Analysis
- max time kernel
101s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 11:52
Behavioral task
behavioral1
Sample
2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 862KB
- Sample260808-n1qa3swdmf
- SHA256 9413000c4d7bfa486e9011b0eddd7fe3d9df006b58d0739a72429702faa49a9a
- MD5 4c0ad4330722e6e0f524aae4c97dd607
- SHA1 23415f356d3b8cd6e95a656d8c1ddc40829d25d8
- SHA512 5174ea5d276f626b60f26bec10ee790c2180396740110cad955ca2aab4d6e4229c828a0012a4ef73ade7bb405c1ddcb3958f085805250cbf5bed09514899687d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRf:A3k03kB56rh
- TLSH T1EA156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/2324-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c53c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2324-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6c-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3316-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a3e-217.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ba9a-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ba-399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bb-479.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3b-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bf-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c1-717.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c2-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-822.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-951.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-1006.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-1080.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1219.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1366.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1400.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c53c-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6c-58.dat aspack_v212_v242 behavioral2/files/0x0005000000018a3e-217.dat aspack_v212_v242 behavioral2/files/0x000400000001ba9a-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198ba-399.dat aspack_v212_v242 behavioral2/files/0x00030000000198bb-479.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3b-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198bf-601.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198c1-717.dat aspack_v212_v242 behavioral2/files/0x00030000000198c2-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-822.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-919.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-932.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-951.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-1006.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-1080.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-1156.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-1175.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1182.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1219.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1322.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-1341.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1366.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1373.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1380.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1400.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3316 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2324 2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe 3316 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_4c0ad4330722e6e0f524aae4c97dd607_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2324
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 9413000c4d7bfa486e9011b0eddd7fe3d9df006b58d0739a72429702faa49a9a
- MD5 4c0ad4330722e6e0f524aae4c97dd607
- SHA1 23415f356d3b8cd6e95a656d8c1ddc40829d25d8
- SHA512 5174ea5d276f626b60f26bec10ee790c2180396740110cad955ca2aab4d6e4229c828a0012a4ef73ade7bb405c1ddcb3958f085805250cbf5bed09514899687d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRf:A3k03kB56rh
- TLSH T1EA156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 eddd60547940142ce7c3d7270bebc712e4aa23e7c5bbaa6333fe014e7c03d39f
- MD5 f2d083b23a4174e8006931fce9f8e24d
- SHA1 bfb037aa0eef05ed90c27536c99dc2f9c10b7c35
- SHA512 2610e130994131c8c90645ffd560e25e268a0e972f04089512ab8a592435a959d41cb72852c164a123d2d4d57e19e957d20f18bb8917175231c3c1b7de4b5638
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRL0Le5ji0hmxNrM:A3k03kB56r9Pji0Aj
- TLSH T180655A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 910KB
- SHA256 42744ad7edcb9c229da1ac6431deb4331cca113793aba77c604494f7d43c70bd
- MD5 1553ace9e0b2288e08c261db29d86b4e
- SHA1 a5d55cb8cf4b88498b8184c0d61ad17bbdbcf387
- SHA512 55c617d0b4c1b496288a4fd548144f0be78c0d2fd52be6c336d49c0b384c9976cde48ae02a62d6d88754c21fe4990154544a96e1fe67c1e3b8be27550d82e1aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRub:A3k03kB56r8b
- TLSH T109157B03E6840FA9D00FC1749A958662EA777C461F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 886KB
- SHA256 a38021e4abc11dd8b90eab82b4b2d73c72fa1498760ec0f6fbe8df064572b80d
- MD5 265996f1eaa1b20b5528808acb3dcad4
- SHA1 ab051bec14238f00aa105b3fa547d0ad93810d10
- SHA512 02afd131dc16a15e00cff6e348dc3da78a29a2fae0b34ae475a196492135f8a68fd933f916f0684900c30ac72868b9ebc6d7ad2fbde6f9347f4c4c8c5ea9ed65
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRE6:A3k03kB56rZ
- TLSH T175156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 886KB
- SHA256 8cc29bad6385720dd34a580051954677f0c108aed9a9d426e07a876389642a8c
- MD5 a48322d044743f349a0e63b79dd2d8f2
- SHA1 add2fafae5a0cfaa9810550066faab32995d2531
- SHA512 826ad69e9aa0757b3aa4267800fd89f72f300e5223359af9557912c071dc7e2a64897af93255598a1d237bd1664486001206425a82c92ecaaf29289bc2e7f8ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRgN:A3k03kB56rA
- TLSH T15A156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 886KB
- SHA256 e412f74b51a87b292152af1ca1eed1ec94309f017d3939d2665935c03521b1e2
- MD5 c064a75b460a5b7b29ed965433e2dab0
- SHA1 2d8dca530c339961d3e4fbd596e9c25ed01ad9eb
- SHA512 91d56e0d3942520f4ff94aa21785611ee64add7ca761d5b986bc530726d985b3855525d04173416f436bf8214b946230b035d11d0e1e1f3b234512f875f9cac4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaROf:A3k03kB56rY
- TLSH T129156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 886KB
- SHA256 02c965fac8af6ae4866969e682888e8b6700b7508230e8d0f35ed725a428a0f2
- MD5 ede63412341af9469bffb23b4bad5769
- SHA1 455fd111a929029e0f5f8453a5057783c2cd8a6d
- SHA512 6725202f85012abc5529934e98cd463756ee9fa401ff2c29f93967a4662a0133fb9b0e58484d01c133d2289ecaa532c65300c20f3769c96c2c8048d2b3cddcba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaR4o:A3k03kB56rF
- TLSH T144156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 886KB
- SHA256 452705b13eaabc861c27a30e801b29452f9aa74fb97a0c8805f1f69fda390fcd
- MD5 9bb7536fdd2e992110fc1274f2b178ee
- SHA1 de434ad34b1117d46cb73d5edb7a98f7805c9c0d
- SHA512 b27fe226eb0c92170c5dc4778135750744db07d022787d6dd5b6bf5bd3592ecac30a12efca53068f638dcca6036a90e2b23bdac3a8967fb212ff953ff7923ac0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRIu:A3k03kB56rn
- TLSH T1A4156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 886KB
- SHA256 7b09bc6b0a9898cecbf140bd05f34799d1b63158496645e204d11274992b876e
- MD5 e5fda8e55bbaa9da9c921942d9b7a68a
- SHA1 572a5b61479db991ccc3ad28ca6ca7804eae6ae2
- SHA512 75b676bc69d5f6d13dc64be92a50c007bad55b45fe9516d92f2fb4286c52a75fd8ed8c4feb501e66ffb4b1c5aedfd31ea2377935db7cb33ee810a7c24766d7c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRc9:A3k03kB56rm
- TLSH T1CD157B13E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 886KB
- SHA256 7a69f4c2ee692d3f75bc43b1160e77d75f588db0013fdfc387f670611997eee5
- MD5 312553c086e4b4487351e3e66126ce1d
- SHA1 25b316fe014e7dd9db3541a90fc50f0dc06d188d
- SHA512 ec2a0a59f82ecc3a7d6adc5940360f65c1f6251552f7510098a2a6a9eedabdae511a60039ebb267b45d1b31542bdf89dd9bcbde4d823f4180d8676d35f890400
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaREc:A3k03kB56rL
- TLSH T135157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 5297175f637eaa1178ec7a7eb1a231a8a3dd3d971e4815ff95dcefb859829fd9
- MD5 c5c2e0f5f346307babdde61724899bd3
- SHA1 ec14e008fed131e40eb0e01528bf108825b0d139
- SHA512 fbeb40901cff7c7237251e6ccdde0db5ff754ac0ac69521aab1c78d8daa2f5e9aa5789971ac793d46efe2ccefeb131f44cff249731ada4c85aee118c27ed83ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRdp:A3k03kB56rp
- TLSH T17A156B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 2120675b8f6360f2e1d759323c3fc532b3974280a9e63ab9f12c3e575f5dbc6e
- MD5 bfa4957f5f4ed99e2790d29988afa44b
- SHA1 7c25f921355eb8587e5be6db56d8433f7d7650c2
- SHA512 860f101a334a42787436c275068b873bf31dc93ba78dabe7bb981aaed744804d6a38bc2cdb31b90f4ebf8d6babae63d0ebd74d1c6e0687a5fef13bf5e42388d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRiN:A3k03kB56ry
- TLSH T1AF157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 88d676c7c766421cb62b8c27f15e3e0988644aff7f0bd4282b80dff1cfd83ca5
- MD5 e45cdcdbc3c94dd93a900c64db86dcac
- SHA1 2d16ec6bcab66a07a594ae6b24926800bf895166
- SHA512 0a372d4678c70f140bcb8ba94c4134979ee9b1aff1c6978cd26c31effe0b90a609f2f56aea401ea30114afe64296039ca692b158649ea60d5a1ab5b6eb813c24
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRGF:A3k03kB56rY
- TLSH T161156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 f11a7125d4a0ecaf3e428c20b567ebdae5c1e2d8f39b6f8ae500db324aa82ffc
- MD5 2786980d31d438beef4e74a3ab60a421
- SHA1 504a2cd8797c76e4963dafe197f5949978ce4f41
- SHA512 4886813a9ba6cc7934554f7e0f704804b3fc3cb8de98e052c2415692fc71ae5c4d95916ee75b3c7ee20035224fe3001eafbd771c40bf2842bebef033dd041bc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRTC:A3k03kB56rs
- TLSH T1EB156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 9762eabef2ce547a376b034221e9193f96777f249bd0399d813605855265bdc5
- MD5 e1436170234579a8e0f6c35cf77ab29d
- SHA1 2ad8b45d8ce1f1cc038b78c1cab7a18712993eb0
- SHA512 6b7d4698b5bdb5e28fb8d8b9664ace97e4b11f66d25f5ac4f17aec01a272cd931233e0fac9efd29ec17859fa4aac8d127132cc6f105836f2059556e25b2a1a7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRcw:A3k03kB56rh
- TLSH T158156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 485fb9fd01e21dcb4d3f39fd8cc41e10f740deb8d67d6e69c82acd227ab272bb
- MD5 6a871934c36fc2c23434bb2503e2c320
- SHA1 d334ae8d062fa72bc0c23680d4c50cbedb817988
- SHA512 5b93fbe78c2c226f3ea0e49c7e08c20fd64cdb2b095eddb4b1a032cf61f3b99cca956b3dd33f419f6606ead94e466540cc1e1aeb64942c7ffc82b4cc790d7e56
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRTT:A3k03kB56rV
- TLSH T17D156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 bf56fa2597a205838211124fdc2ca7d6ff70327ee51ce322338212d352abbe8a
- MD5 de54eea2af99e5dcdba458b46c89bbfd
- SHA1 2593b6a52d19e1e4422adc640e2e5655075916cf
- SHA512 28cca1e4f2eac7ade2a88201a59cc3c6555f0c90816a7ff77d5e0a6a5e479bd64b9d01442be275f4e8b64ef8ab0160a70d9ed001f0b81db69074ca8c9934c7b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRlu:A3k03kB56rK
- TLSH T16C156B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 f5692918477a87efca7b1b5707bd134f067b03b503b18166f014031800a96457
- MD5 370c2cbb18221b79391fd34c7642b5a5
- SHA1 36c5602809d94465294dc976e999b8ee2ff6544f
- SHA512 a0e7e3d0bed7359cbf3738fce82807417f15a30ce89ec1c727eb1e19f5064cfb09651a282900cf9450932a94a266cce3da16ee14656c8906f5b045564d5e5819
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRtb:A3k03kB56rr
- TLSH T1D9157A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 f004d17fe748565051c703bb00940067dfe1c5d814def8e03b31204c6613fa2d
- MD5 227c8916c32e10be672d1726dedbe1b3
- SHA1 d517404109e77de8767367a68ef460fedf3ee665
- SHA512 2c137bc235f7725c816da992eb255ab88ba2b181a5534770e2db83b7ce2d5fc7b38b5c770fe8d56d60ed792c47a4a070ca1debf0825dfe62607f2d1cc7cffcb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRdf:A3k03kB56rz
- TLSH T1C6157A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 b5fcb6cc97c4cb532538e5b97adeb1d9f6de84b740293e99f7b788e5ce19b82e
- MD5 96cd46a9c7a1c79b8631c33462b1d397
- SHA1 501cc4a4de32dd6c679cb95c65e6d6ae296d5af3
- SHA512 704a585fd37358081152805f60c54bcee7540854b7557e5a55f8ddac82cb30e50fd0ad6d70f64d9a71eb059a807f1bd530a432e93d7fb4e2229da97ff4f1b591
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRGK:A3k03kB56rj
- TLSH T180156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 17183ce536d20fc6dfb1ade1af30492bf6e4e2ef04fe43983c1b280596ccebc5
- MD5 5edb79aa8310afa55f3b6b04808b210a
- SHA1 82fcc5fc7330e7f1dcbf5b954dd05c60f8973065
- SHA512 f6d6ebdc0f78b5a37e66437abd3e7760d3786e958351f0dce1b1293bd7c89254792b36020198d9e73a2812a3c007d220ce4f0c0a243b0d0e9b45ba998b696974
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRzk:A3k03kB56rO
- TLSH T146156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 e858641a3f11d877451850cada3aa3d6d94ad18e3f64a2622e2aeb0d14417d49
- MD5 726a82feed00a0924f43e3d64f443fa3
- SHA1 2eb38a596d662d54c1f1acf88a813c0041a6df0a
- SHA512 177856325de6850f2e7d55bbf6ee27318448c08eefe592f21fff948c8d8c317aee0eee6f33a4f1f7a4fafb6dd0c2e3275a54158c5398a0cb9b2b16ee53a4cd6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRE0:A3k03kB56rT
- TLSH T1CA156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 14831112a4936bc0788a792cebdee195eb087c0b4f1b101f50bccdddd00cb341
- MD5 dac7d5f00953b1c15911def749ec4237
- SHA1 fe1bcbc34e6580d9b8a50f9923ef2f30b9009dcf
- SHA512 9886cf22655c8d1577b15b09811203540331faed0aedb085f537914b567a1ed2b38b366cbee09d91144e307216e01d8839cb8a721e642d45ae362fb72f9ef718
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaR/g:A3k03kB56rW
- TLSH T16E156B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 f340b6139962e5aeb48c599307a32f1fbb5a75dbf32d89965faf90975d32097e
- MD5 373673fd6b23cc07cbdd1a0d32de1ba0
- SHA1 8e39c8d201ded822a2e1109cab8fec3f64d9b9f9
- SHA512 54189d46b1b42985b430ea72a25bb008c2972cff18a4fc53976e9b2667889781ab765055dee1e4954a43b8fe9cb6871cdb4c2a67b5086795f32c18da8d96bbef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRSr:A3k03kB56rY
- TLSH T17A157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 e0b731c60bc7a574dcbcc65fdc64302b595c8e22f208a1798fcd2687b2edace3
- MD5 6f3b1d46e7b493bdfc48c9a59a536ed9
- SHA1 c7e097099a7df92d7f8b4846457c1f67502bf594
- SHA512 9e86fe2262eb9ffb2b6bcd20d86ed699ab849230f7d9d48b04abf09d0dc68c03333a80a4540d6f5e0bd55f4b5bde307709ed1bf64d6fb0a124ff9463cf057273
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRwn:A3k03kB56ra
- TLSH T1D2156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 9521d20b0c0672a9bb57eefe75208fc94826445eab275a1d9bc3a0aa3ec11d04
- MD5 2ff62a824b6d767c9c72e95b16dfea58
- SHA1 0030058a3c731df0e3a03a16d5d10c799dab7378
- SHA512 132ae48a07513ad4e7fa86c8869c4bd8ea9d23f593fd1624bda9123c36954900fdbbba9024d379455994a13e84dab7be861e04be16f96d7e3b2b199e2e095f65
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaROx:A3k03kB56rY
- TLSH T137156B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 0bb6060b72a63172f475c34fe1ac7ae4a85727a1ba39b7e1c7b5c4a896f6a18f
- MD5 3a0e73ec5124804c5f34af35f4b164b6
- SHA1 b642640e8081aa97f04ee53522005c00f8a9ecbb
- SHA512 af1af9419bfc660d641d27a655c436b6e7e40e9d918681babfbc458c714bcb57a12444763222603a24cbbd40bc447e0706b99ed780d908bf4cb5b510cb53ba8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRoA:A3k03kB56rb
- TLSH T1A4157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 5c4764d3cd57679dced272ea84497012058c9c508d6266b90ff2b01137ea9589
- MD5 da8964d014b63fe6f246dbeb221be911
- SHA1 9e2f5d0aee4fd488d0b94dce5f155fd8ea2c9210
- SHA512 b57edd3fa3fc38e0cc1905f3026fa4b297ec3a5af6c70413e28fd087e95eefea95b5e26d2a07e019b7ba1b27fa18f217ab8b73255363df4b7cdc5d4f1c322624
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRB9Q:A3k03kB56r2
- TLSH T104156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 475c2cc0ff2051e9a6100683b6b00ce32559cbbc47435bf03469ae99de59cdf1
- MD5 27286ea7e05a47e51420ba083ae457f3
- SHA1 2b8c1af6280da216a58db320e9017fd0beb37d20
- SHA512 ff464d5037e5c539d2a54fe9b644d69dce4879ef4cd81dc572e02ff8e7688918131e1d9ec5733f1483587556aa50400956f24076c93fe336bcc1b8c5f4068390
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaR04:A3k03kB56rl
- TLSH T1AA156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 badb4571602e8986be71ea92013e2922e86f2c498bc23a074b8c3e82bd1b01b4
- MD5 30ad6d03d63d50e9f2a1830180277ea0
- SHA1 4f4b79c4274f5a806576c56b0dc08e9e45fcd686
- SHA512 f38b4dc04be4da3ee73fd7a040045992018db58ee01075472de2253b7c30e77364eb8f3f285824e96485e847562e2c921aacbfd5cb3a3a91ebbb319fa188dfbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRfu:A3k03kB56rQ
- TLSH T1B4156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 7247ca4e7e8c5dc69590de0dd7aa95b52baad2da5c1b4ef9cf2e4269421ffcd1
- MD5 cec39775f2f00a15f7951b18b7bca840
- SHA1 474cf3478889672f5133c8b460798c30f1055e8c
- SHA512 4c6e0e806ac41b17ae123812bd2cd44e7dc9eed42670cd43778f55c0ab721249b90e15778915446311df436e79ec2fe33b427f3ef654f9faa5aedf2730a21c72
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaR6j:A3k03kB56rK
- TLSH T1C6157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 c02d81a96ed5146b04d4681da26b35fae67486c0962d76a3f34e67c04cd8af7c
- MD5 0ab3f3bc988ac4fcc8452b6770dd4da4
- SHA1 e1fd116d4945c701019de66fc524d5f2ad3c311d
- SHA512 1e20ffb59d7a59e1c3ee9e39042de671d4a285d0dcbb3f5d7a35b9a457f8d1a822951dc38e939bf0b839879c4e80121637eb7cec2f007581fb3e3433a31c9a87
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRng:A3k03kB56re
- TLSH T140156B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 3ee3c3274fdf87405be31132c1eac900af2ce79c38bf30d99179be1677e5db1f
- MD5 fd645deb91e22cc74bc90ad3147e09c9
- SHA1 15d11df59e3c6075588590ba5726ca535fe9ce5b
- SHA512 424c592ff366a429f1c9901847f755ea53a294ca096995e1de9b4a5b0ffd560efe1d3719a6413e2909c115172b83a6c1fb59853a51d1bfabfb64a1b0228b9ae6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaR6I:A3k03kB56r3
- TLSH T1F7157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 26ccfc23c6dc8ba149a878f6d7ae376ced0ed6f7e7d8b977c5400801bf2872cb
- MD5 24fbf7c03e0a06be280c8b5083082b37
- SHA1 0c45655547b01a5d43e94f47e5b94e060400a735
- SHA512 79463602619a2f82afd5bf4538304be9a028f43c0a35742e98291f31d77a38747a6bfaa3d9caf497c5e1158d6611ab4e9a54869eb9e9d4d89e37648360ebc8f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaR4o:A3k03kB56rx
- TLSH T11B157A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 4cfbb029ba683ac540f3d06d5bbaf0827f35fc5503b481e5045759d9c4c71499
- MD5 33aa952848236e2f927a3482ae2f67cd
- SHA1 8390aafd4e08ed89efead35a01c89413d19f2cfe
- SHA512 b7d3ec10fd4c94883d87aec9ffeb190d7ea23a4d4ae975c248fdd9740c911d8fe0e0c5f90ba9fa39299f91a68953382ad89a80f37b1b5ffab7ee173b9e6823b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRL+:A3k03kB56rU
- TLSH T11C157A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 a830cf618987d0a63abd3e16692c8c0da5356dbc26f3c2110097f2fcc7f2c0d2
- MD5 56fcbfc3f2f8794d81fc104fc7bba607
- SHA1 e692bc5bebbb63a76d663b121d4dc231ba4ae5ef
- SHA512 326758ca3cf2a5ef8705250e1644e690ad83980ea3039557688ea40cd29a7f39c8cd8d04e37d2a25215aadd6f6ecdec85e5c88572e559e36ac714708f6ac6fd9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRBQ:A3k03kB56rc
- TLSH T122157A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 835ecfbab0979ca10dfc83b95ca934d3ba249ced7d8e4f00e093be4e47195361
- MD5 bc0f924175581a3c5be184435c1da769
- SHA1 f2695981e01589ce51c4ab0a1d65f7cfa9c286f1
- SHA512 ffc6e23d50e224a502d8428bdffcfa8d6963621ed5f0c237ffba50c998f3a8875261cae2d09cfaf81859a73d65de83a8241048e6a6c88de1dbd3f9c0e1419d06
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRGX:A3k03kB56r8
- TLSH T1A8157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 bf504452380dafc4e8377d4a0aa6713f35ed205e1d144acf9a8d3cfc9b8d801f
- MD5 f8dc363d9d7a82e47c13856aff5888e0
- SHA1 e0467341aa3702e9d948ea0433f50e818f02db58
- SHA512 0f4a4197be54b7203f981dfd539491eb00d5a8b5523cf4ed9bac60ca5042fe3d79da1b2590ae4ab5e9753790669792d4e7445f3d159f64df734d8ec0b3d4c040
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRAL:A3k03kB56rm
- TLSH T150156B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 d83ed75c84f4529ae11ba0b4fbb59e5b897de7af868dadfed2c32c40035c8dad
- MD5 3f01a62e7013c0079158fa15dc07f4a7
- SHA1 36cece7e80ea253e65943fbbb1b2009c848aadd8
- SHA512 967e9c98460e933c1eb84d88c1e0a0a6c810e119657fb1c5916e1a53f65e186db2c6ab5484b2d47222d8e76bb72343a12dac242925c78b652d1eed3ed3a555a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaRsM:A3k03kB56rD
- TLSH T18F156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 af435a8e0d1cbb2bd1d6f7fe630a932ba144b3d035e94137ca582a233289e42d
- MD5 336db57ad6fa2f611eddb21e949c4f45
- SHA1 1da28508a1d727170da5bdd92564c0182ea14cf1
- SHA512 3dab8caf2d2f7d441ca73f020c8b1b7110951cdecbfb65270360540684e1573fe72c535321999edc3d6d93e8b751619d42ea9e48405f4b78c0fba8d6aac54549
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaR1h:A3k03kB56r9
- TLSH T1CD156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH