Analysis
- max time kernel
97s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 16:23
Behavioral task
behavioral1
Sample
2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 904KB
- Sample260809-tvtzza1gpd
- SHA256 84ba973ccee653a33d0f1f5b714e2115ac8b887fb8d2f299815d1fd8b338a0bc
- MD5 8f0280f1d7fec7853fe07f5e69e24a24
- SHA1 badf5b229181e033b4808799bf29441eeeb0dcc3
- SHA512 83ace675524347106879c4ff27ae2b4f6c3a9556b0bf4fa0d74e7a83ad84b0c77d5d44e0f17d083076942190a04638f4383cc4202c2da4c4864164577ea774e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/p:A3k03kHRJi56rU
- TLSH T189155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 50 IoCs
resource yara_rule behavioral1/memory/3184-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024715-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1608-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c0b-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3184-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1608-42-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021690-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024719-144.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212e6-244.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212e7-263.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002038d-426.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023621-481.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212eb-500.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ec-591.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ee-622.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212ed-641.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ef-727.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f1-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212f0-790.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f3-797.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f5-828.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212f4-859.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f6-878.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002300000001fa09-897.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f9-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212f8-917.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fb-937.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212fa-956.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fd-1012.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212fc-1049.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ff-1056.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021300-1093.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021301-1118.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021302-1143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a0000000212f7-1174.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021304-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021305-1188.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021306-1226.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021308-1330.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021307-1349.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002130b-1374.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002130f-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002130e-1382.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002472f-1414.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020322-1458.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020328-1495.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020337-1520.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002473d-1630.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024748-1729.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024715-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022c0b-40.dat aspack_v212_v242 behavioral1/files/0x0002000000021690-61.dat aspack_v212_v242 behavioral1/files/0x0007000000024719-144.dat aspack_v212_v242 behavioral1/files/0x00020000000212e6-244.dat aspack_v212_v242 behavioral1/files/0x00020000000212e7-263.dat aspack_v212_v242 behavioral1/files/0x000300000002038d-426.dat aspack_v212_v242 behavioral1/files/0x0004000000023621-481.dat aspack_v212_v242 behavioral1/files/0x00030000000212eb-500.dat aspack_v212_v242 behavioral1/files/0x00020000000212ec-591.dat aspack_v212_v242 behavioral1/files/0x00020000000212ee-622.dat aspack_v212_v242 behavioral1/files/0x00030000000212ed-641.dat aspack_v212_v242 behavioral1/files/0x00020000000212ef-727.dat aspack_v212_v242 behavioral1/files/0x00020000000212f1-747.dat aspack_v212_v242 behavioral1/files/0x00030000000212f0-790.dat aspack_v212_v242 behavioral1/files/0x00020000000212f3-797.dat aspack_v212_v242 behavioral1/files/0x00020000000212f5-828.dat aspack_v212_v242 behavioral1/files/0x00030000000212f4-859.dat aspack_v212_v242 behavioral1/files/0x00020000000212f6-878.dat aspack_v212_v242 behavioral1/files/0x002300000001fa09-897.dat aspack_v212_v242 behavioral1/files/0x00020000000212f9-898.dat aspack_v212_v242 behavioral1/files/0x00030000000212f8-917.dat aspack_v212_v242 behavioral1/files/0x00020000000212fb-937.dat aspack_v212_v242 behavioral1/files/0x00030000000212fa-956.dat aspack_v212_v242 behavioral1/files/0x00020000000212fd-1012.dat aspack_v212_v242 behavioral1/files/0x00030000000212fc-1049.dat aspack_v212_v242 behavioral1/files/0x00020000000212ff-1056.dat aspack_v212_v242 behavioral1/files/0x0002000000021300-1093.dat aspack_v212_v242 behavioral1/files/0x0002000000021301-1118.dat aspack_v212_v242 behavioral1/files/0x0002000000021302-1143.dat aspack_v212_v242 behavioral1/files/0x000a0000000212f7-1174.dat aspack_v212_v242 behavioral1/files/0x0002000000021304-1181.dat aspack_v212_v242 behavioral1/files/0x0002000000021305-1188.dat aspack_v212_v242 behavioral1/files/0x0002000000021306-1226.dat aspack_v212_v242 behavioral1/files/0x0002000000021308-1330.dat aspack_v212_v242 behavioral1/files/0x0003000000021307-1349.dat aspack_v212_v242 behavioral1/files/0x000200000002130b-1374.dat aspack_v212_v242 behavioral1/files/0x000200000002130f-1381.dat aspack_v212_v242 behavioral1/files/0x000300000002130e-1382.dat aspack_v212_v242 behavioral1/files/0x000700000002472f-1414.dat aspack_v212_v242 behavioral1/files/0x0007000000020322-1458.dat aspack_v212_v242 behavioral1/files/0x0007000000020328-1495.dat aspack_v212_v242 behavioral1/files/0x0007000000020337-1520.dat aspack_v212_v242 behavioral1/files/0x000700000002473d-1630.dat aspack_v212_v242 behavioral1/files/0x0007000000024748-1729.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1608 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3184 2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe 1608 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3184
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 904KB
- SHA256 84ba973ccee653a33d0f1f5b714e2115ac8b887fb8d2f299815d1fd8b338a0bc
- MD5 8f0280f1d7fec7853fe07f5e69e24a24
- SHA1 badf5b229181e033b4808799bf29441eeeb0dcc3
- SHA512 83ace675524347106879c4ff27ae2b4f6c3a9556b0bf4fa0d74e7a83ad84b0c77d5d44e0f17d083076942190a04638f4383cc4202c2da4c4864164577ea774e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/p:A3k03kHRJi56rU
- TLSH T189155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 1.2MB
- SHA256 c7232d7838a33e8e2a255c0453837c93627f10d999369fbf2cd4dc266dc664c4
- MD5 d03d06569e49687a9b9be8000d059cf0
- SHA1 f29cd7615d78b34fe738135e8d3f2afae1305628
- SHA512 35e0349d0c0c03095bece8f5c8451abaa7cb5364119a6f1ef54686bfe06183ff8bec303fe4349466a76758d319285c2320fae4fe2d26e5a38eec3496bf84524c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/H3UNUpEisI:A3k03kHRJi56rMUN+Eir
- TLSH T1A2454917AB984EE5C12F917889868661F773BC110F2197CB13509F2E3F376D46E3A262
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 933KB
- SHA256 dff1568668ae7daafc1fe89dc15d567449b648f5bf5122d341f4f6d46cd94283
- MD5 3c5ec98854a9316de4056e887d78b9b5
- SHA1 8f1f5e8ed0b8d12d2924b5a8020c7569dade917e
- SHA512 c09a46c449d50829463c70ed29437a78e8b530bb400e944d0d761a1ff384be19d02db9c917c9fc6ef59f827d9e010ec71c1864b0f072e1016f6560bc876b12c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/vP:A3k03kHRJi56ro
- TLSH T13D156A17A6890FA8C11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 951KB
- SHA256 fb366e0532bbe83ab720398917e0f38dc8257e66ed2a6d65d1666353690e54da
- MD5 ae44784b4fdc09aaf3611ad72c29b0f0
- SHA1 a38d0b62e4d2e9616affa30987e4070b329cd0b0
- SHA512 09dfbe1d735a83943114acd1893b3250b81eaf8381a91c71a8cde361ac1d9b18dd34a18478b47f156e41f68b94f50ca1a5e490fd86ae342b61e9aa2b8e197241
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/c0:A3k03kHRJi56rx0
- TLSH T1AD256A07A6990FA8C11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 957KB
- SHA256 eaec649859a6b049f508ac140733cc1c72b487ea68165ff1e15bb7529c11c0b3
- MD5 8387a9eb8788db5aa068aefafa39e65d
- SHA1 7a1c5cdd3fbd25c6202e6716d44d3519ca3f12b0
- SHA512 5ccb11bc4f6209559eb2779f322448f952280206a7cf8b2a00a912703f0018aebee45f05eeda31b5d01d4997be7c739d154fe5075fe3d8520c0b32c9cbbedf7c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/4fj:A3k03kHRJi56rXj
- TLSH T13C256B07A6890FA8C01FC1748A968A62E7777C115F2097DF1354AE263F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$
- Size 1.0MB
- SHA256 ac063e46bff229edb5b8cc99a885be4a022cc70bde0b9450bf4c1160a23dc84d
- MD5 1021b6abb6b54089e113d9e67b0862d2
- SHA1 13d3133a55d5ee8f8e55af7f1a44e44d9528a331
- SHA512 0a97549bd0e08db9d7ef2d4a59e5fabf574866925729280afe647a1080f5b49088c008ec8bb900e7fb6677d043cf1d281a974c0f33fca716a8c183b6900dda27
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0Gen:A3k03kHRJi56reI
- TLSH T1FF255A07A6990FE8D11FC1748A968A62E7737C110F2097DF1354AE153F72AD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$
- Size 1019KB
- SHA256 141e7124ce547bdff6f6c2dc6bac1b4b78216d7368fed879465de1be90e345c0
- MD5 3fcb7ebd6d350b618b6aee432aa66899
- SHA1 1f495149cc2e15da6e2dc369978cbea36aba4612
- SHA512 a75f16a67d76e9aba7374127bd2742216bf05dd7deabeec0bf08a95cff9e85d2ce13b9b1294d8033e23577f4406bce9041bea33493d72256e9d741f5de805688
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/TTjE:A3k03kHRJi56rqw
- TLSH T163255A07A6990FE8D11F81788A968662E7737C121F2097DF1354AE153F32BD0AE3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 5429028eb87d7f74ba905af4cfce2417d50bd992d409ef3f3fc2a7ff32e1dc00
- MD5 48827d8a3d1afdb8a23ca7ea11f733cb
- SHA1 83a910ad936ff742e835a6ad0f1ca012dd59a723
- SHA512 331d41f22c00e3abe204fd15025a0cd336f6b55042ccdc5a4779ff7f4913812b462dba2575d716dbeb4cd9452a81e1a7baf1aeb867ff7f074928b14899619c72
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/V0Le5ji0hmxNrM:A3k03kHRJi56rMPji0Aj
- TLSH T1D9655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 919KB
- SHA256 362433c75390407511e6a678b37e60f6ad526609521057dfdd1b2cb79d76a512
- MD5 78e08d3d4d7bbe19eec7a72225ba61f5
- SHA1 4316a31ec9822cd46b51de59cfb7a34c26e65adb
- SHA512 22f3ab221017912fdb21098eb95b67b7e3433b365e1e01bf060544dc340ecefa572c5e9310de7996ab36d49e66dba7c16415880334cf6f6329ed09ff4fe93828
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/3a:A3k03kHRJi56r
- TLSH T14F155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 952KB
- SHA256 4e69228982a172a00dcfd90f2d9260905b42cdcb61a3b126a4c5a66ea6c63dc3
- MD5 a4c28d8848a9e93314f1f40912012c12
- SHA1 c6bc68dce2d823b04ca2a312f822efe0ecf83829
- SHA512 a081823b3ebebcbed2ac5983ce15c0ccf8e224927585a0bd5e48abcccf7771c585be5529198208a3821b86c1a2351614864588d3bd168c31602b65fc79d7df97
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0b:A3k03kHRJi56rVb
- TLSH T135255A03A6880FA8D11FC1789A968622E7777C521F2093DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 1.0MB
- SHA256 9ee7f447e0c9bfb08974234a27886acb40a02326d6dca3d2fbafb8e0e46d2c27
- MD5 fea602dd61c642ad8d41a40fd6a9d275
- SHA1 057fc242f724514b7e34f66f30c92cdd8f4b5138
- SHA512 3f4a8c9850c54738eaff6cb129e16cfc0dced27e7d41a5f176c677ab64a888877a6b015f81d99d2b622881840afaf26f0dd2e4513e4a314162d4ef43ca1e50cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/uD:A3k03kHRJi56rh
- TLSH T12935F516E2980AA8C01F8174C7964662F6737C155FE093CB13D4EE3D3F72A906AFA653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 928KB
- SHA256 a31cfb06c7139c2d4ecc6d9fe74668e5af51c75e4e3d27596f852a359fa5eeb1
- MD5 1bba45a7860fee042cad297e8c73be83
- SHA1 99c59cd40e396c3ef36cb33cdfec087130f0f39f
- SHA512 9c7d361de520743b3232f152137d42aea29e0104dd760ef87c59a12a662766abbb2bf6ae9b2641390410ffcb9cbfcb5d7de791de41a9e15447776bf54873a8c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/26:A3k03kHRJi56r6
- TLSH T190155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 928KB
- SHA256 e573ca3df4753d247e3e8675d1e6ae56b1dc02221aba56e2852d7bd091a10452
- MD5 8860c7ba7d67b4e05a717c8779350cec
- SHA1 8a99ffa4c0623ece2b8610e26b7106e107c3b9a3
- SHA512 96a226ba5502a9a4eceea62ec58224aded387be67a464e3609e59a28a9b1d8ebfd24f12da9f77ae09466060486f295d4f0b60e1332f8b9596ae933991e40baf4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Oo:A3k03kHRJi56rO
- TLSH T154155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 928KB
- SHA256 8713f1663cf21390033a1fba8b1cea36e3e3120981260f600d0270c7fe66926a
- MD5 ad9e494bf67859abc9576b9f5e19ffd7
- SHA1 721be2875c6589fc107dab19eee61742078736f6
- SHA512 0962944f62258ad93862f10365e56e3059f2758e1b921bde4b8ecb513d56ebfb047e8265d85b3dc2aa57ada588473008f8d78740ba5a69f03163ba3f946c44e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/iu:A3k03kHRJi56ro
- TLSH T183155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 928KB
- SHA256 1fa8e83216bc146fc8a07c3f9b4d0cd0c0cc606b412567aff13a1acde9eb0c4b
- MD5 81c667cb6aceb0aefee2b56f1f307605
- SHA1 d272fc1bc1b4cb397a225e2ad6cd9fb15ec72d11
- SHA512 1ce0043c8009f8e2c7338724a42959ecc1312b363e3c328726cb666fff1ab33aea676e633445ad24a61ccbd320fb5d54b23455964feff31e04425535899693b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/29:A3k03kHRJi56r9
- TLSH T17D155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 928KB
- SHA256 6170b5ac55c272b64d7daf7ad3019040506fd2ce42bf34f39bddba03ddde244f
- MD5 702b51ae1793ba335e20aa3080466981
- SHA1 acf007da2b2a5c0a38ceacde7af03ce7123e72b7
- SHA512 24185bab7c6ca2373cd42bb17529e028b7cd891be72a65cc01c13ac728c121ff46557822c3f6061c4a3a2be89385f143076daa28fb491333514d274ce38b529d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/2c:A3k03kHRJi56ro
- TLSH T1EE155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 928KB
- SHA256 389d0836b445bc4ff26849a7d9dc3725a2dc5481c25abc1c4e7f86fb21e27e62
- MD5 76f4a8df7589dcadb5c8e9a874037856
- SHA1 10eb55ded5deb0aae0a1d36f5b373396df29f5fe
- SHA512 49008d72cebada13a4e3d41a037fe76800946de477bb70e9e3db8a39ec15978e0db04de773e7299bb6f2cc54c0896e589c22fb2f5cb1d71dfbda546dfbbd6e9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/vp:A3k03kHRJi56r+
- TLSH T167155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 928KB
- SHA256 3c1b31bec62d3ca15cd9f0ebe02649d58523eb33508ee53da3900580460a270d
- MD5 a291bf63d74b91738737383e15215ba5
- SHA1 7fc039089f6bcf6d4b965fefd22a3acd8e311c4c
- SHA512 23ffb3d93d7135a82363b402762fab92f3f49148361731eb286b52e1fca401aaba53c8fbab74f7b0f8937550f8191ab5b89e5617f6b29a21a683a6da46db39e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/QN:A3k03kHRJi56rx
- TLSH T171155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 928KB
- SHA256 c1ca00793e85d9bf1ba20a454090ec756e0a2df7fb88dceb28ada7f8dd255969
- MD5 d474535e31a9b119c899c75ebfb16614
- SHA1 5fb47790f004e9df0a6f6bf970798ec0d8c1ac1d
- SHA512 0329f1ca437cd9db9e1bc9ead781335013fddd8eba035ef9be3f8d523fa3d9b49a91edc789eb9dab15a2acfc0b2342803c33c10113423b43fce1a63724a09fc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/YF:A3k03kHRJi56rD
- TLSH T19E155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 928KB
- SHA256 fa8f03368194f77900e353abbecc8b15864db75ccdd2616e625e887aca6f1ae9
- MD5 292d66604cd169b3262928b372e9c33b
- SHA1 9ec40c89325295f4a90e7de462d2adf46e655d04
- SHA512 3ab133e81bff74f9ebc55bfae8004b11f27999e2c81f164aec1039bfb8e193dfeef999566d3944c5f121093e46b40b7271f656e3b3c06cfcf8774b63cf49d4af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/NC:A3k03kHRJi56r/
- TLSH T1FC155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 928KB
- SHA256 f42c036e746f3f74b2893e9c7e6097768276e0a6e6897fdd9f14811dd4bb62d7
- MD5 91bd10aacd3e1b065cae7076f055fb4e
- SHA1 fe013d30a3b2ac38484bf8a7c885ece43228b37d
- SHA512 4f96b07b5343f8ade6fc1484318cb19af7ece01e3fae653478125fa7f4263128fd25925e499be07bfb26febdf1a15876c62df410746775e6844ac949b9c7e448
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/2w:A3k03kHRJi56ra
- TLSH T131155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 928KB
- SHA256 7525b218ba8e623f72632df1a7acb99940101a74a18970acc5813730f0f25a93
- MD5 7a9832f6d79a5faf0efba87a32906595
- SHA1 770e06cc446628272f68efa99d041ce339a2ce29
- SHA512 91bc085893b4ab54976b116d2e6ce820d8fe984b5bed3d9d94f4ab1aaffaf5ffd26149fd8fbf355fb1a428406cbbe51fe2a548f196538bbfe136aa7237be69c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/lT:A3k03kHRJi56rK
- TLSH T198155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 928KB
- SHA256 5d192d9b8812ee71b70d1741bc2d37834ef97969769368423678779597e232ea
- MD5 740c08026b35ac322d59042839275c66
- SHA1 1cd7bff69f62f478755ca773e1f4802e36ab702d
- SHA512 193ba5f5e8b76b4cdac5efb705e40faec019b296432f8b2cfdfcba99ff2cf0fb75bae61dd8afe693d951dab0dda391dee8fdce41861c61d15683edd65cf5b0f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/7u:A3k03kHRJi56rF
- TLSH T1F2155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 928KB
- SHA256 dfe3acf351dffc0b975f27cc56bf8eba35c7f88731763d2504595f7be967496a
- MD5 ba734b08962e6e223fe46208af282afb
- SHA1 ad1888517f3d576fa08bad1febe2cb405ff8e444
- SHA512 e3ff1ccc3defdb00adbd497573b9e546fa553e81efea3018b52d9f98504b12b6ef44a6496a201379bce78b82effe64f5391c6f36e568f566a8f4bb209041ce4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/fb:A3k03kHRJi56rk
- TLSH T197155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 928KB
- SHA256 4bbd713de34a4edc9c677d266cbb004fc223476126977c59139d80ff9b1a64f0
- MD5 44a14f19b84bb2926ad5acc61ea4290e
- SHA1 6c80b30df044d5dd2008d9f22250f71acb7c5ee3
- SHA512 3969f01e7ef98a66116b3e8bc25815f9f7a12a96ab0e22ac644b6d528775d740cdbe18d0f1ae7797d181e60c84e2201d5a279d8c0b3721d9666ee1e556fa8045
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/bf:A3k03kHRJi56r0
- TLSH T161155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 928KB
- SHA256 0cc5d7d950e4e48cad5833583ca2dff7cc857f3fb8b3a6daed9c8b482f9ec0f6
- MD5 15583189a0a804d5e0e45b3d146ea32e
- SHA1 1b80e37243bf8b0176b67c64945cef8d77ebf73a
- SHA512 5ea93f1eb4b3572f921869dbe527efddfd8011ce1f78bf80a8ebe5186ed4374c0036239547bb06d67c6c80c268d4f7901036f9d2682bdf466ac0213be4cb1b7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0K:A3k03kHRJi56rk
- TLSH T1B9155A07A6890FA8C11FC1788A968662E7777C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 928KB
- SHA256 929a9cb4b15f03f027273878c8cda6676d4ff97112fbc6e95f9e852ec07ab7fd
- MD5 b45ea3db57c5836d4f7db1cd383274b7
- SHA1 3f18a19b96d5773626e5898d07c9553f6e82cea3
- SHA512 3debe26b4298744d97b2ccea20972ddbcf8253e73175fb63cf986c4e4e46ef8059d4e965247b93c422e995a2c9c03062f13c60fd5b90ce8b57c820290bd85372
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/pk:A3k03kHRJi56r9
- TLSH T1E7155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 928KB
- SHA256 e61b5a0650ea709d30b0fda83cd9147ff50b5199555d696b78727b5f6d74cd72
- MD5 3caa51364a30506f3616434dfe0ce3c9
- SHA1 a34ca91c3a54cef20cd7b6619cac6d1be70833c2
- SHA512 d452ae16449c557abf13e7ece611b183036594182ca624e688fcf61ce24c549938b5bdc7feda6f0cfa304ed9cbce19efab61dc2d499e6cd6b5bbe43f97866653
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/G0:A3k03kHRJi56rA
- TLSH T1E9155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 928KB
- SHA256 2319676e44eeb8c854e535133b7ffda1c246103bd31007a9bab6e87f9389a00a
- MD5 3f5d1e5da738b605da31e58067c51d68
- SHA1 ba0fc0cd6f24bb397921cbe96a9db92adf453d25
- SHA512 dcb605835ae876b68b5966344f67201442992ee9f8bd55d62e7f9acef3c0997a6d8a94dfe470fa83927a5ccb06d8c13803bcf4f7c3895cdc678ae04496cd4be6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Vg:A3k03kHRJi56r1
- TLSH T141155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 928KB
- SHA256 79d4f3c49e5bdcfc03d59eac44d9aee984586c3ac00b2ff862de062582152ed8
- MD5 bc7b39af0ff703459c2ec05d9f25ae29
- SHA1 780bc0ce7453e108d4be2dd275c7f66d469a9550
- SHA512 3d05d2e6e33478f52329b7f919556c2a412b03c2be0f0611ff35674b728c9381fb08d2d17bc5a726329858399b108e6302c3825df1f8c9d135b11fe8ef7d5021
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/kr:A3k03kHRJi56r3
- TLSH T1D2155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 928KB
- SHA256 0bdeecad80f9a35660aa2284d7625bf3e47855382713963cd7d31d48c1d4158a
- MD5 9c94e4fc94d9ecc06fa30a2620d09c51
- SHA1 66f1a6f96fb8a7213012cf0315e8f3f74dd386b2
- SHA512 2c3d0d043975f8a604316f933aada1aa5d98c4ba43d59e267b8d671490c4c3bf778dc1b60cccc53c562bbddc1531b099570eff9bb6411e14c2974a60348b4a47
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/6n:A3k03kHRJi56rB
- TLSH T165155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 928KB
- SHA256 47333d1e9a48869b497dcca88292df017d5c3ba7c915fc3265f3d3cebccac07c
- MD5 049d1ee8b1615110c8455bf2480c3dc0
- SHA1 3790b6e056ab5e85b600a9f154a6d6e3f0f9f98f
- SHA512 c252cddb2700d557a0ad072585306fbbfe9673f540a91ac45b60cf55c8c9edc4161539310659c2540ee215bbde7732b6f6ceec168a3fb7457391f67789d0844f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Qx:A3k03kHRJi56rv
- TLSH T13C155907A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 928KB
- SHA256 67b3560f58e102c638c4afb6c048fe8e80f7f3ea15cf6618d0fefb5044ae6ac4
- MD5 9e5647e0a5b5ddcffd4d892dbc7edc46
- SHA1 b7c8dd81258fcb9f9788d564bc36cc6b8e166d60
- SHA512 af14bba3f227acc83a10e06ca98093a66207f24e0cd90ebb4866afe9bb00b15bf2e4d29f38e94ec05eb9fbbf740c98c02166f709edd950b3c31d5676453422fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/SA:A3k03kHRJi56rw
- TLSH T1F1155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 928KB
- SHA256 406eac4ace433c45c9541d4ed41288a9d1fa65fb9502e5ad1109cc72851af8d1
- MD5 035dcf37c680d9d3add56d68c7cfdc7e
- SHA1 6db70ed6e1de890748350e0823ec9d0205d6a406
- SHA512 f6371696c476130e525a16da223a7ebd67ae4d570759a6ae15fac09c229806814a07fafee45c17bfaca403d71ceb9e7f95304c06af9a65627ce5681b5ee796cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/r9Q:A3k03kHRJi56rJ
- TLSH T189155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 928KB
- SHA256 6039effa92fa7fa201d4388511d8469e083d9d1454dd6b03b92b257b92d52079
- MD5 a395d5e8342e43725a2635505174a8b9
- SHA1 0cafbdb26b48c6d76a42b3a34f1afc59065aaac3
- SHA512 b0b8f6ab1f32c53ae778cbd4190767cb03be8e1f356579f3a6fdae986d7cd5ac5552f165ee70c8de2e50817b60443820f123442653e6408992720c35ffd83952
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/a4:A3k03kHRJi56re
- TLSH T13F155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 928KB
- SHA256 a67e0bd22cf4c2074e8a363e0acb5ff11d54dc805ee0a280ccb392929dccf7d5
- MD5 2d0f79186f55e21c69889d8f2ffe6f18
- SHA1 b5796907897e62164c0ca915c81ad2bcef61bba2
- SHA512 81c3096ac38a0b3de71e187c21123b8bbce725ca8803798ba7af914774580d21b8a70f7d38579217ed4b580f194ad8998de7f54b0607119341caca3f67592889
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Bu:A3k03kHRJi56r/
- TLSH T1E9155A07A6890FA8C11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 928KB
- SHA256 34c3213aad9f2626144711679f7d03b0b4effd262d99a6f4ed23c9420f8122e9
- MD5 c75aea33b3bedf39e580cc9d15e7abb5
- SHA1 013b7fcddf7ab6603766115cbb7a72ffd549e9b6
- SHA512 a5f698b8e089c0c4291ca64c1b7d74de13f8b2278e149b5046a85de0647e9468e7cf27d7bcf31ce2b8ad3ab28ccc9d48c6aecde4eb2fab2ac2fc27575f4b860b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0j:A3k03kHRJi56rh
- TLSH T14C155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 928KB
- SHA256 6606cf62a70ef1781fc65da4c570d6703a7c33e5ddebc55f3e3efc16363593d6
- MD5 bf8568128a0cbd700d0cdaa231fd1872
- SHA1 4f0841751032d0dd48b616cfa909933fecde6001
- SHA512 cb81c488424a8e3825ca80c740d31bf9a0f55dfc211fae0bdcd28eb18f9c47154d3096b07156dabedeacffdb0970a1e7daa9b12c470ae650244d796e2092bdd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/1g:A3k03kHRJi56rl
- TLSH T143155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 928KB
- SHA256 188410573faafd1afe34ce2622f550ec105a373e1d6df059c6b93464a63dbe8f
- MD5 ba7653c8a8a347cf8251e9bc0728980a
- SHA1 779a501420efaef244f34ba74b2400bbe5616f85
- SHA512 61922879682a48f08c4ec35ff93d13148fb9b2bf16f58d7772ead7f5427407397b6e00ebca655b9a71843e13bf00bb251e11c2262238bd54f861b291931a521b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0I:A3k03kHRJi56rM
- TLSH T1B3155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 928KB
- SHA256 d057655915c6d778eb0d84aa32b3fe4da09f1e80b437c03be42835c9a7d3aaf4
- MD5 0fdc5940c649319439680a8772dba290
- SHA1 0383e2e4fd2018829de3062f39f9d49f90ca0515
- SHA512 3bd46b78527f6366169a54f93957bd5493d9d1cd125d36874eddddd6851ace9c4d893d95b5c418b2b2cf29c6181fdd0b84b1e22e6069ba376636c4a25b79187a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/mo:A3k03kHRJi56rO
- TLSH T187155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 928KB
- SHA256 599a26eae768fdb60c624c7b72cc6a22ed13f8ffa49577c6d6cec9dc1e0c589b
- MD5 cdf6ec3d885de59d8913a43dc82e79c9
- SHA1 2f69ab87cd32dc564fb30b9d91e089cdab99c8e1
- SHA512 2a8507cb87b504de937f453e6da209ec505ce4e60b35d93181e28d2396afbb0c3741cf3f81d7a467f5068f1629085f633b8dd7abac1e9e28cacb8f2ffa1002f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/N+:A3k03kHRJi56rb
- TLSH T150155917A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 928KB
- SHA256 587eeddaaad3f840446ce0a620fc06e385b25fe71a278bb8bfc77ec766156512
- MD5 c2703844ac8027aa9fe167d443cd5ded
- SHA1 20eddee6959c707ba4cf0eb2168b36a9f2257db3
- SHA512 b14a91c7b60e538087c94d86d8e5a8997fc6b6501b96d6606099a95b8dcb015e77d2bed9d70d97ba0182b0748ddefc7a835814a4be6e9c58fb24e48037c87a2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/7Q:A3k03kHRJi56rf
- TLSH T15B155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 928KB
- SHA256 066cec1ed32ac4aefcafb4a69fd488431cbc66635476b3db0945fc318a521d16
- MD5 bd1e08f0e8a86bce4a5335f89e3cd3f8
- SHA1 1d5492ebe804a1e327879c9ac8b12e437af41aab
- SHA512 b9da12843e4d747425354a0e3f62f0729ff477e1ea00fd69dd155c1ff2e7df54c7e4a139f5ea591630bea69eea34be469107edb492690b574b670153c33fdb45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/wX:A3k03kHRJi56rz
- TLSH T1D4155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 928KB
- SHA256 4cbd2461b02e3133e934edd33088ef848d0691d5ec0a4a8f256dde5b07f0654e
- MD5 6a10a35907e92af4c14a385f4c97f093
- SHA1 dbc3a270c4c348fd01616a86481c3c4f151427e4
- SHA512 84a4d184514011f3da446989d842d532fe0b8be2a9a2d9591b6deb460327643e529287a346d930a7e08adfa3691dc7819838169fd7c172d1b23983de346affff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/GL:A3k03kHRJi56r9
- TLSH T16A155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 928KB
- SHA256 ca6f20f6a9480375f1be7284be3032a8d27752ed03cdefde423e40fe0c78f21d
- MD5 d501f6ec9da4d992b87e2742d640ebc5
- SHA1 6d9139cf4f12137dfbf7b6c547f175d62219dc4a
- SHA512 a0f0a68fd6287b02be811302281073d0fc1a820eb351005741203722443c3aff727981ebe33cb2a45f3e7fbf9d90c88461d65e4a5fe71543450410eabf3f8de8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/aM:A3k03kHRJi56rE
- TLSH T139155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 928KB
- SHA256 bc39d20d3b9d022c7859fb6a923db73ef6dd092d71c9295f3e729bf04f23701f
- MD5 c119367dbddd5be907feeeffca3c2de0
- SHA1 532d8e8a1912b0f75d93b7e39eb4a2e3fc52f37d
- SHA512 3f28be74a8c7fee1a70ade95f5dc134f2643c671f2136b6c46a7652ba8e1d6ba475cae8f6bf7db1ddb56db584a962552a4a64e3d20f028aca6ab538c1efa5110
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Lh:A3k03kHRJi56r+
- TLSH T1A2155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH