Analysis
- max time kernel
76s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 16:07
Behavioral task
behavioral1
Sample
2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 904KB
- Sample260809-tk2xtshp7s
- SHA256 58fd60fac1cc18725b3855772e8054878cac44cd9aee8d6e34c7d5162da7684f
- MD5 b6b75341d39f0c64fb3b199051fe365f
- SHA1 3dc09a5fbf909fc7699d9f48d9505965d49970f6
- SHA512 554eb6d9fe472bdf1408812bdf3443a05f68975d371f96cc5383420d7847b0bd82c98aa9d1f6da2eea31ad94d3936fd583216a88691e18b22b75399034507af7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG9:A3k03kHRJi56r3
- TLSH T12F155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral1/memory/4176-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244b4-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4176-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b6c-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5060-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244b6-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235d5-155.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020295-243.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020299-262.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002028c-419.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a3-480.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202a1-505.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a5-590.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a9-621.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202a7-647.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ad-727.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202ab-746.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202af-789.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b4-802.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b6-845.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-870.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202bc-889.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202be-896.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c0-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c2-922.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c6-936.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202c4-956.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c8-1011.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cd-1054.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020307-1085.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-1098.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020309-1135.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030d-1154.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002400000002027f-1173.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000203eb-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00130000000203ea-1212.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-1298.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1335.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1348.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126b-1373.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126f-1380.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126e-1387.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202b9-1506.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000001e6bf-1632.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000233bd-1728.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244b4-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-11.dat aspack_v212_v242 behavioral1/files/0x0003000000022b6c-40.dat aspack_v212_v242 behavioral1/files/0x00070000000244b6-60.dat aspack_v212_v242 behavioral1/files/0x00020000000235d5-155.dat aspack_v212_v242 behavioral1/files/0x0003000000020295-243.dat aspack_v212_v242 behavioral1/files/0x0003000000020299-262.dat aspack_v212_v242 behavioral1/files/0x000300000002028c-419.dat aspack_v212_v242 behavioral1/files/0x00030000000202a3-480.dat aspack_v212_v242 behavioral1/files/0x00040000000202a1-505.dat aspack_v212_v242 behavioral1/files/0x00030000000202a5-590.dat aspack_v212_v242 behavioral1/files/0x00030000000202a9-621.dat aspack_v212_v242 behavioral1/files/0x00040000000202a7-647.dat aspack_v212_v242 behavioral1/files/0x00030000000202ad-727.dat aspack_v212_v242 behavioral1/files/0x00040000000202ab-746.dat aspack_v212_v242 behavioral1/files/0x00030000000202af-789.dat aspack_v212_v242 behavioral1/files/0x00030000000202b4-802.dat aspack_v212_v242 behavioral1/files/0x00030000000202b6-845.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-870.dat aspack_v212_v242 behavioral1/files/0x00030000000202bc-889.dat aspack_v212_v242 behavioral1/files/0x00030000000202be-896.dat aspack_v212_v242 behavioral1/files/0x00030000000202c0-909.dat aspack_v212_v242 behavioral1/files/0x00030000000202c2-922.dat aspack_v212_v242 behavioral1/files/0x00030000000202c6-936.dat aspack_v212_v242 behavioral1/files/0x00040000000202c4-956.dat aspack_v212_v242 behavioral1/files/0x00030000000202c8-1011.dat aspack_v212_v242 behavioral1/files/0x00030000000202cd-1054.dat aspack_v212_v242 behavioral1/files/0x0003000000020307-1085.dat aspack_v212_v242 behavioral1/files/0x000300000002030b-1098.dat aspack_v212_v242 behavioral1/files/0x0004000000020309-1135.dat aspack_v212_v242 behavioral1/files/0x000300000002030d-1154.dat aspack_v212_v242 behavioral1/files/0x002400000002027f-1173.dat aspack_v212_v242 behavioral1/files/0x00040000000203eb-1186.dat aspack_v212_v242 behavioral1/files/0x00130000000203ea-1212.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-1298.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-1335.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-1348.dat aspack_v212_v242 behavioral1/files/0x000200000002126b-1373.dat aspack_v212_v242 behavioral1/files/0x000200000002126f-1380.dat aspack_v212_v242 behavioral1/files/0x000300000002126e-1387.dat aspack_v212_v242 behavioral1/files/0x00070000000202b9-1506.dat aspack_v212_v242 behavioral1/files/0x000800000001e6bf-1632.dat aspack_v212_v242 behavioral1/files/0x00030000000233bd-1728.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5060 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4176 2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe 5060 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4176
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 904KB
- SHA256 58fd60fac1cc18725b3855772e8054878cac44cd9aee8d6e34c7d5162da7684f
- MD5 b6b75341d39f0c64fb3b199051fe365f
- SHA1 3dc09a5fbf909fc7699d9f48d9505965d49970f6
- SHA512 554eb6d9fe472bdf1408812bdf3443a05f68975d371f96cc5383420d7847b0bd82c98aa9d1f6da2eea31ad94d3936fd583216a88691e18b22b75399034507af7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG9:A3k03kHRJi56r3
- TLSH T12F155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 957KB
- SHA256 bec026fa462a028006f5d16f5d5cbbc71ed0a876e88c390520c3ce92813dc431
- MD5 daeb753aff594b2837a1a760ad0ddf9f
- SHA1 12344d2d30b041e1e0e34cfb274010a034f02c55
- SHA512 b0fe32775e451912e1b062ad25197b65e63218b9aa5f74cff72e924d0be6a7594f280efda6e2fdbb599e0cf93081d81f16b7c282f031d9a93301f624912e07c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG8fj:A3k03kHRJi56rEj
- TLSH T1B4256A07A6890FA8C01FC1748A968A62E7777C115F2097DF1354AE263F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
- Size 1.0MB
- SHA256 b39351b6732828ba8bde9484325a8ae24f2684800a5f340301c911c8c024d248
- MD5 56fd03612cc1df62bcfd534b9a79db29
- SHA1 be584376dd43a8bf23051d94d5e8e409b56ed762
- SHA512 a2d8961c42781fb8215e6aa0920c31549857c5be7d9bb3bab646def19e0490cd52f2c4e69a6db057068e8c3703cffaa7cb7b012b1b8a7c660616728fd30c2d7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGIGen:A3k03kHRJi56rpI
- TLSH T1EB255A07A6990FE8D11FC1748A968A62E7737C110F2097DF1354AE253F72AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
- Size 1019KB
- SHA256 4c86f22cbb69c4287bf7929713cbf63b7fcf477de4d86bc496f63c18af86701c
- MD5 c16bb328e7dead92edcf8f1dcaf1b07a
- SHA1 22bd252b8ab37059f5e1280ccf6f8c4089cc7c39
- SHA512 a1f7f7545bd2114d5c8a4113ee44f8fbce28463bcdb93f8522359dc36872f985a9aa6fbc3e8700dc3cb0f8aec4ad2692aee807b20adeff5cb47b46c27edce08f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG/TjE:A3k03kHRJi56rtw
- TLSH T119255A07A6990FE8D11F81788A968662E7737C121F2097DF1354AE153F32BD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 6d83217722473873d22ebb5bd9534e68204a2f3fe3f8210807428e4da4b11058
- MD5 91e19c7aa2faa17decbea300741f076f
- SHA1 c465c8818da9328d9f80655baa7bfa5c896cc8bd
- SHA512 33d8870a5cdbf5de5fe357c9da8adbfc1d296a1c75583a9160be636f340cb50d08e1adf6f1263ada87b40d5a0db31839e327bfabd31a747445ddd7f1a3650473
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGJ0Le5ji0hmxNrM:A3k03kHRJi56rzPji0Aj
- TLSH T16F655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 919KB
- SHA256 f21f0ec78c635afe97fba50f723c56b0cc0d54d4a16df3a53e4603ae31da405d
- MD5 e071dd31f41ffa3ebb39268835f877a7
- SHA1 573216841e19816949983534af2848fb709010b9
- SHA512 3fb3724bd6dc55b7b97b690979e855027a851d960ccab9a849f426d8a262a7bc2ae40a6d28da4915cc1f8a535a6b707908c4c7fa945fc099d6f21d75dfb50e46
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGba:A3k03kHRJi56r
- TLSH T155155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 952KB
- SHA256 abd36350dafb6a68cc6f07f3a90670d8f906c47373756c838facd7c798afcffe
- MD5 2de54dfb905272c558ffa7b580e4f6b7
- SHA1 8b11a1a9b0bfe3083085c6d9276f07f1ab35ba52
- SHA512 054ca2de87b07ff98aa82e1946a45415530ff450cc1faed22376b7f4d6e3ac1ebbd041eaecdee69d177de02f853fda858aafcaa6747e3c30ba0fceec8db9fced
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG4b:A3k03kHRJi56r2b
- TLSH T161255A03A6880FA8D11FC1789A968622E7777C521F2093DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.0MB
- SHA256 b5ea555f212289c0fe6c692eac8e92cf6181ccfce5ef74ee3a8081d67b0d9f92
- MD5 42038ff607095b8a19e7eeb5b64296f2
- SHA1 0d00521feefcd03ac2a6213d8eb25bfe3e48ad8c
- SHA512 c1dc6628ab8fa49cb2b261534d6e3c263e4ead648a6cb2c55d6065970abcecc54acda588aed50301802ac9619bec8d2fa4b7aa7244d4ccd95dc50f50b280cafa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGSD:A3k03kHRJi56r0
- TLSH T1C1350516E2980AA8C01F8174C7968662F6737C155FE093CB13D4EE3D3F72A906AF9653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 928KB
- SHA256 8d3b389218a494233461be710db2aa64b84548a47bb9ca9247b65349a494e84c
- MD5 72fc2fd8c3727aa6007a545608f84526
- SHA1 98aac4a18e46d507ab9f73a2d1fff2c9f39673ab
- SHA512 eb70c96eebc2735aa41b4ec3766eef58b196ba063c365abc9cf56de2e63e450687b94e398c815bd2d6ddc8d565e618cbf1093b555f61cab83e2ed93daf19afc0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG66:A3k03kHRJi56rb
- TLSH T13B155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 928KB
- SHA256 3e3e25852ead5f6512836caa70030c346a68dd1e16a5405088c3139c1a247166
- MD5 94806802ab701513fa1eebc76d1b4a64
- SHA1 56011ba61cd4d92ec905f470283ffd7a3c83abc8
- SHA512 0348f4baa13527aa9db6e417048472bccd6211680c7a79bdd376212b7a797e0df16f76c884e0514399c1499b6529cedf063c837facc84e104a6f73544c27ca4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGCo:A3k03kHRJi56rD
- TLSH T195155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 928KB
- SHA256 066135ad63ebcc7e9033ffb1fee073205c70720f3fbbc347404c9c3365bd97e2
- MD5 21e221d9832dd96285246dc33eb45a77
- SHA1 1e94635ed9cfa63aa7916dbdf692782b3d02a574
- SHA512 14fcb4ddc27fd577d8905f30e790d33554dc757807bd09093d9dca9c41dc05b7c1e095ff6b4a9fab557b2986d88c99fc5ea31dfa51f549615a5d155f8deaf774
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG2u:A3k03kHRJi56rV
- TLSH T156155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 928KB
- SHA256 03bf590358210f4be5e1e97320af4367c0a192eed51a54fad7a20c929b4c917b
- MD5 21dc4243c598d6f4c0f47c7bfc811aad
- SHA1 501f4768aa8e21aea44b2d9092baff26c4583f91
- SHA512 0e2b7e506e4bbfae14fd76461b3846d6067cf77e44cd80508c25174b7656921222f11976224b07748442c6a87a37f197ecef3b1be3fbe12ca9afe86ab6dfdc17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGq9:A3k03kHRJi56rg
- TLSH T183155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 928KB
- SHA256 76da5fbf4189136c211a889b36159165823adc7f6e060f4b4cd07f098d5bdb37
- MD5 66481b9e25d8587ad962c2d42b2894a0
- SHA1 84f10d95adab50f8df5d24dd29ed94d5c2cc412f
- SHA512 6029ec9de31efebe80b9d743815dfce68428a9b3b3500bd9825a84b8921a09b5ef7e7bb1af9b8dc82877df11a141c59bf5c9884aa46cc16e2939459a76bab722
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGqc:A3k03kHRJi56rR
- TLSH T11C155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 928KB
- SHA256 11cc44e80702a0dc0d4de16d4bf24c9f20bd0247ace70b1e6593609d3504f040
- MD5 37017b9e04d31c1a8b76138b7720a7d3
- SHA1 9630626dad14e65c1ba0a0fe85bd9eeff0671d55
- SHA512 2715c2193584c9e5a64d68371d75d9abbc7f319eb80f093156622966abfb6b6529c289d9557a7039de961db24aa9d8b5dc0f438329e6a7d2650edb60cb2078ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGjp:A3k03kHRJi56rv
- TLSH T1F1155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 928KB
- SHA256 3a4e51a60ecd29934e0dfcdbaca1eb25fcbd17a5ca997d37577c2fbb33e0bd18
- MD5 0b30edc703231a54113585cc9ef52a9d
- SHA1 0792f693f156b031cd3e6a70b5267152489a4668
- SHA512 87dccb163a85e7c7577c65a551cbe8a4387f70ccb8e2fca09a147853564c8e7d118cea80f06014c74c031d9c43d97a68d75b1f8cdde798b7e1869857bb32396c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGEN:A3k03kHRJi56rk
- TLSH T15B155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 928KB
- SHA256 48a12530d6c86489bbaa7ac669662dba6f9aa764b98e2729d25cd2820b05540e
- MD5 e54d3aeb6f0f8ae807dd10990f4e5aad
- SHA1 0266d200abd99cddbf04fbf9f0f6fb9e099f3d24
- SHA512 51bb52a8418a500408442b0338d6ae4bc746f6ab56a51fce3185dd20432a8955f03232bf249eff5f73ff9ab01ea910e0731c884ad8d35b2eb79fe8b12ae8e3ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGsF:A3k03kHRJi56rS
- TLSH T1A9155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 928KB
- SHA256 c045d74d750d407fccf36c2b06546e1f0ed2af09bb979a4560c8dfc3fcc8b5eb
- MD5 ca35241626d559baa8ed1c52266b6ab7
- SHA1 c563ce2e235b12d76ac1be8fa5dc0f5694633bfc
- SHA512 997681a7e4d15a4f258ea11569515f530cbaf4a03bf10f5769383c971c9492c35f41a8d1fac9970d96a8e17208d309734a93a5808a7f4b38385c2827db15c42d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGZC:A3k03kHRJi56rm
- TLSH T17C155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 928KB
- SHA256 6e023445471b6354adbefa43db531f2b62a6c8b62df58c1244fcceffcb234127
- MD5 c2a4556c441fa7d51015e56900bb172e
- SHA1 1e767b69126f75ac699e642ba714e057ededb9c3
- SHA512 e7752a98e6f1f3cb24e5ae1a024adb5e11afea0d659f5a4f664a9ab542dd10a2cb4be588efda057a4e401432ee980977d6e6392953b766525c04300484129bc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGaw:A3k03kHRJi56rT
- TLSH T176155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 928KB
- SHA256 8d91ccd4244749e01ab0ef0694ebe49b853c66c421cb4e4cc11fa65f90d3eea5
- MD5 20f79d46d605ae2781f8653f83e422f3
- SHA1 f92d65f030b1254164d1e44850b96b3f761f0dbb
- SHA512 4f42400ceec704600a5b11a850c663053c2216f42184dfec614aa7b284b68f92ef46b8d06965640c5d1b15a1a2cdd91b92d5c312ab6a90a878194d527fb387b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGhT:A3k03kHRJi56rf
- TLSH T1C1155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 928KB
- SHA256 974913df1a762dca8e0f429c21ec6960e1c93d874b9e81b1e571a5aececbbe9d
- MD5 1b99426b3aa16bd5d714169fb245711c
- SHA1 7619b6d962c18ae0f6f43efed3aee1054946fb99
- SHA512 526105349cc4d3d9c63c83f8a5e3b994d158a632753b6f6b15f10e26f6348cf4156fe5f568c36754d7931beee99f4fd0f78fd61a38dec1a241205dd0b5365d45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGPu:A3k03kHRJi56rw
- TLSH T108155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 928KB
- SHA256 f50d89912dc24813c6851341dda5d1a938a5d948b4f0f775fcb5c18f1fcf0898
- MD5 eeca3f19eb93483feb98b76c3c6efff3
- SHA1 7279a7bc5fd7ba69160ef36bc7f3a4d84089e34c
- SHA512 87fcdaef9516b5c2b1865eb38752fad52ab7f8c508b596f8508981deb552bc2cb7925f8115093e20df50a50d61b47362eb39ecef7b40644ceed3656e2e195cc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGzb:A3k03kHRJi56rp
- TLSH T1B5155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 928KB
- SHA256 e0f970926781e1fb6e8bf49b9b8018fda65ed0df786ff00e4a9e3ce34dea9081
- MD5 5d5aef4bbd5d448fdc807fa38edcbada
- SHA1 31143d85fa7077561a047b770d9852f68c4d347e
- SHA512 9951ba7a4ea6f04ca31d073315e533f5744023cc2b2f8ff97b9d1df00c9d8eb96cb507ab095054888ebdb5aac08e519e59b4540227940493d83f5bd3fb2c3d12
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGHf:A3k03kHRJi56r5
- TLSH T15C155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 928KB
- SHA256 0ee60c036d9ee47e8e10335a4ef04cdef111e735d2149cf09ef1ab098ab364cd
- MD5 929c7a1c04fb95da0c08f710647f6129
- SHA1 76b11ed3c9be21b64fa840f3b0ab2c7655263f69
- SHA512 9ba0c2705a0f26a01ff5a361685e15c36f84e53e39e3050d6dd67b0affac4ad1d2dad9bc611655310a49b5ac9d8008b8875b4ce230d60954bc0085e9f2b4054d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGwK:A3k03kHRJi56rR
- TLSH T1B5155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 928KB
- SHA256 a547aeabbaa874b34bd4571fcea6aea482e76958a31f9559f41b26940b9aa9ec
- MD5 34b64e361f0e77c03b97fe0b2f2c5762
- SHA1 4c5af38b5f6b0afa4886790e57941cfc60c83246
- SHA512 debefec53bd5263518ab1ef0af33de2221203dd9318cd81279250f7f6ab0874367de36dced407112b890700ab8be4cc72013060f7a2914c94d1590054a6b6c50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGtk:A3k03kHRJi56r4
- TLSH T14F155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 928KB
- SHA256 4783f602f83c0cc8db887445db69202aacc12fb93d03546c8687213e4fd9899e
- MD5 4ee7e86eec6049c2b0c890ab7a11752d
- SHA1 852e374366e7a0eb56018979ab3076269313b6c4
- SHA512 fd0f93106faa125bbf27d913d9e5767332e87903a3f8d4b281eeb4702f4ead7e6f8e108ee36c4cf7e65dec64b429ec98db6a4ea50cd2d2f797234cfbf022f023
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGy0:A3k03kHRJi56rx
- TLSH T10E155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 928KB
- SHA256 f84810cf97495ac002cac52d29b3f3b641d43a4e9a4155a244d0e2f0d115ba08
- MD5 eaeee20712edc93ecc4845a69030e8af
- SHA1 f4ff9d9e539063dfc4f0a9a512fa8cd64ad39770
- SHA512 48e8c3a17ca24d3e22c67a4a2b8dde89346c955e2e8a05eeb491d72ab51c6a99cf3562a00b586f604694a96ffca5577eceb1f03594054d6383f578978200586d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGBg:A3k03kHRJi56rQ
- TLSH T153155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 928KB
- SHA256 e05fce934f1bc87461bb3e5771c8406ab013456fc4110a0baa422094474c8bad
- MD5 6b658ef145a34d3e4e1c344ef6fa61bd
- SHA1 d1c0efcb347a7e97af7f07734bb93c5d8c67240e
- SHA512 abbeb33e2cc4ed6f40322b0e6b8534dce973b952796a856f8eb4647253da287f1ee9221147cbdaad3708703725563276a3b6b0e92c20b95f9398152c1eafa6af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGor:A3k03kHRJi56ra
- TLSH T16D155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 928KB
- SHA256 91b6bd44cf46c1f5325499e8bec2a183175f09732b4eeeba3595bc66be0f9131
- MD5 061046df50dac2485666873445cce143
- SHA1 5df0d4d4a33c8ef67bf265cf7f0427b7efef9006
- SHA512 460955e063d0ac8111cbb61c1b15507f481ae5ace647520b33be223bdcdc0b3a76cd4d6903f5a60b907a3954223078dceee59e7b5cb1a180e8012f209c104e2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGGn:A3k03kHRJi56r8
- TLSH T166155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 928KB
- SHA256 215d8c0fd650c5a5bde32d431cdc67a49cb3e11ed96835528a14a203f8fff9ce
- MD5 53b20a5902727d836b6782b9a64184f9
- SHA1 e109ce11e1cc185098ea664a28603f4846c876b0
- SHA512 dc95a3c4f0e7f9d13f0240200fdd584c08f61f196b0f635c9fea6d8f4d34144a7edba309c9e9dc550510abfa3b4113a2730dc4d2600e596e874820d2ffa7a858
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGMx:A3k03kHRJi56rq
- TLSH T15D155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 928KB
- SHA256 d6ff5e639afe60cfe73ee9b11190ec25bd0dc9f4b0c3e8fe8e1f3773fe96d8d1
- MD5 af0e338627d1a99eaa8446a7ded1c191
- SHA1 6970fb3236051b34a034a7ac9786c39606f9651f
- SHA512 8885962a641db63d91712bbdc58f49f21fe44e602bb0dbdb68fdcf41868015f9120884a76614f9c369f67fa398074a9055eebad3fe766af8bc0bf34eab69b87d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGGA:A3k03kHRJi56rp
- TLSH T1BD155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 928KB
- SHA256 b9718ac7fdcc12ddcd1fd9758e0fa64c9cd0f23d211b96e08d9f78c67d1df105
- MD5 44f160a81c7b894085c215355174d712
- SHA1 8ad42e5bf9a3395244371a75073b6a32816deb6b
- SHA512 03d9d21e6e24480f469e32e75440b9b676eed433e2e02427efada26f7baceef08402313fbbf2f9cf41461fb7927c382043ba69d984ea683a0245676382a65a7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGf9Q:A3k03kHRJi56rw
- TLSH T159155A07A6890FA8D11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 928KB
- SHA256 b5e065f6f51d3d2f9db5f3442197ff88815b068e1c5c767efb6722488fc0c28d
- MD5 9ed1969dbef6f7325271525e7cd07918
- SHA1 9a40924d9f24981a6e462963f5e9c57c3c69a3f2
- SHA512 fa565f50479be0d581ab18469d74390a37feffccb204ed83764660cf720ed3872509979d730358aa1cf94d48ce5c00226e46d2838b0b8cdd3127f3ae661e8c71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGW4:A3k03kHRJi56rr
- TLSH T191155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 928KB
- SHA256 dfa3ee1062af1f969583af20bc35ccad19ec32ea9764d942b265514ae72d90ec
- MD5 fa22efa384dcf6185ea51d7bd26802af
- SHA1 d56661180651159ea480603e17512ce0243a888f
- SHA512 d897beb21cee1dbb9120bf974bc31c3c2559c04a27de765f267ec870b3e71e48dfca0b3a6f54870d04390a2240afc77c80c8609aebfcc9b1d825b94354473691
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGFu:A3k03kHRJi56re
- TLSH T1A7155A07A6890FA8D11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 928KB
- SHA256 bc2a8355f9f7ca5cc7120892fbea9faa1526606446b03be85cfa9e7352b2d330
- MD5 27e971c3515217cd619cc3ea59975a35
- SHA1 b3b863daf50e3f6ff1dc304b2062d42f1365076e
- SHA512 d36ceaec74d8af629e73a5a7b4d474abef5e12d22126be97cdd4bc80b2fcf32d5fe74516ca1623e801f763b68b643457cfe9cb1bfa477ff1a315ecd3daed4d4f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGYj:A3k03kHRJi56rQ
- TLSH T1DB155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 928KB
- SHA256 2fc8bf2c917d816d0ea9e74a7e38045efc68ee70495c3ca83c3c95fbd6ba172e
- MD5 30dc78e1b255318d096ecb4f18f61abb
- SHA1 e347c437ad5407a1c217cb9f601aca946a5d3b02
- SHA512 af8b4440cf0ef4399e7708baa7764ea19ee992ca17ca6262ebcfa83f19818ef409a404b30f95308eaefc8c13f91d6234f037141812cc1ad7f399af1281b066e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGpg:A3k03kHRJi56ro
- TLSH T160155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 928KB
- SHA256 1c92c6ed81f77e08d15d6860129ec8faf929c3ed7530f9701ce7ba6f6563e28f
- MD5 bb0b462da5d44f81a51147b3361ef6c9
- SHA1 89e8608c9a4a240f84e83719a1bb3fa2f81c4ea2
- SHA512 c70dd469632ba7c3211b1a222484311d15d100f464121a578b3f759d5ea19bcaf471047d5998af894c58205cc0052e51fc0dc35d9158b7d0c86bcd142802256b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGwI:A3k03kHRJi56rZ
- TLSH T1EC155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 928KB
- SHA256 d79ae19981a748f17232fdf79e754c61f66b9fec8689a278dd80f8185a31126d
- MD5 be45081e71a1d99fd66b13504dccc320
- SHA1 5b2c5df1f4d1d3f7ca9d99e0bc599afd6307cca9
- SHA512 0be6a9170efebf11cb1058d8c5579211caf1842b35af520b3c3bd6a205885bd329a79366bedc2687e0aa77f0e2fa21d348a7134847e13432b991bfd265ff041d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGyo:A3k03kHRJi56rH
- TLSH T131155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 928KB
- SHA256 b81c07b854f75df7eddc6cb4ff916241eaa079c6b92c95119e8263c5f5388619
- MD5 e74a33ee2046a3cdaa9905e55443b24d
- SHA1 bdc2202eb1ce888ee6381e66fceca076b9c6f9e5
- SHA512 7cc4e2f0a9b71709ebb9a4552958f20b048b0ae9fc8cfab0897487d92788ba2f278e1cfaa95ac1d019a2a09b49c469661e80d26ae654b755d596bba85a458b81
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGp+:A3k03kHRJi56ry
- TLSH T167155917A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 928KB
- SHA256 3ffc8b7295c3b59590536e777e7d6c375d49d8141b48abf07185368da55804d7
- MD5 c7ca18d3c6ff5088abc0a404614145b5
- SHA1 eb7c89b4d0ed76fad1529bae680f0ed9bff45849
- SHA512 ebdd5f94ec157fe49506bb2e32ee82558cfc8e1329f6908aecd7787f09d72df63c8c3ad0b1686f6e3b1039db05804505142dbe02f41519000777b3c26fe04b33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGXQ:A3k03kHRJi56rm
- TLSH T1D7155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 928KB
- SHA256 3c6976e2eb811449156c9220559416fbbff6c9c9cca0314b4952e60798f5e2fc
- MD5 80f6bd83b4e8cbe467182d5c66f1711d
- SHA1 bfa902e7a83f7d80083463803e6807069a9cd5c1
- SHA512 20b286148c16eb3c8020f322bb30326d230924fe4e54598fb504c1d343fa0de6c10d47ca6cf465b70f74da48ec15855967d3e5be681db93ede0543bf2ef2a939
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGsX:A3k03kHRJi56rG
- TLSH T102155A07A6890FA8D11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 928KB
- SHA256 357ff1a7786603ff1c58056216f031db499b2bba354ffc591d0c3139233763e4
- MD5 6f2dc6d5baed54c8e9455550a5092374
- SHA1 c3711dd049f1f5d4cc30742097d9a638a7c183c5
- SHA512 3a091ce08c86350b5dfbff24d8d066cb7e20f57f321d5c0121273d758e28ed49f02632d5e9f490d74f22e29b7d9b7fe4a113699408cdb3ee5b348f9a4452ceb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGKL:A3k03kHRJi56rI
- TLSH T138155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 928KB
- SHA256 daab029b260a61dae2e23a2deadbb560de6b395d462226fe5addaea3321939f3
- MD5 81a6c92f2f2efd390b98328ffb9b315f
- SHA1 55d5e64c1c4515a2ba1073a7a5e626edd5961441
- SHA512 15091a39aa649a9c64bcfc2929e3a9b964258cb91cdf3b116c14aeaf3f2f095be2cd122899f231c78a316ddc1ce2cf64912dea1fe97710281f1d7d5847fb50b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGuM:A3k03kHRJi56rJ
- TLSH T155155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 928KB
- SHA256 546c791db4edbfaa2c6c910f208006f888ac73a5286832bc7fb7477d46197b6c
- MD5 f1fefdb18a288a2f7943c19718667a8e
- SHA1 fdbbab2b8cc1925b8c9af038991f7375986352e9
- SHA512 52c3db489d55fdcb688452706bf68f9b63c16ca3fbabe0fa09cd947c7f55ae31eacbfe9fb4fc6610883ce98d969175f165f543aaa9b0a6ce31620b6c6e3b847b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG3h:A3k03kHRJi56r7
- TLSH T1D9155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH