Analysis
- max time kernel
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 03:54
Behavioral task
behavioral1
Sample
2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 886KB
- Sample260808-ef9dsasyfw
- SHA256 68800bea06c3cc347ccca985b3ad2aa9d76cfd21a4e90355eb570321bac0d71e
- MD5 2b8b58b23dbd81f613a4e931569d0b10
- SHA1 a59dc601b461e5cea8b74cd4e98dbb65573690d7
- SHA512 3171ad1a678bbda89bc21405754af1b510d72f5590da03c68c43efb200c92fd45226d235cca5914da2e4c9c41784c8f155bbb751c360651fed560f90bda73291
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSc:A3k03kB56r/
- TLSH T114157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/1180-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c549-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1180-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5756-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7a-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-239.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-285.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-448.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb69-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198d0-516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-645.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-832.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-960.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1015.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1111.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1148.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1161.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1303.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018918-1519.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c549-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7a-59.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-239.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-285.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-448.dat aspack_v212_v242 behavioral2/files/0x000200000001bb69-497.dat aspack_v212_v242 behavioral2/files/0x00040000000198d0-516.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-595.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-645.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-749.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-832.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-863.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-928.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-941.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-960.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1015.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1060.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1098.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1111.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1148.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1161.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1186.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1193.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1224.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1303.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1334.dat aspack_v212_v242 behavioral2/files/0x0008000000018918-1519.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5756 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1180 2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe 5756 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2b8b58b23dbd81f613a4e931569d0b10_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1180
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 886KB
- SHA256 68800bea06c3cc347ccca985b3ad2aa9d76cfd21a4e90355eb570321bac0d71e
- MD5 2b8b58b23dbd81f613a4e931569d0b10
- SHA1 a59dc601b461e5cea8b74cd4e98dbb65573690d7
- SHA512 3171ad1a678bbda89bc21405754af1b510d72f5590da03c68c43efb200c92fd45226d235cca5914da2e4c9c41784c8f155bbb751c360651fed560f90bda73291
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSc:A3k03kB56r/
- TLSH T114157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 938KB
- SHA256 bf42ecfe7601906b641f8d2023c42184be79f1fe8ab871659feb39799d5f26a9
- MD5 32adcfc644311d159365086c9382b98b
- SHA1 d76a4297a6b9f90556d7b67a2bc4a1e383658873
- SHA512 1481d687efed99cb06def34138cfb44977fdcbd569b47dc87b1db3090eb330423c11430ed5b29d245ed6e48f922b32ebdb5becec6f2036fc22d59e8f23649d1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSHfj:A3k03kB56rMj
- TLSH T15A157B13E6850FA5D00FC1749A958672EA777C125F2093DF2358AE153F72BC06B3A29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 4f8066488178b8244ce0e0c886a8091ce504adf1a5d85c0b82d93d685d60622f
- MD5 6f9c0fbb89f42c379f968ff85897cee0
- SHA1 41c8e670c3087a082e7f656690d4550949c0fdb8
- SHA512 ab360387c460b864c7ee27b755b399dd2c05060289a000c5c03ab2e85396a6909649e77d2ee35cbc1ddbd4914f29e32b8eafb30a91b5194262218cbb811ceffe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSk0Le5ji0hmxNrM:A3k03kB56rrPji0Aj
- TLSH T13E655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 934KB
- SHA256 f5db32473efad0ffea72fc3cf77bc169c9a701eea4d24273dae4ee5cb0e180ae
- MD5 0afd9ff62c6e42ffdafe865a14a3eeb4
- SHA1 4a19ce3b2f8bd63e53673ed01f5024079fac785e
- SHA512 a3b416168a0b20e847d5f0a1aac1b5f7418dd4cba6e08f175474cd28d1d9d3129153ccd2a574086d98fafcb9160b2f10cb5dbd2bcfd96238947532dda4d7bfbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSNb:A3k03kB56rOb
- TLSH T1B0157B03E6940FA9D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 909KB
- SHA256 5fad708d622b2c3b211c1ede669bf0ef8385fe6bbc604950c408dda84a91420b
- MD5 833b73306c75929fd334cf853179e35f
- SHA1 02cf9e122fbc8b212bb4a01768960f92254b2225
- SHA512 7cb939161fb17d16e05e4d900e4593b75026faca32d716f5e96241ee6a4aa66734f615d44d4320c76b3bb40f32889ed05a43531c55122583cdb2384cf2805978
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSpo:A3k03kB56rr
- TLSH T134157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 909KB
- SHA256 080e8ce2fd1f69359cab8ee5f7d2173cdb9269df07cb82acde76c6907763e945
- MD5 f50d8bba01cedd056f3dc28d2736062e
- SHA1 b2dbecd3f84b3380a56ed433c5ffc774863da38c
- SHA512 69e5a4813416f80ca62dbfeb0f71abd4118572d2b1ddaf91a2e98e18cb3bdbdc1ed97b0f9917593a11aab7fb87647cd307459f3883f803a03cd83dfbf9d5ddbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSZu:A3k03kB56rN
- TLSH T135157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 909KB
- SHA256 fbf3036b39e2c632f7c22b113a19314beee7c0b3edd8a298c3b84b9810b827d1
- MD5 5a0b567caf09c79d06587671027b141d
- SHA1 550681b0f97cafd61cbcee8369374f1b4b90d2bb
- SHA512 365425f5e91bf72677e275133917836f60e25812962829c3a2cc152f1495196be6e2c80de40d3836ecedad7670274f37cc51b2d47559ae54177e0cc0f29696ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCS/9:A3k03kB56r4
- TLSH T1EA157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 909KB
- SHA256 8be05cd452b40427f6cada9eefbd18643d36e8f0a994ed3f75dd8db49b118074
- MD5 ded39a611dfa8145075cf089825cf897
- SHA1 28d6de196086c1d6e0ec60128863346f0e610fe9
- SHA512 ec355e1cdf56a220a71333010388433a3772bf732aedbd6d765508ed070cc68386337049fc4a7437fb102275b980af25fa0820fab1e9e539afdcdfb3c791fcee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSbc:A3k03kB56r5
- TLSH T1BB157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 909KB
- SHA256 f5611448523ffddec8a064b9153069d260ea8014bbc16786ffe9b600b18ee20d
- MD5 d9d224b96279e35d1064398128702b64
- SHA1 477921113bcbf57e5d81f0392b719179798cbd74
- SHA512 8964f44dffa83bed0e83d9e5c36b84b9431c38715c6978e662ae3144a221e645473e62fac4273250f7ab2e881730d359f72ec75ee2b5b95227a5271c6f7f103c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSEp:A3k03kB56r3
- TLSH T199157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 909KB
- SHA256 33fdbf85a3ed6a8e0fbbb61bb68929bcf794169bbde0b50a56082477d43ea710
- MD5 27bba3511191967bfc7a414c66f0daad
- SHA1 323c6da1d7aa6803efc2905515b09a5d4b0030ca
- SHA512 c0c38986aac4bc40235e718ca28d907e281068a5aed43fa1a62f26f704f9942c2e972e46fe27481ad1473dce57cf6bf1c95eab26f6c4d490dfb90d7a92ed3411
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSLN:A3k03kB56rc
- TLSH T177157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 909KB
- SHA256 3e1d90c972ddfaf282fb561b9875c419d4093c6893ea369e4ccbc2bb0b85b80c
- MD5 bf512ee2cbbe83bff4bfc7225ed056bb
- SHA1 44cfab405ccf8faf2474686c3b228edfdcdb4839
- SHA512 42f4d220c66b703f4adcb4d62d0a796d264202ae5ea01138b9f4c51d2120d5b0d5d06c32607850862328eb68a1945f81f3969654d1d4e19ff8ac70fa3dc804d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSZF:A3k03kB56rq
- TLSH T1A7157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 909KB
- SHA256 814091afb3cce3901319eaa9a6a316a4155e1f5daf610c06d32065b945fd9e8b
- MD5 3d37de41cea4334bf6b29dfa08e6c84b
- SHA1 5079acf0829565229db02b54467fdba2408f7ffc
- SHA512 7562e6b5f4bff5483de72ac8698187737a15ebc74a25e88bc6093ac18bf348508d7e0bd6e783f3bda1dc922dde1ce3b8131333342b9a08696c60e92150af4f2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSyC:A3k03kB56r+
- TLSH T119157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 909KB
- SHA256 40a1623ef4eb264da451a9c06c6ae5827b130100e24769390fb110ff8b8fc160
- MD5 e1a12b1301b221b7d899fa0799b1499d
- SHA1 e9887b8397365c3dd3466a9dbe1bbcbe2e1a140c
- SHA512 37d0a9dc110b84109c4e8a5fc5c64910d76f644aa76144865c1a0bb8da3743883fbbf2817ef6d9bf3fb890910741ef41635be84768851652a2f241839b5b9dab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCStw:A3k03kB56rL
- TLSH T139157B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 909KB
- SHA256 c2977dfaf412e9583c0e734ec845f01cecadc4483b3ba066b1feb9d0ef5efff2
- MD5 c517d10e547250c7185013c619f2549c
- SHA1 ffce3e60a1659f3937cb091507a252aff12b660c
- SHA512 0f6daf00419265583df31aba314513204b2b35313e7df58d91cd2b850d859833bbec0e84391e9450ee4a83eddc5bf3b8b715f6b31ccdeb1cb7ebaa5b40544a66
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCScT:A3k03kB56r3
- TLSH T161157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 909KB
- SHA256 8cae2135d2b5cd2167a42cbec06bfde3054f8779087b23681e33b0ce8f1de0c3
- MD5 7dbec41f2308dc8d7296cf29a5f2f94b
- SHA1 5652b73d0ab139af0844f80211ccbe935a29a3cc
- SHA512 aabb680ad3ef2f359e734787d506724365e284a48b221b2f6868a60d12b5ba4940b1e5d211382bccd7d9eb6ea505413684c1dec2ff0670e11bfc97405566f9bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSwu:A3k03kB56r4
- TLSH T18F157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 909KB
- SHA256 dac19f100e7d9aa46e29e68554e6cf4b7fb615be7dc9e2495dabb1cb225545f1
- MD5 692846afaadd12602d96556c101f06da
- SHA1 6526133bb319eed36bfe196ea17b4af75224749e
- SHA512 0d13839c564db797e894af713b3b22c6aaaba6f4aa6b2031c5cd61cb67e8e69944bca7198ea902a80103a2f71cae0e0423231944e8a1ad80c334b4b63274c785
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSOb:A3k03kB56rh
- TLSH T127157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 909KB
- SHA256 f77267d79249441547015201087cae70a0994dd591e4443a97ffdaedad84b3c8
- MD5 0a15c21374d3044de550a0296f681e9a
- SHA1 9c5bee834afad3ed872b2196fc811edc2832bdf0
- SHA512 805c14652646f4a2e5a77293f7ce04d07908658a11190bf671542e96924b3fadac06189eb9c03a69a90f73e606897d257c43bd6ce9dbdb1799755e4268bf7d36
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCS4f:A3k03kB56rh
- TLSH T17B157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 909KB
- SHA256 440ab02bda085a439bdfcb6ab91754b6898850d0ec60229d22578d471edee797
- MD5 2cc8bb7af3145556da2f6a57fb15cd93
- SHA1 0b8ea8aa8b1ce99a6f47dbdb5fab125950c17bfe
- SHA512 eaf00da367da9e43e2e7c080f4745f8822531884964154e06146e75cb58c06f76942282658a2129b6f2f428e7230ef36a9dde0652edd8f9b875556efec14306e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCS1K:A3k03kB56r5
- TLSH T164157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 909KB
- SHA256 8f708a76f649634bcc14a24e80c82d9c1a2eb9de2afd5703ff6fd88a196a0b0a
- MD5 f86e59cb14353a90a50bf5a7f021ac35
- SHA1 fbc7137641bafb8a81f8ec4adaa8bedc07e9142f
- SHA512 c5e8f5a30f8ad2417c0679672cd82f7df944004d1d3475b37169570b92a89d4f9a55633cab315f8b78a1bf22628768ada69bb3be1afab1d893b65ccdbde3682b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCS2k:A3k03kB56rw
- TLSH T142157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 909KB
- SHA256 6138f08993ce0dbc86ac9a2e16f96f0879d146784ac348ed4f1f47905682757c
- MD5 5cdea74226dee7824ea87d2e45800939
- SHA1 8bcf5205337d1b06c20b0dab2e8ecb5ad286484c
- SHA512 45a246e364f26af26f509f5c4d104b668fa97459d8eedc60aec795335213e29cd0adcaf507c82f06c89725de97b999991bb8a5aacb01982292276709996e0db8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCST0:A3k03kB56rZ
- TLSH T184157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 909KB
- SHA256 6ca40cdebd29ad0c14eaa7a4d677b78632e1f3c204f5c0d471bfda1a805bbb92
- MD5 0bf0703007bdb844d2c5eb892e0345d2
- SHA1 487794abd7b2c7af01881059c4d7ef2ad9ec91cd
- SHA512 8c0b3155b146662870255edf50374d0043b02bee2c068be9ee5c1b1a97ee52bccceb04f98f054dcff8dba393701b074d6a2fd61c415b7d2d6ff43ad1d93e52f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSig:A3k03kB56rI
- TLSH T160157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 909KB
- SHA256 5c58a257ececb2a53a05237255b70d1fa8569dc2e8afb8b14cef4ee82644d32f
- MD5 db5f570f48f70392ab3e31721299e932
- SHA1 5af32a2aac341b136078c6e95dd212668273d9eb
- SHA512 3e480b8b5c90076316ac2d77cecc7333632bbfe30e809beadc3e1f66bfffe1bbbd5d7760a9f643abcb8e6d6c4a64fce443d18b2d691a1c3cf9ee99f27cae69f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSDr:A3k03kB56ry
- TLSH T1F2157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 909KB
- SHA256 5c0969229949664f05428b904c9e2662c116cd13964d2309b8f35acc21023987
- MD5 c20fe0c77b794d5d4076fe61d2d1629a
- SHA1 ef19f79d4f40c48341a07759f001ceaaeafc6d00
- SHA512 8cea86458e441b7c8f639d446eb823632b098b8845b5c1e13d1cf29902df92a3d4db454e8aae1304b8cd415e6af026918047d1e9800fa865ab1da9cce32b38a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSln:A3k03kB56rk
- TLSH T19B157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 909KB
- SHA256 ef0117b072e07a593ca489875d1e90ff4b9e7a36d032f761be55c2206fbae706
- MD5 449e5da34510aecd4f40044e11b516eb
- SHA1 0e9b9089235bffd8283437e65e9a1b20174c0aec
- SHA512 c7118da53b747d4a55301b1d8ebb45fb702fa24d0a7dfd7e3108fac50ad95be087e192903cd62bae2edc42ddd9b0dae2403612a71f8c6c1424e9da47461d2bb4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSRx:A3k03kB56rC
- TLSH T16E157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 909KB
- SHA256 0c32520ebb625347a52d0a992b1fe49895caee3568cce8ca261c63bfa1b1c3df
- MD5 ee872847b9068a1bf6ecf218f9971e74
- SHA1 affdeb25d6b450f7debbfeb8e10494a1c7cddd5d
- SHA512 38dc808e843fd867fddc7939cd0839330e39a64d356fc0afb14221af6e9822551005b1f576cebaa9d5d3478fec23e63d49d217e0b2b5bbcaeaf317140dc46b67
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCS/A:A3k03kB56rh
- TLSH T141157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 909KB
- SHA256 08a6644a42798a8f5ff329b34e05e0be597f96750eb2a4080d1103e19c19a642
- MD5 fe92e4cb0806b7f6fa9cc05b77934ed4
- SHA1 32a3a9200f49f95c9876e9ad53dd424bcfcef954
- SHA512 01ef80d08ec08edf5be3d93f56450dbcf30dd6ec83051dd713c06a40fd14074f644898039ba2f0b0bf609c1f63d8b8327e35831f44e7b1ce9917aede266b0cf5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSQ9Q:A3k03kB56rY
- TLSH T12F157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 909KB
- SHA256 3c8706aed44bcd581cf48cfdc7f256161358ff1eddfe52c55fefacd2bcb2d977
- MD5 990e65f7c13431afe43a01375b1f925c
- SHA1 a84a8f2833bc98b7521b66a9de8493a05e703b5a
- SHA512 726d5c2010ee5d8d0cfce5fc2b3d1a3c2654e769fcff28c40e4af99249f8ae7136f3998d4fed76ec2a864b06aec93482848a5bdb2da2ebcfb3582f3a5609c7c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSx4:A3k03kB56rj
- TLSH T1D5157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 909KB
- SHA256 a1026128c509214a49e3d00195b47351b294638554179250fed7bad6bf19eef3
- MD5 ffb90875632b97993d49be0cb16ad70c
- SHA1 25f05448c7026327e8e425865b2c444a3f459cd1
- SHA512 0be90419214e4bbcc33807e4068255ceb35d4a8785823566e7248030495a2d0230669e3e7ce684f33fe8f8ab06ad30dd72993674d85b1842191e7ef395f43d33
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCS0u:A3k03kB56rG
- TLSH T1DC157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 909KB
- SHA256 1fe0e7406be338db8e833ee39d1dc2585e6816b8c12e8e2ba8b5c223a73c44ed
- MD5 98811c8adefeb7c9210d17033bc7be37
- SHA1 c1274e47527b43a0e15c0e98554c943be0735753
- SHA512 b4678957c237ae35ad4f9c7cb79972655e47667e6d92f8523ce199c4aea5ec00034ad813496d65c081d37e6cdeb744500c7761af86d21c4b5935fc5769704424
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSFj:A3k03kB56r4
- TLSH T112157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 909KB
- SHA256 77543810d8e9c750dff3c79d394aa80ee74a7dadfb794516e85dddbc0956543d
- MD5 e12dd00aba0780f4ff6c85fac52ba970
- SHA1 efde0c4e2e92e8d628424ff5dda1eef802209925
- SHA512 6a2ded327cc0f37f4d235171b2e06fd337cc1f9b51005fe59110b461ff08c14f8f8244390f0953cc37943f270f0af958c7ece3d10094b22ab2efb6ad74a43151
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSMg:A3k03kB56rA
- TLSH T16A157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 909KB
- SHA256 fea0963a398cf4e0d60439c363204da053d91f15d5c244982d43ab181068bf6c
- MD5 ab141bc7dac805096f3ce551a335a2f5
- SHA1 8d18ff9d6a73d10a612be44c8cdb58f5e7f5fecf
- SHA512 b4f2a52084fcea772603c02f983a752e0a89e0c5a8bf6307fa9b95d97dc7d0925f03c69f076fdcc25b272880c7e7b94de56d141b897b9e3b4103f0ff2b0b80aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSTI:A3k03kB56rB
- TLSH T18B157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 909KB
- SHA256 9f77097587c5a10f0ee61ef0d265dcf3e0c490cbff5cdee1e8656eddb8ad894a
- MD5 0fcb412dd07ac98bff846b762051240b
- SHA1 a5830e3f9f10ec0d14f9b857d66b82b7c8464dc3
- SHA512 bda3a16fad00135de16eda94d46dac8a0ba3916aa073b00c01742b3c888565424652d5f4b6afed07adea4f294714db2f3e7cb4d301074dfec50c54d4fda7ba91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSpo:A3k03kB56rf
- TLSH T144157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 909KB
- SHA256 2eedb547898a52a571ac787026559353fc367e3ae269372d3319d4f0f32c6634
- MD5 ef6b6ef0bf20e83927f4e8fa803c7f0d
- SHA1 1e5e3ccffe3c4eb241ea50cd6a7267f730b8202e
- SHA512 3b7bc9c9ab0184daeb5532f61b4462140700102d01958b1275f4fabd17c09133b4ad4e467f47c6ce7be4d235ef36b799355958a4574832ed4f8856242b78b2f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSa+:A3k03kB56rq
- TLSH T1CD157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 909KB
- SHA256 cece7595c62b2d7a9073f47b1eb30413939262d42333072015a749fce9d6abfb
- MD5 d985629dd4fbd9f729f59615614c7548
- SHA1 2b015f491dc7a0d1d7d35b53ec1537fce5c6af9f
- SHA512 1827df964c24430f3b1d687210bad7c301e806506d40412987e32cd6429d260a18593747199c7be851bc32e2dff4f1b8515ffb1d34134a6996c459daf50a6c8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSaQ:A3k03kB56ru
- TLSH T192157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 909KB
- SHA256 26477d1794ecc5e2034c94bfc09eb19c8ed43cbfdac05e743123c6a8ad703e67
- MD5 fb1a584e94b5c168fe16abff4d131c30
- SHA1 f69346d84bc3d98300252e1b8c26dce1738f9572
- SHA512 f3aff75695326a5541efc072d23c62592fffbb54dd2a5852af5dc574ddaee4f93e7916ce75044ffdb6457a5cf9f7f0a6a2f4d12de05bf183ccc724314fc719d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSrX:A3k03kB56ru
- TLSH T1FC157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 909KB
- SHA256 9503493ae4d439762e18d9706c98e42c09cf08b514c7473c1a9c88d787d083d6
- MD5 3ced808ddab7f3fff64bf88ccae0e1cd
- SHA1 6511d45889538e970d3df480520e1f1cc6ded483
- SHA512 d1fe1736a69081a1cf02eab189ee3c9fffb8dc25841e7b55595809b61f16ed99b96db621273e387fd8af4c5ff838003eb11e9575541b222862908e6391174135
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCS5L:A3k03kB56rA
- TLSH T14E157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 909KB
- SHA256 0a91ff64f7bde2f8b05e04f6709ce72b66032a3203c6276aa8948fb7c1604641
- MD5 73c2bbfbaf289b7dea512c0e2dba8138
- SHA1 a86b5375950cbff6fb2cc4e479c848e2640b7035
- SHA512 1dfc959a606750871329078076478ad41d8c93ff69113f1d6a36f3ba5691fbbc63fb6b7f9fe79a8699bf965419f90210926388d3a6e3892d33873545bc4f0197
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSnM:A3k03kB56rR
- TLSH T132157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 909KB
- SHA256 1ac9ce24e7e7231f2196267a975315477a96c07f094293b594a3c4ab8c418a0d
- MD5 d5791779d33a1b432b0625c9ac1ce66c
- SHA1 de64625a6562f8c887581f642b36b49b635a5a31
- SHA512 5bf22d497cc341eb38e2e8b5ac15323bc8016c779fdda1fb83e04d91be8925aadb5c94293abbd762b1bacdbc3b5cbbc5d6e89292a29df56ba2f341b591ded15e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXCSQh:A3k03kB56rj
- TLSH T1B1157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH