Analysis
- max time kernel
109s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 15:56
Behavioral task
behavioral1
Sample
2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 862KB
- Sample260808-tdl8sshq2t
- SHA256 75bac95f5bc8ec8a6952c171f4941ec849a257e732401c608638e51e7a065d5d
- MD5 778d20cf634d0362edcdf36ced865b60
- SHA1 436665353d1cf82675291e5e230d66953fb9923b
- SHA512 1f851dabfb81eb4b4b54f8c50be8033776179fcd93076ff4e863ded997e21dafc60ffee8f9dcbc1fb9399bc9ab68397bcb777afaf2206676e161352c75fbcefd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOr9:A3k03kB56ru
- TLSH T1D7156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/3588-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c43b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3588-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4936-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019857-220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a67-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-709.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-986.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c43b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-60.dat aspack_v212_v242 behavioral2/files/0x0004000000019857-220.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-263.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-396.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-475.dat aspack_v212_v242 behavioral2/files/0x0013000000018a67-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-599.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-630.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-709.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-802.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-910.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-986.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1054.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1097.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1171.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1178.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1186.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1248.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1333.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1346.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1377.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1378.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1385.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1402.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4936 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3588 2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe 4936 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_778d20cf634d0362edcdf36ced865b60_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3588
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 75bac95f5bc8ec8a6952c171f4941ec849a257e732401c608638e51e7a065d5d
- MD5 778d20cf634d0362edcdf36ced865b60
- SHA1 436665353d1cf82675291e5e230d66953fb9923b
- SHA512 1f851dabfb81eb4b4b54f8c50be8033776179fcd93076ff4e863ded997e21dafc60ffee8f9dcbc1fb9399bc9ab68397bcb777afaf2206676e161352c75fbcefd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOr9:A3k03kB56ru
- TLSH T1D7156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 de9e4b4cd8f4bb0c1379b5612c9ec462a84ec0f7b9c8ff7142cd79119eb8c837
- MD5 5c3c5c3084d114e34421a28b5d927095
- SHA1 df52947646501aca8ad19ed3269fda01430a5334
- SHA512 5d91674b283c801efb1b50f3add45aeb498923a712fef97428c0ead35b2d7539ba1415fd085fd1e02ad43138bac7ac86e5d390f72cc35c40c3fbc2c7f441532c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrJ0Le5ji0hmxNrM:A3k03kB56rePji0Aj
- TLSH T103655A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 877KB
- SHA256 d4a2c555e31d4161f7922b0823e056c9ef4a3151bfc8c57edcae820cc8bbb63b
- MD5 9a9fb68d0c3e3a4b6134c2d9246baa9b
- SHA1 db8985af84986376f99744df310413325068c10a
- SHA512 fe24e93d42357803a9e832a7d4af6155557f76192da510831c83db988154557cd5999531f914ddd9ad3d87a3a561e60f1653be50d365b74cf6be11c9c6befd99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrba:A3k03kB56r
- TLSH T15D156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 910KB
- SHA256 bfb8ab6f4e66894b30e5c9b9f135030463139b2bc8ea91568bcbb5b5355ee57d
- MD5 7eb0669c55e7fc83fb36868e6c354fbc
- SHA1 909715535d3214fbae420f26b874c273328a21ff
- SHA512 d1764a1e8b6ff7dc802adb18faf9ad03e58b6b242615cbd14954364fb48429c50a4b9a75b509a2731d3dcc3de196a3228f14ec66f8dd4080b52e423e1adc1a06
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOr4b:A3k03kB56rTb
- TLSH T10E157B03E6840FA9D00FC1749A958662EA777C421F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 886KB
- SHA256 50e457ceb4021d39f6685f220d37561c08d6f9b13ab6676a6b8c27b96d2d5bf2
- MD5 ad6b63d939905dc91b7d98c1bc9629d5
- SHA1 a2255be710c15ad0555a171ad7f998cf90585dab
- SHA512 4a5e6bd13ab6d2bd2b060ecc97e8abb61b9b7f5f5a947262ee499f420af60b25b0af1ec9c64e7894d45c732d54539e86f7ccbf4f77756eda8ad83ee534b431d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOr66:A3k03kB56rI
- TLSH T118156B17E6850FA5D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 886KB
- SHA256 ea95668e6d2615b938b2bc16d528f9bba7775fc9c2755e34fdb4cb5977fa6297
- MD5 974e2699e1c477b2eba9f34a48fc8e6a
- SHA1 85d25f524f13562784e6299789b4d3b8bed95d56
- SHA512 5245ef11b6bec5bd47ea08fa3dc6d633811183bf132a83259b4bf89685e693823e93ec10e33332bb3aeba8f114b4435def80fe9e108a8587e52fc06541588152
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOryN:A3k03kB56r1
- TLSH T162156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 886KB
- SHA256 b518261c59c8aaea5fefbeea7741a244c685869be804940fa954d7eca394a9aa
- MD5 a8022f33afe4cc27651f5197f81a4648
- SHA1 2b5db7ed100cfdadd225da0adfc9c6211f26e103
- SHA512 8789948b103769b001ce82faee24ed43281d15d6c7a487c399a7751915057e1ba0b0c80dcc47e20f0fb733d9a6ab981466655d31dde466a7ba1880531ccdfa21
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrof:A3k03kB56rt
- TLSH T12D156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 886KB
- SHA256 2465ecd1de486fd397766de341b8b188de8d50ae083fa977cfda3c87192c5cb2
- MD5 19f54c23445ea61b8081f982e018f7ab
- SHA1 e1e1120d57cb49b1e8842fbea6688202595ee4ba
- SHA512 c8e85ecbb76094afca56bd4fe1b239ac491202c240221b23c836146b0ef236dc80f95fb9a0f5e3c5735f34a4aa163361d2668994bfd66dff5483f65041bdb0d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrCo:A3k03kB56rY
- TLSH T1E5156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 886KB
- SHA256 fa2327010e539c01cc43caeabb62bdd273663e7f456a2019503d403a7879ccd8
- MD5 bb75450206a2c94c86875248fd9f389c
- SHA1 08283e318138e557a0c1914838a5555500ab3efd
- SHA512 653b2a497a19f1846cc5362b16da240d530ede419ec55e9771ad5741707127145e7233640fbd246c9819ced7e567aebdadc292c38f436835c75d582a5b2ae8d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOr2u:A3k03kB56rq
- TLSH T134156B17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 886KB
- SHA256 e865394a26e3e2069d0f55b0a3bfa5f04bab2fd70b3decc0fe3427dcfd283582
- MD5 e719d8c80a513a64234999936b546e15
- SHA1 af5880c0419837bf3ca4cc63a6d9307ad21bad33
- SHA512 120e5d7bfeb55b6ebb1bdbec10f2d3052f14f0d3e49e62155219167c199d783ce9971dabf5c327957ff16b4c2717947f3cc43a2b12495be6bfaad320eeee6a49
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrq9:A3k03kB56rL
- TLSH T1CF156B17E6850FA5D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 886KB
- SHA256 a7853707afe1d8cbedfa5a1261d52d8de1ff7a38f049489ecce7724428002e83
- MD5 6734aa19988797a639b6a3338efc5301
- SHA1 831a8c750b536dcaea7ad73bac699443825cd850
- SHA512 0176cd30bd0a1ec43ec4bad4c6cf18f9de84018f5e9afede1a79f99e258974333921742f47d9235a8257380114120819fcf5768a66febe7679b7eaa74b84d93e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrqc:A3k03kB56rC
- TLSH T1E9157B17E6850FA5D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 28e638313f7fa67a7b29f73a0473cd5389a0b9caacedf415de889dc4a8a15954
- MD5 56236ec42d089e8c88803cd9547c9466
- SHA1 6140339e228be8884e7d995281f44ef93a42efd7
- SHA512 c1a42cff167590c90f46d1912676cd0c187246f8cda2134186cc016af0de2cbd9dc1fc4e9e76ef65a230e5c77f0c6dc81f6b1ccb59b1c45e94724042a78772b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrjp:A3k03kB56ro
- TLSH T147156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 80e1e2b32b4c99374a21571b46af9341321941ad708b7ca43c477a1a3b7cffc5
- MD5 1c57db18fa2fe1aacec021d4bc695a70
- SHA1 aafd9c5fe71450f38b5b24b31f1e74564f95fe56
- SHA512 0974b14a15dd4618496b6f913f9e984b6a8cee00ec40d33621db8f5aa98a37eee477af4dab24bb12273d18e51bceb462bd3b4b66b7f76dbeab2304027794e442
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrEN:A3k03kB56r3
- TLSH T1E5157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 85d4bae9cdb3eecac33aee2e89265a26d683c84d5bae266d719caa19e722e175
- MD5 27200edd0740dc28f664c26517c9019f
- SHA1 67224dbbe9aa7cd71785f5c82d99a3afb53532d9
- SHA512 5b87a3e5ea66fb364406f1c5f95246645fc64bad054e669c77f92a0c8445fbba6c1ae2d079343934d7846131a323fdd48ee6fef5cf05c9763ddcabd2508ab7d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrsF:A3k03kB56rx
- TLSH T1E1156B13E6850FA5D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 2265af2ac06e38641d4deb5ad08bebb10fe0dd2cef0d1f86b1d59a033e37f324
- MD5 116892230be7c38f56d850891936dd40
- SHA1 4da44d53407fef8eb615df7bc39b2d892cd03e17
- SHA512 1e26d0195dfeda2b9b641a66225c9727875785e4fe5678308677614a76eb5b3d4a855052b558d1629c967db43ee79d8a23f9ddb21655da0773d02449a6c7c68a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrZC:A3k03kB56rd
- TLSH T13F156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 275a5594b14ada3a92ef41bd397facc66e14b68563c9b84c74cf1718f30f9761
- MD5 b80981debd0ec426ccbaca2e3802ae25
- SHA1 2c06aef4a8a31146b8e943a7eb9e8ce8e743ecf9
- SHA512 d9db28a24388b8c3d36a4f67531dd340f0bf97437f3f22752144c8a7c5e210a87d5f0f202e3690d8aa81f73d54ba030643f9da01321e357962337a3807d7d934
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOraw:A3k03kB56rg
- TLSH T1E9156B13E6850FA5D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 532dc974ffee9ced72e493be7b0bad0132a3f5fa5b35676085f229955c5e75ba
- MD5 6558bf55e6ee774def230ee53a8bdd80
- SHA1 7e7b024695bf27aaead1122b8cf7f377c2b395bb
- SHA512 265f62fe47d996620f9311c90f391153a6468b7f10c311a160657452a059410aa3be7838248722da7814e1a072ce0a2a8c5741df4ad6db83caef0df290ba1d35
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrhT:A3k03kB56r4
- TLSH T1A8156A13E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 96e9a14dfcfc5edd1f0fe81ad3c7e60781a669696df9546051198e0b1dd679dd
- MD5 c2e3b0460bc9ffbe530119e7630691bc
- SHA1 ed92a6309a4390140b9e995cccd71887718f158a
- SHA512 7309df7927a5654dd7fc3a38574f16ab817ba9f158525d28538f5a6441390dc869aa69e8029c39c58c0bd32b1049d3037a9980d363d42e83024ecc9cf37621d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrPu:A3k03kB56rH
- TLSH T10A156B17E6850FA4D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 719e1c01b80a0301f3535f901b81a819e290fc83f54ac70e7a94d36ac16e515b
- MD5 e81eb137b6474c9c27a4a9fc0dbc2ed4
- SHA1 d190ef7d635bc694b221aaf6fa42f9d12f5e255c
- SHA512 9b9aae182dc6e411367a739d4ee84fcff33ea3b0a94e6753ce263fb431a47dc5ac3788b6ffb041b01f2ac2117476a2260a322c6bc5099281bb44401ad6b67764
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrzb:A3k03kB56r+
- TLSH T175157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 0f1b0aac48284e05fa638ee100c3bbeae30df4b5b32d9f80e549063431691b88
- MD5 3f8c0a9896c8af2673f3dd88a3241a10
- SHA1 8945e6e72cf5956ee9ed626efd6b408b59b8da0c
- SHA512 d7991d792002aaed136d6f2ff4ab76906b817ff3616f943dea1392335a380cf533ee97b3ae447b02879959107fc728d6750c0cc4cefc5a0f0789f9b19b3f24f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrHf:A3k03kB56re
- TLSH T159157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 09e9207bda9bec2932d3a9f34d5435936f70232fcd7bcec522fafd362d5ad499
- MD5 4c6e70c894c0368d996a01fb2b86ea7c
- SHA1 e15f8aecab951f2c6edd5722352a0515dd7cf39c
- SHA512 ce975313e06d1f64e070dda6db473720538b8ad39e9e03cfefb6787ea622cead5db2038a48817100bc5a2883fda1007d6ffdc2667a4119cd4c231b1c10aa036b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrwK:A3k03kB56r+
- TLSH T1E2156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 21a8997a9bba76bebbe180f7973e54bdcca674153cf85cbed478bc44b5b7328a
- MD5 6200def01ed5f86e61a43def5f9389be
- SHA1 432833a777e897d28b4a1beb3ed5934804de98f2
- SHA512 c3b357bd3ba8ac979a9248590ff177ed7d3fc17ded7230f17827bdc54f6a3cf84cff69f5392e9ffb1a1b45570eef9593f74c42ade842406a357fbf93bdca54f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrtk:A3k03kB56rj
- TLSH T1D7156B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 171a0eb924cc5935367e11831423c9c5c9ef42cf01e264f52b517f0ae80d77e0
- MD5 67d3cc98a087428343ff557097d5bcfb
- SHA1 fbb0046745a54f82af540935ad78eecaf83ea341
- SHA512 cb70649340a88d188ce60d1226331f00d0534a2b3915523274fd6fb67cc63ba489de16cfd7bfd329164e11ca0b6d034d2f5e45ba46158b17e58e97bab344b3c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOry0:A3k03kB56ri
- TLSH T1F0156B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 9dc8d0f1f218e5f8d458b6120d987fe89db40bf639be460733344430e7c7f32d
- MD5 c529f00ec295e83c205e6ce9bd5159be
- SHA1 7180d68d9a8c8dccaea11abad4cc08be1da5ba2c
- SHA512 a4908da3388bf0fb78794d6868f727428e642730e091728f299b612c193f8607f5b43f5b4af4b0f63ab3059f84da25c9c2544ca87446cc2f1f90d4ce8af2ed3e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrBg:A3k03kB56rb
- TLSH T1F3156B17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 30b6df1e286b61c55a12c206525b50de3952255a676f7b20a0c7da7091be0cc5
- MD5 9b5bd426cdce644b7c322a17a2a28a5b
- SHA1 a5c84fa959868d66011dff5aebb229ee2173417b
- SHA512 06f3f902bb38fd5f41acd07903c47151879dd811871f0507ea4c6b96e090ed55e60571d2ea4815d5ae8c9d59362c249edb352acc823910c48960513ad8e44dce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOror:A3k03kB56rN
- TLSH T15A156B17E6850FA5D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 3a59d397064efb4b9f873ed04a44ce7c3a4d0c388281c6837b8af23cf6921337
- MD5 bbcb4c5eeb6de559a604e9fd5cb5c7ed
- SHA1 b7eb7c35bc62b6b7cc0e11af61d8cf3ffd98ed71
- SHA512 9f5098123f504eb15ccd87a436b684933ade0ce72ace524583a69c72897ae43364900e4da5b65b826d30ee227d05ba9c38b4ea823f74949c5605ca7b9641cb0d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrGn:A3k03kB56rP
- TLSH T14F156B13E6850FA5D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 a765e4b9bdbee76a7a2369647892b96f999ba4dfc84ea813bc282ff1036e5801
- MD5 6db15f0e83b07a7dd3c888b15e3a4c34
- SHA1 df77f394d4681b95062f7e71b2acadaf83c32744
- SHA512 b7c1abdecd45fe48f239853125eec18f5e022401c7a08e434079b856bd06d2035a99b9c19501e976e5d840ed519e9e402baf0ca77e4f343b57829d6f6408552a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrMx:A3k03kB56r1
- TLSH T1AE156B17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 debbb16b67e453d660a6b0cf7de7b084b97fd96862e041b9856496725b9e99fe
- MD5 d00d40320c6f010152070ff1228cdbe9
- SHA1 edbeb1822d675dd26ce9f3e06ae28f44600a8316
- SHA512 2e4515673a3916fca589eef8e5176e7ed7fa49451ae8f631901ef0f7b32e0a13d2401cea624cc0b59306805bb234681568f1fb1a7e629293f5e21fe1c378376a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrGA:A3k03kB56r6
- TLSH T14B157B13E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 f80326d0a8c05eba9e48b435fd9824898f764d78b3a4a434bf2b4c25abc34233
- MD5 a5ad6773ef6d253a111bf6216d920db1
- SHA1 d8875bce069ea39140cf2d530bc1a594c8fd2c59
- SHA512 0fe2a2684c6e67bae527e24ecbd9de4c9c173f3d07157c45ca6128180db3c820b512fa25c6a3f2a450479c03248541e20ee708eb7d1a9adc0ac5db4547c7bfbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrf9Q:A3k03kB56rH
- TLSH T1CA156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 51b08404784e11d10005e41d850a2eab2a85f726f98d76ab306a7ca38e2dbdf1
- MD5 495c591b917378eb28664f8860bb860c
- SHA1 6936e7db7dbd8bfc44e9be2da0b25a602e90ca71
- SHA512 566838392a2b809a6154db4ec721dc6d172ba939f1606eb3cda359adf94bdb86bf4137ee5247b9cbdbf100269ba67ed4f8fc20cfabbe87dd2070def014fce8ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrW4:A3k03kB56rY
- TLSH T15B156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 155d77dd40e3222743f1a894023047783745de94247cc082a0466a660244f61e
- MD5 094ade826f90a4e67020db990bb8501c
- SHA1 92a521c3dc5951969c714e3c93d8601cd2d88573
- SHA512 0782b6dc6a7c79db971e6d86d47fd8e2dc0379a0640e4a9ed27567abca0a31b9111e918d8730583064e04baf5c126d33f8de8b7fb9683ea5c93f53789eceee9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrFu:A3k03kB56rp
- TLSH T1B6156B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 4bb7b79cfa9974a34bde41a6a3ea45647038737e3ea4aa22935334f03a45c52f
- MD5 04d994fc0a398c4b24a49d9325437a35
- SHA1 585fce10883b4cf4ff740b24db68454a520d38b6
- SHA512 8cadfd6a4539fc88e241254242f5ebfbad99507a2933c20ecdd21c565991540672b55b11069d72079d7e1a839f1e2dffe5202a6d24672bcee16d3d444c2998c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrYj:A3k03kB56rz
- TLSH T1E5157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 23988ba52483e0a2ea86df866e30148978059bbd0b63c987cabf54afc18d2442
- MD5 08fd6126a0f52e7d82ffb3cc7d8b82d1
- SHA1 fbdb983f4eb1c2e86f41909b068d531ac301338f
- SHA512 fcc67abe49d07d999e30e55a63ddf184d6b473c86fdfc1865f24c746ced1559333a8ab0c8a55f7c2cf0fa6525d96039d845c6670e1f443f1344b8edfeea6a15e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrpg:A3k03kB56rb
- TLSH T1C2156B17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 6ad0775587c541b2d7f85231e737eaf0a3c677ddad5c3ff7470af58f6a8b53b9
- MD5 fedd887419208946552e74d3900adad6
- SHA1 9c4bdfa274f96fad13cfc63bdc9bff9051b1bdc6
- SHA512 d8b17d2c01c3a067733e4b0dbe3d31b36212d8bb6a1d04b91aea2cb119e1700606588d1b6e047f06e12586033d362ec13a130a97027a38badd21e96a6082bff5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrwI:A3k03kB56rS
- TLSH T193157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 556f3e1790dddf54e9f68f494e6ec0f05103457afa9f9c5c3cf42b0743b2e9dc
- MD5 fb7b59f6feacd811f6d9f76e3b81eb87
- SHA1 bf2e351ff560c9b1dec86296cc5ad5f3607d8c8a
- SHA512 9d4048734d82690975bae25974036957facb31023efbf4a986c8325a951a5dd458836b43cc49614953e02c376c2a2c5b6b80402bcffb971b9eb6f8ff0700abce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOryo:A3k03kB56rw
- TLSH T111156B17E6850FA9D00FC1749A958662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 7d7636e07c8330d7c01a607f9fe5f02f9b8c5ae0d0268dad9d61d2689affd015
- MD5 3b95b869c17da0ed0b5986bff5a04abd
- SHA1 63f2bdbb0e8a512a72cc18a5733471549b95e74e
- SHA512 65d32f7b4fdf75adbce9bb9dec47c88eae8baeb919141b19ce49534000ed1d18f7a24d0f783734ddfbecf706e9f949626dc4fa8c951286568de7a171df2e874b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrp+:A3k03kB56r9
- TLSH T1DE157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 264fb4ee70d04e1dcfb76da0ff9b3d95f769deafc6c50ee6253d64b06f4b3342
- MD5 9145c8b65e88efcb3d05144a37513fe9
- SHA1 5a9bda1fea12fbca77d2c4bf51af822f76201f42
- SHA512 c734828d380c7acd62bc5edcc54183f9de480666cf8ba72e4ff2c80babbf0cdf36843c82716c6dc85efccef9127a1b83afcb254dfc603f13683a70788ca5ba01
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrXQ:A3k03kB56r1
- TLSH T1E9157B17E6850FA5D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 21134106ed26aeab9cea7b64e3ad858f263119a03c14d2eb86ec0a44d5cf4ba0
- MD5 9b22ef5097d3a91f21cfe812fb8db513
- SHA1 a400bcf4c87653abf7d6bc3ce9c58ad9b115768f
- SHA512 e4f9a859389725a44126891db03825a3a6d5c2c3d97fcccda70ae4ba7f1a5114c4b5a62c6f1ef4b6f878c56289fa6c5871d47a65c0a10ec049f7b1020514e648
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrsX:A3k03kB56rh
- TLSH T167157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 c01af3e8f1491065a71b7f95a9d6f561cc3cfedf52c5c7aeecfb48842b0aa287
- MD5 768d03aa0fcaeb7c0804e986ff02633d
- SHA1 78b7db74e70fb7254b7b971e0219077bf8966656
- SHA512 cd30645d6946382c51a1302a3b4f237de67c60bb55046e084da85ed2087f622c4c2f3b1b9e103f4320d75c454cb16e1c2fc7f75714d3892e9212a12bd75ac427
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOrKL:A3k03kB56rr
- TLSH T1C8156B17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 c59c32de8512e978313f7baf2733173770a548778398f426b5051d289080893f
- MD5 a35cea59e0c4756f19ccd618ed39690c
- SHA1 0791d07c5e2743f07b6249d5a402b98ec5cce24e
- SHA512 ad9cacbae4ec9d413783cb583a9f5a86d3c5bf316ada6f486c27d1ff089a9f5b4013f5d7bd69e229cece8c1d2c7eb7ce9c4e165cd721508c84fa185593df7023
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOruM:A3k03kB56rm
- TLSH T1C2156B17E6850FA5D00FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 f94150f2c72458df2f934386d201094e0338380d07cea9426a721203490858c6
- MD5 fc672aab340ecd119a4b0f51b8abf3ec
- SHA1 0e1e20a58bbf067da7d14bc107a8308c0011ffdf
- SHA512 6d8773f98f8d582b42454cb0c1ca926dbcee668b77d3ad7760fe9da03822aa129feff8d40a8a3570b32b1f41b88f76cef7fcc1718da46f505439fe6a429b93b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocqjOr3h:A3k03kB56r4
- TLSH T192156B13E6850FA5D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH