Analysis
- max time kernel
100s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 13:03
Behavioral task
behavioral1
Sample
2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 862KB
- Sample260807-qaf1tswckc
- SHA256 f0adb94ddb3b9cd36efa50025a620d9d0f1e6b9c856c3d538e85ef7bbcd3a71f
- MD5 524c30c2eddda585c0105846a025c0c1
- SHA1 412cf286ddfef4f8c3f5ddf102454662d996ff66
- SHA512 2de7795aa63ecb79ef12aaab25f49f4bd58ab445acc1eedc8b7d9385a42c69b29e78710ea7573bf218ebd7e6e7bab664829db69c226f5b3271c6da9e12b6b717
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTp:A3k03kB56ro
- TLSH T14C156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/4304-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c58c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4304-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5800-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-745.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1152.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001300000000014a-2194.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c58c-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-60.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-226.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-263.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-438.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-493.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-518.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-603.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-745.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-953.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1008.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1052.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1084.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1139.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1152.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1177.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1184.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1221.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1330.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1343.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1368.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1383.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1396.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1397.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1400.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1401.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1402.dat aspack_v212_v242 behavioral2/files/0x001300000000014a-2194.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5800 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe - Drops file in Windows directory 31 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4304 2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe 5800 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_524c30c2eddda585c0105846a025c0c1_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4304
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 f0adb94ddb3b9cd36efa50025a620d9d0f1e6b9c856c3d538e85ef7bbcd3a71f
- MD5 524c30c2eddda585c0105846a025c0c1
- SHA1 412cf286ddfef4f8c3f5ddf102454662d996ff66
- SHA512 2de7795aa63ecb79ef12aaab25f49f4bd58ab445acc1eedc8b7d9385a42c69b29e78710ea7573bf218ebd7e6e7bab664829db69c226f5b3271c6da9e12b6b717
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTp:A3k03kB56ro
- TLSH T14C156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 6958b6abf28363a4efdbb527b8c071c74f7a9eadbe13170ab0f6ee3dcbf356d1
- MD5 8e7ae5c5162530a47026dd78756316da
- SHA1 d35f171cf289529d427444996ba2851ba2634bef
- SHA512 c878efa54ff5cba16b9cdbfb07d3c87790631f374b226ddca2f496a5e0f14a45d5d4bb584692c99b6581671870ac228a4eb2de042c2acc8b5176ce5fc60c4a6d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTV0Le5ji0hmxNrM:A3k03kB56rwPji0Aj
- TLSH T1D5655A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 877KB
- SHA256 e16d4899a0f47ac062ee3100d2a954e3817af5064ccd7629451a0549929979cb
- MD5 81217feb29cc6cc53d7b2cb54fbd777d
- SHA1 de46d1982f32d977ebed5f319b3c51c4320d9459
- SHA512 ae5c629a3622ae231956ea042d823c6f25751e8e9da8d9cf48c650247449b092c888161a29f77d8e3a1cb0f1538be870f60fb410b7351bc1a00b55bffb19ed11
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT3a:A3k03kB56r
- TLSH T140156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 910KB
- SHA256 971eb16dd9c92227b488f6a4ca49dd5198446729464afdec97228fe178f5a4bc
- MD5 a7d1508d32fd90ad8267bfa49de89665
- SHA1 71e101314b9707b67297c0b1303ef7c17a714ab1
- SHA512 bc06f4eb175b5c941e431b66a393b848fd48ee77368ab4adfbd03917c9623fffee0f8c8d1185388dfe852b7c82d8481ed7b4c79f82171a7cc8ea684d2ac1db2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT0b:A3k03kB56rZb
- TLSH T115157B03E6840FA9D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 886KB
- SHA256 b46c4965c0a7754a0fbc97cd630d1b42328852dc7a50c86bd643a46edada4fab
- MD5 7943f08e0faaee673cc5f6ea9484f408
- SHA1 292ed4d56dd70e44de309d47b3a682b80a66f6bb
- SHA512 8e4e085a63c662a2aea8f61c17eb18ae3f8718f077c3bb7c93d37a4f348c9f7d4ea06554aa74520358d87645c096bd694f66a828ed55dd09fa72b097af712848
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT26:A3k03kB56r+
- TLSH T1BE156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 886KB
- SHA256 751907fac3217816144746980c05fcdfe1ce763205f8a57d554d73fe620806de
- MD5 3568c2f493a2aa5bfbaf97946fa06de2
- SHA1 a571b8ae9d3764f3ae128cd377e5f95a4a06de0a
- SHA512 db1e4435e16ead31d448adba041740c793e36451c5966b02ecd68a830c59058796a79df2b4365f71911c569318f74d7498add9233fc43f08f39e00cdfeefb481
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTmN:A3k03kB56r/
- TLSH T144156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 886KB
- SHA256 9c9e57a4ad144cad70a33cf2ac35fef66df904f27e813aa53741f8da00e92604
- MD5 34674a13e2eaf4c4f9888642a1fe7816
- SHA1 1d7af52053bc907d6cee4b75241db788c7728d5e
- SHA512 55fb04f8ca4e7811ca09fcc32228fc8aa783f660845e6bcdd9ef254cce44ed5e544501ea224b84f04d1bf1397f1ea259cb413d16d6b6247582735911eed1b5ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTkf:A3k03kB56rb
- TLSH T124156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 886KB
- SHA256 c1b55b813d44108025312057dc9f1ebcbbdeb73992a1fa001886eb67f44d5c8a
- MD5 ba93c483f528bc9abadab04e3fdd0b5c
- SHA1 0723fa7fec27f663ebeb76e4cc9eb342c62105db
- SHA512 329c340745cd4ee3fddb2dca8f25a0afb4b3bdefeccc97d063692ebf137731814a38adfd503ccfaa41a26f2f40d585e57965ff1a36660c9d2cfee72cfcc56d48
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTOo:A3k03kB56rq
- TLSH T1ED156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 886KB
- SHA256 089aa65e7815e269d5f03310ef607fe48b7da9afcae31da486d56ef2b67b7501
- MD5 3bcc8887b07d7b025ff344e0aa83a694
- SHA1 4d2b72d96a916b33eb5d23f83b97e3df6fcf4755
- SHA512 daa69bf828d9b3198e6ae5d929addafc72650d1beecc7b5fc50a763e13186ea5b312dacf83a44e29d884c3574b63ef3a14fc0c126747a707176d7c9b43a4393f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTiu:A3k03kB56rk
- TLSH T1E1156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 886KB
- SHA256 3a22694102a1ee9c697043f674976db05742609c35755c3b30454e03672899e6
- MD5 df27628f1e46a48dc7d01adabbc8ae12
- SHA1 86796fa8257d919bdbf78aee45398f9ebfebc0a7
- SHA512 b099ba45f2971e38af28c7a59e66e6756a8317d24cfbbd04c7fffb9215a105e010df5917df1549544f9b850696a9409c646a2909965bb22c948e3dcc4a318c07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT29:A3k03kB56rp
- TLSH T13D156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 886KB
- SHA256 c33fc63520803b2534b901a42ef6ac6f95f1a027f134f525b578eb906261477b
- MD5 10ea6fa61bd2c6dff6e07a650c0eca96
- SHA1 9cae11c7e77c17b7a3e95007795c10bc19d7cd0b
- SHA512 9283f9bdcf8ebb3fe7df37fe98f504bf588faf721db30f554dc2f1c6e20fc946131eac99f777f018e21e58efa583321eb493bcd985f3aa985f27740a116086d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT2c:A3k03kB56rs
- TLSH T118156B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 d1df87bb2a223fc4d9841588e21cfbb79c05424327377d7cb17c0a18e634ed5a
- MD5 7f2e82263e398b77f5b9373c18df9253
- SHA1 cf65b796cb40ddbb9d193e457d6731d3ce7f93a5
- SHA512 2082b8f7bbc6741b8a682eaae867096eb6abb8dcc55f8a1ddfedcf0b1ab4c60a61e8b8549d014b16abd277582ef97c5e6cccac181406485cee38e0e8ee6d7b02
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTvp:A3k03kB56ra
- TLSH T1B6156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 0fef869a9f78a5cf65b516b788cc72fd3d83cd2681b66ae959aebc63aa3d9f49
- MD5 d402cac6fa7d447adc2fc4000ed4bb1d
- SHA1 dd5ec436b09601dda6c550c79538b642dcbbf9c1
- SHA512 c2842f1c3eba390283c9061b6a327ba06aba2aec550174c7bc5d5747837ff8156b26b979567c7ae7c7a6ed888db7ea554126ace2229a8a64d54cd89d2ca04037
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTQN:A3k03kB56rt
- TLSH T19A156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 6e3637b4462c134812913daf8627cf1753fe81b72b8dbe0ff74754a0f253c79c
- MD5 861beb34a14db2249da5731ce1318e7c
- SHA1 610dee49238aa18e7fedee9ef90bb2dc9106bfe6
- SHA512 7a705ffb79b9c68203b866d13258da960797239c10b42e37dc15554263387f65e47d8d5dbbf307e5c3deae118c45347a14785d0a5c61fa7a1002b6bf60b1f1b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTYF:A3k03kB56rX
- TLSH T1EE156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 980de6429e89d93b9818b0d85fae593c701582b5d2483c4f6615690c0e61aeeb
- MD5 7062315f3c0842ad465b237d6258503b
- SHA1 ade7f5a92b93180ba980335df64d7552521c1c43
- SHA512 f29695b6865701aed1beba61b6c2a47055c656785693de51e3df92486286a7b2f8108c8067873323487355d128df59a2d92b9e4b27c168f240d42323da22acf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTNC:A3k03kB56rL
- TLSH T1A7156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 8f0d60f1535ebecdc732972ca9174d326b6066d0c327f4710bf45bb38154110a
- MD5 9a6d0d9856b0b99e0af9b0d5fa8328c9
- SHA1 9f2d7ca5ee692af9e12f81083db2b713919813ed
- SHA512 bad793e957596f588dbf83948243cd65d6d00068a66f711d486b8cd4bee9a1f426fb19769e5f9f2e2f8378a70d257498fafad7050ba44186de2b8e786bb0babc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT2w:A3k03kB56rO
- TLSH T1ED156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 5d2078edbe4a79b235ecbc05566484433f325a300a8bb1c530e79e6d2c61557d
- MD5 9c56cb8392ab0a4979c0c509f38bf8b4
- SHA1 c1ad7ede9582e78bcdae23be8b8bc9df472d7c9a
- SHA512 601af3fe8a2bdad6f0a33d2766295b6cf2399f69dec136fa205c00589c79230cd717c13949de4aeca9484c9de166e2551dca826928887c61f30382fcad0e364c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTlT:A3k03kB56ru
- TLSH T140156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 6f799def1e4281f778e4d7c13b58bf73144f9cdbf55f0f0272923c6ea06b707d
- MD5 a510c675afb392d313fd06c9d149da73
- SHA1 42a7c208609e13bb51219131c98f596224dc153c
- SHA512 5f8726d9bf6d06c75060f3848b355d199b3561d694e3f7a8beb0df1a0f18ba776104ed7c7dad2f7d2a4ea278ae5e576b3404a76e28c84f4301dd5cfb90de40a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT7u:A3k03kB56rZ
- TLSH T13A156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 3b4f3040530a35488b46f2f3b3c1c1c870196f2b0ca1d1cc045f771904096d44
- MD5 9c812b960481458a5753eb67f99eeea9
- SHA1 3307f2ce81754be088782c24a7f2dd41b35cfd34
- SHA512 ef41d12d6228d8ae15205a65e00f15ed8258072746e88c8eac83c89fbddb874065b585652b4e748975d35535d33696ee464d1cdf7fa35a7a6e77cf2cbb5fc660
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTfb:A3k03kB56rI
- TLSH T1A2156B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 9fc0f72c3f9fc958e4f0cbad8e21cd14cb7b9323a9fc39df4598345b2374e7e1
- MD5 0a33a5e2368cb1fffae0658d5cb064de
- SHA1 b805e1045dc9d0ce59bfdab282b3ef169ebd92bc
- SHA512 02f1df8722bb6a86bdcf0b1668c93d9052b12b4b0da8c18010b062acc9f54f7500be78a4ba27e686b207afdd09b74739ccb98e11e7d6561f73de604c44515921
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTbf:A3k03kB56rI
- TLSH T183156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 e7ba28614392a6db6a64b1f11955e425a4d235045078c098146c3d4b5bb626d8
- MD5 23729f6b9d687b5dd0054626cf299da5
- SHA1 9bd7c9b41fc18d9d462bb7e6f80a516f65fd2fd6
- SHA512 0a0bcc3b33b12acc7631a55b523056423115b43ea503a331ab085a3f985f2ca7e85a367875090fbc05c1a7a22ce42f6aae0bd160c0a3b640c7e360f374059436
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT0K:A3k03kB56rI
- TLSH T148156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 cf140e4fb72db40ed15531d39586a2f6c72a4142ca63c475ca1647d00f0fe9c4
- MD5 f0e6a5ea5f67b9258a44ed6e5eab9aad
- SHA1 39fb451060ce2419b8099593926bcd20c111b64b
- SHA512 68e15dc77848a041a489411734af883bf75f26c396a1715c8b9909337599b911c91e864f0eb90c837119af93c14194f37b75eecb75a1abce618384f1350db038
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTpk:A3k03kB56rh
- TLSH T13D156A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 34b1c0b0dc458c4b12249387564d4ab25ad5e2a12ae832e2bf1e7d7832a4c86d
- MD5 72e493a6070ab1c62722ac52bab9a39c
- SHA1 075f58be6d2a992e98e6e02b46cce53f7e993650
- SHA512 b4d2abedec1a91564fb04c544c29d8a4001ccbd0c4973da4f5ca0efe8f871547ab95b28b4ee96d11f4f00dab351d6c51f355066f013264a0c4e1c02d7eeef3b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTG0:A3k03kB56rE
- TLSH T11A156A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 500e89b9238278a605745fb7c2b3bca641e6be6d5ca6822efc4e1f341da4e8d9
- MD5 ba0fda4ac462303af96d37ffe8191df2
- SHA1 a9965c86983a67ce3da36c00cfa86c35d98f644e
- SHA512 ece52ef31c3b6f2e211b169c8c1aeb3c1d19aee60a3b5b4a2a54daead4171b86f3021e76ed2d9afdcdf037143084c84a5992c033c6cdef9adfd4244a362534f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTVg:A3k03kB56r5
- TLSH T115156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 20f5d66e859014ae33097269727f82609516f8278c0a8df12c09f5203a55f9e3
- MD5 aecd9b48e9be15a6a280bf62cfc71157
- SHA1 ae9cbfd0abad75352f908cf9ee4332309b0c28b2
- SHA512 d84eeb105b0ae98d437e9b51e99c7f688b6f3982dae1f5a17134710b1b44dca1924c2ab69b522697081c48b24da90569cd0d6c82aadc0eb7b35ca9b782748130
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTkr:A3k03kB56rj
- TLSH T162156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 1fc3df57a0f4b72a5108f43790df411dfd457f735939cd309db574000b3dc035
- MD5 b7da8fac732c5fbf54716c7a7ea7a3fe
- SHA1 9c7471a5b0823359c542ae864c1e55e48d6ecbc9
- SHA512 6d2d29c31c76a9c385b80efe8a9aa0082a8f8f94a3574e796ecddd776c7e7e714d98532a6ddb84969a4a3551507a6a0014b2ad34ef4970425fc44799c14fde3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT6n:A3k03kB56rF
- TLSH T1CE156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 7b24a8084d7cb1ef58a6eccc96537e05b1f7948c82bc62458e93a7f473ddc58f
- MD5 05a4802a61fab8622caa28be6f027014
- SHA1 5e30e8246776ec95749f1e1bf90e4298a48f8202
- SHA512 9237c28d7f73a2b6dd073f61df82ade8ea9156b7cbc9fe9b741009c91ab53148d0d32f20b6aefecf1fe32afd1818e989e3c655b5f27e22b66a735ccc81422795
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTQx:A3k03kB56r7
- TLSH T146156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 d2f8f575ed4d7ee949710018c533e9c2741da5a9ceef26a745e7a41f80cd686c
- MD5 6045b9ffe1af41ecf58528dc15ce28b8
- SHA1 730ccff5ec1b3d486024c9e1700beab04bfc6ff9
- SHA512 9622d7ada588d7cbebc7af5cd2d20250d7b56675bc529404227ae0519a154fba02b7d9b8649213a8082532b5105e1c7f3b6c7ec80cbbd6152d5d21f68504ba62
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTSA:A3k03kB56rU
- TLSH T1A6156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 966f91059208de1c1ee1f4e0bf5a4c70cca49cf00be8e170ec6c87302975c3e9
- MD5 ec9dae827092e3d31c84f66af204ebcf
- SHA1 c09de29b66712ec777523a4c27a24cad0ad3502c
- SHA512 5f0f63637e8823ce825331c144ef857a3840d72400935e75b26a4652b4a1afaed9b9b36b51f2e5ee52e32a18a37fcdfb3e9979bed838c77257d5b22d7566b201
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTr9Q:A3k03kB56rl
- TLSH T138156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 fa4ac1b571964ec3a6ed42b1ccb9f59f8289dcf7a5020ea97c9c9994d1e716e0
- MD5 c71bb8f006d654009e6eff613e8a73aa
- SHA1 f5b7c96582b64b61789bc3858e0b8513e5517857
- SHA512 1e44d1374eab9969af96913fe1d931f82d6e7f6ccd94efac4d3dc2fecb542c3024300e2fe072cd46777d2b51da304fae5c4344dfcb8d1a431e76c00c8a249911
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTa4:A3k03kB56ra
- TLSH T1B5156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 bbb008beec1d145ccb9e36b37d6c2c7099235a028e674dc1f195c483a11b4e74
- MD5 48816922efd3e566ee4e1e51da9f63e7
- SHA1 027aae83c0a53c192581f65bf49c8dc20648af77
- SHA512 de21a6edfd06656f8883f41fe4801c0ccdfe3324bb50a5cb8ae851ff1cbf09a0dea358a6fcade34560665868006a287b92493fcd5f535bfc3be00459f011e597
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTBu:A3k03kB56rb
- TLSH T19E156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 ff54ddc2896dd4998174020fc541b764119c22936cd61fdd0dfb830ce6662687
- MD5 fc3d4347edc3ee5a62992fdb2aface96
- SHA1 42c5eb25a278a573be4f472a1528829040d3b77f
- SHA512 febdffe7b3414e4b09aeb9949708a2ec31662ba55c80585b7e622da684d68386d347600ea776719c89b6791192b6c024537e83ae6ab426e9ee303622bf75556a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT0j:A3k03kB56rF
- TLSH T1B1156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 073ad8617ff4385a6c6619508f29240784ca4b7e85aa71b9bb9ee54b2893c319
- MD5 50fafae0a8bc8a324c386355ec8a79de
- SHA1 b643724920a9de95675ce69b0a678a1eb7245256
- SHA512 05a88f234c1ca29f7d13630b485379420471e9e126e51a53b714fbc45c2ac751384b7f3124de3b0f3a43be35c77fb407cf32080cbc277c911f0e865c6cd6b618
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT1g:A3k03kB56r5
- TLSH T1CC156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 39860a0bd64f6f2f95e96b915b8ffcf70e3af0f11ebf095bc083f6788a907329
- MD5 237fcabfd53be23596e7683ffc560bbb
- SHA1 68cf5e5166c00b4e5b640929efe11dd46c64b03d
- SHA512 8e5f7970dca68ed285f2a3602a9eb15c317e70ec47660c5f17836c5877aade45073333a5022d721347e922ce9bbf5df50c5c41bc2bbcef181bae32adc97be215
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT0I:A3k03kB56r4
- TLSH T1B9157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 e8004a1bff9df0eb5e34afb90786de5544eb59d1c865455c00eafb0b42721ac8
- MD5 538dd86cb83d111a5bc3f5c6de88ac2c
- SHA1 62d3e7a906e19b147244b0d2c9623b42583d734d
- SHA512 0f763122cb40397aac7889db1c6b9f3530a278f00484f19b24169968740cef913605268bb0a52617f181b1ec07c3bcd883e42f71ca98c648688fafe70db7b1ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTmo:A3k03kB56rq
- TLSH T165156B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 cbf38cfee67aac5dcb51c1b36ff739e186a82c86d458e89c9e98f5b8fdf3b907
- MD5 3d3fc5ee0bd616a115b33bb78438a334
- SHA1 d64dab29a915db5685a8844307deb7ca11abfa98
- SHA512 0390a424550a4b28ab923c848e9e56a8bbd5d245f41b8fb8848d4d0f26a06634dcafeaefbb797f96467cc870346d38e811497f46d6b0e584ab7fd558525a5810
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTN+:A3k03kB56rv
- TLSH T1CC156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 921203bf7d876c9a15b463135ec5947f2912996b81a5772805aaa313982b047a
- MD5 b50be3146e7c0fac0d8496bf4408714b
- SHA1 41cb2cbdade7ff15f1cb3239f268582ca14cb6e6
- SHA512 88f7b0a5de9fe7940c804eb20a9e3e59863e2c80f32d91ff4ea1216d08a0091cd4ad231cabe2b40c9f8c12e6040dd6af300a713707ac6d6ffc4476379d89c67b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocT7Q:A3k03kB56rL
- TLSH T13A156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 843e4119d547a0a2eac240cdfd8a52f285cbe7c185273372e1e85936011c294d
- MD5 59b4edcf583addefa052c06bfb404154
- SHA1 9dd6a5915d44b7672eb36933a57a344c4783afb3
- SHA512 736914cfc52d7c181bdc93d8463b05486f955a4ed8feab1e075779580a1e6287fd38472fede0b819a319eecf9cd78b339311d932532d327a1431f40a5ef4a8d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTwX:A3k03kB56r/
- TLSH T164156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 22a00affdbc877977ce15ceb1f7dd8ebc0b3a69d88421f7c672854db057c2b01
- MD5 b7de7b5fd15e7e372f0d959563092958
- SHA1 6e425979873077f3dd76bf2f44a994bafdd1b137
- SHA512 73663ebcd4575098fa78c79a1a185f69124336dcc0f8feabdbb0cfff7dc3857b1fde474c68a14a0e6043af8d8c228823dac6c8eaa2f876e8494e3276e0a691d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTGL:A3k03kB56rR
- TLSH T196156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 b0b079b0c699296e3ce3c526f960d05037f4c336f23b14668ae84ec91011c2be
- MD5 4b6362ee3d1763c7cdf0b6b791c315ca
- SHA1 38df68e04dab485dc4e8e464aed03f014f284c24
- SHA512 0c77b514ebaa1fc326edb6a18d667444eb8710762df673c979fe5d5925d8c4eb4c042ba98f66e36d8dcdd825912abc2343c7241ce0ab23aeb177524adbf5a2a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTaM:A3k03kB56rI
- TLSH T10E156A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 cad7b0cd41d9fd48abccc233c229b86973e63415f8e36e243b72db75cb41e4c3
- MD5 2ae0c9c98aa6b5372a58f017cea94585
- SHA1 33f1478ae1244463f43f3817c4f41a867143cc15
- SHA512 420630d48f0ebac1e80aabfe7e510a7d594dff8ab979cd9b58f995d95ccd6a8abdce4d0338260ff72b6d01eccacd6f185920565b7ecb85f9377e1964eae2da51
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTLh:A3k03kB56r6
- TLSH T1B2156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$
- Size 992KB
- SHA256 65e9ce6d7487294a2a6bd2e2f61ba615808dc5f2463fc5303e9ab9304a5fe1b9
- MD5 d88934ece171551eb556de600fb11ea3
- SHA1 c8d2b8e5961b34076a5d1ed46fe44595c3b92c63
- SHA512 4cd0b74ee4a240d8d82bf99901c59741de38e01d6a084fa8f2e3d0ae2277a9fd9d8981c1de75d9cfc14d97e469b4f65479c1f84deb2e2a8ba9e895275be0154a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjocTf6V2bOteF:A3k03kB56r46V2bOtA
- TLSH T1BF257B17A7D40FA5D15F817496A54562EA73BC021F20A3CF2358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH