Analysis
- max time kernel
106s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 21:15
Behavioral task
behavioral1
Sample
2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 762KB
- Sample260802-z31elsfr21
- SHA256 fd9777eb5fb18b6576a9a4ae6cf984db6c155da9a8d2e1ef6cd29d4019deb4bd
- MD5 c758feacb441ea7b5475449dba50675f
- SHA1 a4be2970e8b0435f59d9995dee41cb6521e21049
- SHA512 13eb977357a7a89a8b4fd514cc51f5de37d4c5751d32a4607d2606986a944a02e8a90e58b1e87cb8c56a28350136253314e2d019e5c8aab6868fd3bd96db5120
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmC:t/sCv7SeKdYD0D5TvinrmC
- TLSH T10BF4271766984FA4C02F913485A54652E733BC1A5F2047CF16B8BF253E36BB07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/4384-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c587-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4384-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3308-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c89-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-591.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-671.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-827.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-923.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1012.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1080.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1405.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1406.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c587-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c89-60.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-226.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-263.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-378.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-475.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-591.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-671.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-827.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-858.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-910.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-923.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1012.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1080.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1129.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1142.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1225.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1329.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1348.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1373.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1380.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1387.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1401.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1403.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1405.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1406.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3308 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe - Drops file in Windows directory 24 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4384 2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe 3308 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_c758feacb441ea7b5475449dba50675f_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4384
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 762KB
- SHA256 fd9777eb5fb18b6576a9a4ae6cf984db6c155da9a8d2e1ef6cd29d4019deb4bd
- MD5 c758feacb441ea7b5475449dba50675f
- SHA1 a4be2970e8b0435f59d9995dee41cb6521e21049
- SHA512 13eb977357a7a89a8b4fd514cc51f5de37d4c5751d32a4607d2606986a944a02e8a90e58b1e87cb8c56a28350136253314e2d019e5c8aab6868fd3bd96db5120
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmC:t/sCv7SeKdYD0D5TvinrmC
- TLSH T10BF4271766984FA4C02F913485A54652E733BC1A5F2047CF16B8BF253E36BB07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 d9674456d7f87552e675ce0d3e6f587ebca4c7c3a61685eab08f6d107c646138
- MD5 973bc9c1890401900a596eb191bb7bed
- SHA1 d5c25913e7f72657d5cbff98fe85836373749b6d
- SHA512 062af1872f8b85f5661675d31967e3d3cc4f3f9142823b4b75bd890ab4666da123ca0e65132ef51e278e9e4976859941f01d4ba54654bbd761a81b279e41cf7b
- SSDEEP 24576:t/sCv7SeKdYD0D5TvinrmC0Le5ji0hmxNrM:xWZ56rTPji0Aj
- TLSH T1E3551816B6684F65D02FD074C5D65656EA337C450F3087CB02A8AF683E37BE19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 777KB
- SHA256 b8ccf5fb6402c07b5ab27ac0cb72e63a34bc5b2c614f564c823dc161f8491974
- MD5 45193deafb714bbe55fb9f0ecead5175
- SHA1 09ea217ca87a925aa17a3e50bdec7b0717a4972c
- SHA512 d4ec4159395911bf88892d8d12714fe9889aeca4b7ca7aabce873ea8343f300827028ff3f51e730c7820e6417bbf8e2938949254ece4bcf79acf0cdda0113f46
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmMa:t/sCv7SeKdYD0D5TvinrmMa
- TLSH T11105281766984FA4C12F913485A54652E733BC1A4F2047CF16B8BF293E36BB07A3D627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 810KB
- SHA256 ef86383f0c4e5fd60dcb3e66b62b86e786cc9b337d929a5a932f5e62d58c5bc5
- MD5 f8b2fe87d77b65ef56973cd661e1ee55
- SHA1 c191da87d704c4593460f1d277ad20130e2d449e
- SHA512 6f2e38a82714a12f30472b6117adfdcc4f7434ff9f5796eae10e18d9e87d6d2b0102ff6eb0a1e7cb5327a9fc2157737ba222555f27529b65c3c5e99c509a2caa
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmnb:t/sCv7SeKdYD0D5Tvinrmnb
- TLSH T18C05381366984FA5C02F913485A54652E733BC1A5F2047CF16B8BF253E36BF06A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 786KB
- SHA256 3785d7590edbd241ed4e210b021c9e84d5dc00921af8624f6f8826918392eaa4
- MD5 3ee69d74fed190526882c0aac03e65c1
- SHA1 0a2b92b7d35a95a410b35fb796b855860120de32
- SHA512 e5019866841768c97c53a0c44d84c061ebada519115ec22039c4232f5b0fadb6016b29706edfbf707362c6942eae0c4dbf0f0df6b52b5f4cb50ad8e7bc049f6b
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrml6:t/sCv7SeKdYD0D5Tvinrml6
- TLSH T11705281766984FA4C02F913485A54652E733BC1A5F2047CF16B8BF253E36BB07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 786KB
- SHA256 1b3f235c31b1fcae79e73b3c79f79e30ebce09e62bcecdf2a4d8c31fad3f6aee
- MD5 84ce21e25977b2f48929543507e31a51
- SHA1 f4c5c8aec22dcf97e49210087b0f775c9ebad026
- SHA512 7c7d2119137d7bdfb4c66b23d1b68acac238a3bc2e64fa21f5799ff586a139c55c7e425ddb8fde72915eb1a6a455308851e050b9af4f02df7e3f253bf2eee37d
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm7N:t/sCv7SeKdYD0D5Tvinrm7N
- TLSH T19005281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 786KB
- SHA256 f252116bc82683a6c01a6a30245f18d45a0ff92983ac9ef4f84dc624ae64a740
- MD5 0bd52a4c02113b8777c98b4580505047
- SHA1 81949a8bc8d7ad15370637cbe1dfa06a1292763e
- SHA512 7abe5cf091c58dba465d228a9775bde446e9f3f2c64848248183500bb279da59bc5ee116e94a6ea3f4c17e6d46d851daf05d81a3c27d41739a3e38d0e2b49a88
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmZf:t/sCv7SeKdYD0D5TvinrmZf
- TLSH T17105281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 924KB
- SHA256 452db73aaac47fa224a2779ad23e2c5620618e12e9e21d1b77516efad6482024
- MD5 caddc89510913d9e3c90f5eb8431e687
- SHA1 0f772e7f1d90dd168fa646c5bed89736be821f42
- SHA512 dc8c4a3c21ba04da658b6dc7702dae38af931efb59d6c6f87d20e4db1f4078ff89700659fb20d256e534eeb9e676c549319f2f06f4a1125b11d238c8f79571b8
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmNyPz5L87:t/sCv7SeKdYD0D5Tvinrmkzy7
- TLSH T10015281766984FA5C02F913489A54652E733BC1A4F2047CF16B8BF253E36BB06E3D627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 786KB
- SHA256 afd4058b784e943c97baa1135b79f09fffc901ba9a71e5f77c2eed5808c69b72
- MD5 8a0af3a1d48b98b01e1522ad7caf662e
- SHA1 66bfb0eb48f9d5bce179f009c86c177b3c0da1ac
- SHA512 8549f3aa466a53f48ff8873f2f995dc05b02a6c97d124376d973585967b272eae75813e8e028dbb5ab523b938e7fb408e6780f70b2006d9a7d790a57e3c505c3
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmbo:t/sCv7SeKdYD0D5Tvinrmbo
- TLSH T15705281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 786KB
- SHA256 ff8490208e07da6c92a24764ce23a5044cff3c8d9f40daf65eef01ac9c64a173
- MD5 35e20b10e5360ea10ca72110424a4cd6
- SHA1 f8817a2e3114ec529e25895a8ddda5e782558163
- SHA512 f390db89db738b6972d9fb91ad22447b44eecbefdae646a96cac488f317905c607c7077fea6db4444b03ae5a0e4f4f7326817a40060c1e7af4e6efd2e1c948ff
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmPu:t/sCv7SeKdYD0D5TvinrmPu
- TLSH T1EF05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 924KB
- SHA256 26ec33781bed44dee6491b4b7c0f245fe807dbca46a85699a95809ee66ca8621
- MD5 84f1011a0ffc6d27ef25a4f46fbb26ed
- SHA1 3757964359c194d25cda4329244348b2a45d1a46
- SHA512 2c9f4156c75843c811c496e6265dab6b660af3a40ed6bf7be0e8dd57cf044ed7a0eb41e2711a4ad731043f13f4a99bf89a4220c8fa7806cd66161aacf5e87181
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmMyPz5L88:t/sCv7SeKdYD0D5TvinrmVzy8
- TLSH T1AD15281766984FA5C02F913489A54652E733BC1A4F2047CF16B8BF253E36BB06E3D627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 786KB
- SHA256 6e29accc775595ad0bfbf2765cfce1f8312756b65af54dfc019b0966ea4bda53
- MD5 1ab5061413ee644b92cdadf3dd664592
- SHA1 a04c79174e3d18d8b2f178a542b35664e5ed6863
- SHA512 e2802d359c5799383c6cbaf77b83cbade70b391439bd35922a453dbc2f28928001fd7a6b0a00b84c054f4f82d699639e4fb18a0fe43610187a522b2cf52b1f1c
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmd9:t/sCv7SeKdYD0D5Tvinrmd9
- TLSH T1A705281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 786KB
- SHA256 a43afc490569811eceaf5d6714480ba3023edbb1c800506cadfaab82d12d1888
- MD5 54d8787e340d164a87eb06dd893ae648
- SHA1 89c12a806c9fccb9d138dfe86ac2b9611bf9fc6a
- SHA512 a5e213caf62c234058ce372b5a7b49bc0694ed895ac9ca732dc5a71075965b2ddefb3655d89e8c23d718a9b1b62e918ed45307413ebdc2fa8bf06da073559294
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm5c:t/sCv7SeKdYD0D5Tvinrm5c
- TLSH T1A805281766984FA5C02F913085A54652E733BC1A5F2047CF16B8BF253E36BB07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 786KB
- SHA256 ce8c9854117970008f08d4191a78572744dcd9f8cdc20f303155dc56cbb01db6
- MD5 767fb7d8e72ba31dc43692aa6c98864c
- SHA1 c1791bb51c339235f5618cbbcff0a330f6d7a629
- SHA512 4a11d1d71172432cd95032ae6a78ad68d2147a246bc4e4ee2f416edbf7ab43189b81153afb23a452a800db893b2721e658b91c111906fa4ff3ba82143b13819a
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmyp:t/sCv7SeKdYD0D5Tvinrmyp
- TLSH T16B05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 786KB
- SHA256 9bdf73e5b60fe33221cd07aeb6ca2c9a50e05018c2fee784dcabe26ae0c6d483
- MD5 d67988b420fcbcc37df01f777299c74d
- SHA1 4615041cdf458a252a6ffc88424f9e4ba6482b9f
- SHA512 1736b1520a57cfa5afc018c6a26a683a9aa97ef19d30e4da2cd5bae38250c844aeb72221a5b444241bf9973a2d7422d43f531d6425f6d96b22bd124d5d0797f6
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmF0a:t/sCv7SeKdYD0D5TvinrmFN
- TLSH T1AB05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 786KB
- SHA256 cfed188bccf38da6c8461ea5231d6d7659816e4b44a38af7d54b77e63a49c949
- MD5 049d486483c533a3f0271f5961f8c81a
- SHA1 b6e04517154a863fd56971b19a62254691deb391
- SHA512 64e79b4d043fc6c7acdd05e393ec1ec9fba65c4bc2e5786d4fe0e98b712f3a463c0b058028d181b39df153268477d33c5fdf0892064a8c7e5beab7e63389497c
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmXF:t/sCv7SeKdYD0D5TvinrmXF
- TLSH T10B05281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 786KB
- SHA256 6a6974984b809eec03dc06f095edd49234ea14c24a32e7d3ad88a8850b789b53
- MD5 9ab8d212eedd152720e80c5118a18c32
- SHA1 0a89ecef15d555c489d68197ef3f01b72c969e9d
- SHA512 c3b8e1af7ac881ac7636c22bd1e3d88967af8be7a5283ddf0c849c20668d79b6ede09c00102acc8a97527a0a4b70eefad39927aecd2f1463090313e4aab7e51b
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmoC:t/sCv7SeKdYD0D5TvinrmoC
- TLSH T18D05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 786KB
- SHA256 e40ac1b981f14250096c60a1e6adb007254bf51720528d78b9c56c3b492f112d
- MD5 bf02d57dee2ea64b939f5513a9e05249
- SHA1 8ad18dcf123b051a0445ef1033dab3ff9d56d7a1
- SHA512 f0446f30948fcef1bf3f53b850e4fc2fe820baf03d48d584f20040bbd458dabc6a572b25b596f9039e746cd110694db1f2791469febc9cb4ed9531dd98a76ade
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm7w:t/sCv7SeKdYD0D5Tvinrm7w
- TLSH T1C905281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 786KB
- SHA256 a129c95481758059790c514f65b7705a365293147e2c1adca2ef0ddcbe0779cc
- MD5 74c1b396aa0505f1f53d60f611988a0b
- SHA1 41c5dd27109872a440740facf0cff02c31bb5c0c
- SHA512 eece74aaf4706271103c0653215e70b362f5c67301595447283842df7b21566c382cc71ced48f3900172add4355383d24a034133554769933eee72ef9bce1df5
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmCT:t/sCv7SeKdYD0D5TvinrmCT
- TLSH T16805281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 786KB
- SHA256 55b6705fa001f49805b82a4d5a1a39b53b7d1183979d66d513d9cbf7f6deb22c
- MD5 b9c5ca706825c8bbfe81864e5ec06da4
- SHA1 e556715792e898637f8769608f4d1f1e86a761f6
- SHA512 2bd08edae402b2278a19dd179c6336bed223439298545d7c6dd30ee3941cbfdbca57a27356e5bffa11efea2078eccbcd8a03cc9be2beac99715604d64170a16b
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmSu:t/sCv7SeKdYD0D5TvinrmSu
- TLSH T1A405281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 786KB
- SHA256 8d99022001a0468c7486334773ebf7d6f7d52d527f2941a74cc715c64433e1ff
- MD5 2145f8386a2b40f3eb260093fcefb8ea
- SHA1 b97c646df82677764e33e699970db17940201c57
- SHA512 c2b4f84fd4d4c053f68d3c41f9bd5b7cd1e49b360a6324bb5ee9a44f4d868bfdca654d7b8656704c7e15eaa51330c279bab4cca0fb3a1d141b593fdb87d082e5
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmMb:t/sCv7SeKdYD0D5TvinrmMb
- TLSH T15405281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 786KB
- SHA256 7d5ef4e59a98bf3860e983a1c1b553cef30d585c7c930a86a1a179f572d60620
- MD5 c200205c5baeadc114659ed25e52a56f
- SHA1 531e0df5cf02e5f05962b87ed57eb89069f2c821
- SHA512 02836f3ecb70a0851f06ef7a65fc897f9ad1a71a638ef973b17c4ab97bbde9a1c154801321c8e62e0791ea3d3bb77ae1a70f920dcdecd418e3f90c15c31499e0
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmyf:t/sCv7SeKdYD0D5Tvinrmyf
- TLSH T1E405281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 786KB
- SHA256 b0b61b83e88d2000c88c6d33cd8240eaedbee50745102935f66a5cf20643cbe7
- MD5 76dfc5e7e48a6a0a6863ee57f3260b66
- SHA1 8cd338649b5bb799bf2a728d2e31a0dd2ea861bc
- SHA512 8152294807d72048da23ccf3dc5093ec5ab09d0cd6fd996804cc7e711e08eabe99501cf645a9a39fb8e64d3c8849d4abb196f52d6a4afc8beefdf4d089fcf2fc
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmfK:t/sCv7SeKdYD0D5TvinrmfK
- TLSH T19D05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 786KB
- SHA256 751ec232f78aa136502a6cadd4ee3c54b483351576a03b0617910bce695f7720
- MD5 2306bf332cff46859856c564524a267a
- SHA1 811a06fee68fb20925c8250553aca508e0fcfb61
- SHA512 1d9e1ccb28284c79fc4c87ba63edae83ddb9480c5283c8c84162e8ba00323f5a2492cbb0c99372456cc564001f2d1242794bf331a99091d7c1a7b476dcefaa89
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm4k:t/sCv7SeKdYD0D5Tvinrm4k
- TLSH T1FF05281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 786KB
- SHA256 c8c72df7097e83db99e979ce20634f5e6337a6774abf18c03cd708b23124bb38
- MD5 a3f2dd511d9a7a6c3403f19690e8aedc
- SHA1 d167fab330297bbb660712002d6367afc094c76e
- SHA512 d99163608754dfbf45a040c295bdfa1c7f04b750dad4b0d95e21be659717600b1552efd0616373c270726610dfada1b46a681d7d0836bd6467f40289fedaf47c
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm50:t/sCv7SeKdYD0D5Tvinrm50
- TLSH T15205281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 786KB
- SHA256 cb5282897b73019f231bcfcf185d619dddbb956c032fd1e1d1d81d2f112c784f
- MD5 464e3a52bf82b39ff2e32739afe09cee
- SHA1 2c5045618608dfab7e74a8719d48d955649c5d55
- SHA512 cc904dadec1b43f823999f9799639257d79688aeb899cfc13936998a2951d38763ef21e9c335ec36caab73e9f283ec2f8ad684d3556b2692e85284cc6547ae7d
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrms70:t/sCv7SeKdYD0D5Tvinrmsg
- TLSH T1DF05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 786KB
- SHA256 fc374e2c16d35264bad0a4ee4fe84b06ddd12ff9a032828b9c911fbf25816e0b
- MD5 fec9474bae18ace7ca7bb661b5698a7d
- SHA1 1222f657ce872543540f1d689d366ecd9fd2cff3
- SHA512 95a14fac44a012d8013c5fe09569994e2edb771fd1ee6a3b45a4881af5af016d7bdaeb21de0a4d8749ae9390925538f0e58d0903e170f17eeb429748d05a656a
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmJr:t/sCv7SeKdYD0D5TvinrmJr
- TLSH T12405281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 786KB
- SHA256 2833bcec1dbdfd57c077b956f09865c7af4f8792f5c1f23b196b1bdc0dc49411
- MD5 7ac488063c1c42d3dcca45fb87757946
- SHA1 e4b191bba1cb6df366eccff4669a5fea547368b0
- SHA512 ec89e42dd17140c2e44a32e0471803cd7893370bb6f4e50e1ce5ecc8ca4fd82f28446d19c33fdfc38fd0cc7cc3feaa8fca1fd803cf175fda61e23e79e84338bb
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmrn:t/sCv7SeKdYD0D5Tvinrmrn
- TLSH T14A05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 786KB
- SHA256 df66ec939714f828e68f2b992fed640c5fe4878e1d64237a70b35ac10e2969d3
- MD5 3238f3dc32e947cdd4d1be33be8088ab
- SHA1 da9fddd4d8b1987b72404b4be50bb161310f1968
- SHA512 8f2fa4a961f984cf4c24c3333252575d50c09fb2683e7aa2956fbf4b0c062bde1f0020e07ef17c56457c94f24d1672891a8bc76c0e6b8153bdca0d046c512088
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm3x:t/sCv7SeKdYD0D5Tvinrm3x
- TLSH T1AF05281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 786KB
- SHA256 e9d7508b2220de2fe257f770d772bd69f2d2e4136d5239906e4b92811f9a7e43
- MD5 1d2e606c0c77e9374baefe1d9a6db8b7
- SHA1 08dc348f01a43c5a0beea0e62d0e435fbe36cc12
- SHA512 04b8a3eaa8d3ec7f42d3cadfe40b398d2aa1b4aa1f08ef7e569da02e01d097aea851de7d0ae0450713b763df8e7d5988ac27656cfb5ad77503fcd0499e3b538d
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmtA:t/sCv7SeKdYD0D5TvinrmtA
- TLSH T1C205281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 786KB
- SHA256 f644e7ce2514ced6586c87891f0d9ecf3c6a70c00d296f0102d1933562b35472
- MD5 3c85dfd91bf2056737f3b3b5c064807b
- SHA1 baf0a46aad33a8ddba46243f316d66462cd393d1
- SHA512 0cf7786dcf74876ae43b0b78c6673123a38c220c3ddfd6533c6d0df2c8b5fc5db5fbb7f793959a2b8468041c9bfa41f01cf25c7dcf5d7afe1a30d605ed2cf4a6
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmm9Q:t/sCv7SeKdYD0D5Tvinrmm9Q
- TLSH T1A505281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 786KB
- SHA256 7e54d126940c19d7f86d8c4929a4fbb1ed05f6d6301556aae113674fc8edfbfe
- MD5 b43cf46d3f8950889839bc06636d21df
- SHA1 613c231a8de626dcb9dbbbb2e371b19633fda97e
- SHA512 5d8ea6dcae075659ce36357b28d4b4c3e000641806fccb17dfc575750e6cf811fdb22f89e58d40acb9ffac3489c3e17abcadc461ee9cc6cb33e4fc441a3dfef9
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmD4:t/sCv7SeKdYD0D5TvinrmD4
- TLSH T1BF05281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 786KB
- SHA256 c348729f8e69bb7dfbe4f976aeda72eeec62a85262fc3992629c9507a2ef44f8
- MD5 af0f1055e57e8368e82a67792f6fdb9f
- SHA1 6fd89f62543c41dcd0bd23a4c9db1c68eb38327a
- SHA512 0f4b66328127dad516eb8e09d7c25c4e5ae4f65c9a8ef75202ada4dd33b4d44fe08102631ed65c74f85c8511a1fc7629538fd919988bf7b4e4d671265ef0c6a4
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmqu:t/sCv7SeKdYD0D5Tvinrmqu
- TLSH T12D05281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 786KB
- SHA256 873ac76ed81f19107aeba4ea0d0eff5e415216e1702a5a9e5773f17a7f1a4912
- MD5 ba06a0be7eb7d759e9f756b403eecf6c
- SHA1 7877d01aada9ab6bd16e156e7f7cee220f4798fd
- SHA512 ae4f2b715fe522b1b5f367c05cd7342aee9cefbe5c82ddf1d4c6e50a8b445de7f0b1803bade1e74520f65d1f74242b51b7080eba62e9d341627b42181cab82b2
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm7j:t/sCv7SeKdYD0D5Tvinrm7j
- TLSH T18D05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 786KB
- SHA256 4191722ba7946558688aa16081139de33504eda9973f2083ca16544e3afec066
- MD5 70d326d98e62cd472b247e90d115fb1c
- SHA1 c55d7231b20ec2e0f89b2627563f25b82313188c
- SHA512 7260e7c347b4fa2d215e6e2487109249e5d56b931e91cb253127a174c091415f22ab588d367fa0c4ebb3d500f320400f23cf48358d43f9bd201b5bc8db4187b1
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmGg:t/sCv7SeKdYD0D5TvinrmGg
- TLSH T1C705281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 786KB
- SHA256 38a6edab9c86f37c4491e38eb0ced8c63d2d5723538d8318a500e599adb88341
- MD5 7bed37e4cd11d3941a124874d4472781
- SHA1 d41ae247535da4f45a56643a3cc7a149e2579034
- SHA512 b6ae352db36a07b6d2449563221eeadb6eb887d9dbf9f2748ec596adf7285be4849532a02c6e7973d37e42b4e8b47c92980a175ae8c1b5008231cae377fe9b00
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmpI:t/sCv7SeKdYD0D5TvinrmpI
- TLSH T19905281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 786KB
- SHA256 7264f8abe6ff0e121c95d043c3f522c4ffb5269d2bb29a129490098033f00363
- MD5 da45aa5901088708deb8113df2a209a2
- SHA1 9b7171bfb663cfa3e76f09537c76bfbaa317db31
- SHA512 522a6ec8c1d415e05885051bfa171312d48429fa49d0d2e4edb243860b4a2cb95b425fd69a9daa39e3e27c53f234f8f76ba24ef028e2da46ee0ca825ba19171b
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmLo:t/sCv7SeKdYD0D5TvinrmLo
- TLSH T1CF05281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 786KB
- SHA256 589346af205f1f76ab0be5a1798047924e22cebc18331d353748db74b753728a
- MD5 5010403fe88bd440fb3de0d7f26107d2
- SHA1 67c7d75137e4e5ae0abc3d1458dac4c0b4cdf584
- SHA512 d9d794a1cc62c258c3c1eebf527df489764adcf85c0adf971123a4231da4822f73986c250efbe39b8d93f17ea04a14aaccd8298ff2ee2ff1e47a45a45cb897e1
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmw+:t/sCv7SeKdYD0D5Tvinrmw+
- TLSH T1E805271766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 786KB
- SHA256 30d799a4fb4343fed919b5cdf4d56a0e2110f0744af9dce2864e5522f166645b
- MD5 07e3b51748e9b1ab1e8d44e7566f30cb
- SHA1 af0dfe995dff2b15121f82b8aa4320a83bddaa33
- SHA512 4ee4866d765868b5d45d966e95796d04cd2de43e3d5e61a096effc23e055d3ad51ed33540b9348d8b8b2f14942d5014fba2dff7803805eed7883ce8b5ffb5e3c
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmIQ:t/sCv7SeKdYD0D5TvinrmIQ
- TLSH T13905281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 786KB
- SHA256 a54e08fc0cfda5d2ddd01bd79e845eeb9b6ae26d82b518568705a56a7945a7ae
- MD5 c6e1ce5b4167398fd8a3603da2ab01a8
- SHA1 12439cd36b3843f8a7014c90bd93251a79d2dbb4
- SHA512 654cd73165ff3e76fa67f2720ab73dbf2cfd6736856cbd177e9d329098ff2a3a1f8ebaf59075b4a8c11904515a1988fd215314326000545bfb9d278389ed719b
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmBX:t/sCv7SeKdYD0D5TvinrmBX
- TLSH T1E805281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 786KB
- SHA256 8f80090d454412a96c259bda6b14f06176311a2d77f23c0cba4fdf5acb8e6ecc
- MD5 e1f201745a491f2dcf6e60ea852e5a70
- SHA1 12c82f7372ed70884348299470d75497ae9ac6a0
- SHA512 753880d97e856b363ff66fbc3867b9e3381babcf35aec6c15c1d3bf36f1e4341d053efb5879bbe29400882b597a4047b0f05996aaf8c0945b4fc1224b15ed5b6
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrm7L:t/sCv7SeKdYD0D5Tvinrm7L
- TLSH T19B05281766984FA4C02F913485A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 786KB
- SHA256 fc300e447c6f5d6746bcc23d539f5a9ebe788eb748aa1bf8e91d2ad0f0c92241
- MD5 d68e77b6729b6c453dd94a2a253e8100
- SHA1 a993fc00264d06c4795379cffdf029b569af00a8
- SHA512 201890cf25fd1c59256e3b2f70d4cf59156762ca6e6ec3714eb6e110efce9417845e33ee471f8566e10b253d4f9fbf1326ea37f98502694c1762754c2cb6a2d9
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmBFC:t/sCv7SeKdYD0D5TvinrmBM
- TLSH T1A705281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 786KB
- SHA256 be83d053d29f099d7a39e6843be3ad52eabc582030fccf27cc86aa5ecf75786b
- MD5 5578971ad8e26d88e9550daafe36bec6
- SHA1 1710463bd85305e274889bc4fff09cbf3a813cb2
- SHA512 79579643620a1eb920bdfae032c3fb79d6b7443880e841e5fa5c9f5b3fc71db5d5ba64bee251e6593e25ea4fcaca96996d04bb599e6ad2e9747790cd32631f42
- SSDEEP 12288:uE/72wcCvRR5uvQ68KdmfEED0D3JeU7vinrmqh:t/sCv7SeKdYD0D5Tvinrmqh
- TLSH T1E005281766984FA5C02F913085A54652E633BC1A5F2047CF16B8BF253E36BF07A3D62B
- MD5 SHA1 SHA512 SSDEEP TLSH