7868073249f05b0ee500c0bc523cdc3129f3b559b870dfda5a738c0c25189c5f5875aadf850852ed3b13131d40448d75df5928eab857b6a27dc1e710b20b86a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOAL:A3k03kB56r9
- TLSH T1F8257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 84d387c63e49a1bb978ab4d2f81f1f937ec03ecb52b01bc9f482c28220f4917d
- MD5 22bacd3270bfc81aabe1a82b13f5c408
- SHA1 84b3e57e3fedf6568cbecb7ba48d8d93698bd62e
- SHA512 d162c0898b5cff870748c67443871fcfa96a35ba6b737a31f27c8396538a86dfc51de2d2b9df51fcca8a10bf4258473777b9b1ccde6a747b6e1179af0809f9b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYOsM:A3k03kB56rE
- TLSH T10C257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 cbbf373992043612036593660b484962ce4fc70ee110516d5561b464fd8441c3
- MD5 006ceff88f5a39d273b7e370fbe7f66f
- SHA1 5519144c7818233242847171e059abfeeccf1301
- SHA512 35c73a1350684b2ef272551bb985b75082c32c787336b82f103d956d7188741a3e2008706cc16ce9fea07c53d1483af5f9c19557dcedd0ce0f74872e2ae56ae4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryTmYO1h:A3k03kB56r+
- TLSH T126257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH