Analysis
- max time kernel
101s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:31
Behavioral task
behavioral1
Sample
2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 904KB
- Sample260809-w6f9csbh56
- SHA256 4cfbfa7209126f81b617ef514211628bf9144be3a8219eb31101fa21e0c24ec8
- MD5 6764a3b39f325c3b28adccc4cb2c02d7
- SHA1 272b8ae2e1cfb8e2df7c5d905f5fcc0d34553408
- SHA512 4639690f1ce160a97708de853fc2b4a3914cb54318e60b84e230e838fbffde7d9e3d2587dbb00081e0020cba60ef52d8a733c53cef4fe9a2f85a713b173970f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Em6:A3k03kHRJi56rs
- TLSH T1C6155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/5764-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000001c81e-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5764-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3364-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c71-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a42-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001982f-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bf-444.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3f-530.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-635.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-844.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-869.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-927.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-985.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-1046.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1214.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000a00000001c81e-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c71-60.dat aspack_v212_v242 behavioral2/files/0x0005000000018a42-226.dat aspack_v212_v242 behavioral2/files/0x000400000001982f-263.dat aspack_v212_v242 behavioral2/files/0x00030000000198bf-444.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-493.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3f-530.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-609.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-635.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-844.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-869.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-927.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-953.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-985.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-1046.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1114.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1139.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1183.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1214.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1324.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1376.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1389.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1402.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3364 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5764 2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe 3364 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6764a3b39f325c3b28adccc4cb2c02d7_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5764
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 904KB
- SHA256 4cfbfa7209126f81b617ef514211628bf9144be3a8219eb31101fa21e0c24ec8
- MD5 6764a3b39f325c3b28adccc4cb2c02d7
- SHA1 272b8ae2e1cfb8e2df7c5d905f5fcc0d34553408
- SHA512 4639690f1ce160a97708de853fc2b4a3914cb54318e60b84e230e838fbffde7d9e3d2587dbb00081e0020cba60ef52d8a733c53cef4fe9a2f85a713b173970f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Em6:A3k03kHRJi56rs
- TLSH T1C6155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 3d6d2eadb467a1b14a609c72f832e31b226449249f89d533c1dd8dfaa1499154
- MD5 f46ec49c22c44a2ee0663ed82b58a282
- SHA1 4a00b219c2665942706d7f8cfc94889860eb6d91
- SHA512 7a2679c202467faf6d7d15b8e43af79675c3e68939fabcba93f6bcc83e7812963f065a709d2924c43e8c0ab33bc7639eeb9fc758c0f304a2b85c6b7de489843c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmK0Le5ji0hmxNrM:A3k03kHRJi56r0Pji0Aj
- TLSH T1AE655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 919KB
- SHA256 540acc2b50928218efee8760abc379ec5bf57439280eda6d9e796bc0eae3bdbc
- MD5 ccfb9a4067696cc1b2077903206bf836
- SHA1 6b8d6ee7dc30187c1d8726fe253d40deba6d984c
- SHA512 809ea32ef2ca0d969a15f1a5919a4e5a9904976d8ffbc9121eee51f6f2c483154dd774968d48b0c91ba8418c4f1df09f0e44226b07eba0843e6eae3bbe53280e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmEa:A3k03kHRJi56r
- TLSH T1D2155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 952KB
- SHA256 d34e4c3b8b09ae776fd711e2f8901b1dbf8984d6d78b84ce744c334eeb1209c6
- MD5 d4518588b0bf75db40ec7c3941b29450
- SHA1 473a084b21f02b3f9be5a90dbc8d22a0361102ae
- SHA512 69618799207b8000c55998923cea7b3b9bb9e21f36c9b695f8cf1f136f03971c16a6b8491648320683311bc8b23363855cc2128c429227d02601d0ec3108405c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmPb:A3k03kHRJi56rdb
- TLSH T18B255A03A6880FA8D11FC1789A968622E7777C521F2093DF1354AE253F72BD06E3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 928KB
- SHA256 84c6f9fc4f16caaed12e2740797c5462028e6d0bdc20fd2e51de0791c72ab75b
- MD5 3433d30508ae0a6dd2db270ab3c6db04
- SHA1 e3e176c361717ae734d74dcd5b8643245fa3c91f
- SHA512 c1120f71004bbcc67c84bb8fcc03e2a17fab364bc2aa6a7243dfd917ccf24ff82dac314e6f73ad6b8bd2c8bfb7dbcb89960a0860f5075c42978e5d40919247e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Em96:A3k03kHRJi56ri
- TLSH T1A2155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 928KB
- SHA256 2c9282adfc0cee9946a6c67cfe9b63bd9dab5cf54b4f4faf711da084ca7fda5f
- MD5 9ec34cd75008a51176f3b8067dd5eaa0
- SHA1 cfaebae768c89812a112f368bfa27e0fbc2f2f65
- SHA512 81cb598f29f130e764f007a965eee71c4ca6ba1e1ab6b8e8d2dd727106b54f42e520a211f49b14c72ee88bfe5dc23588d588a9eca5b0fd88159d1288dd621434
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmTN:A3k03kHRJi56rL
- TLSH T1F3155A07A6890FA8C11FC1788A968662E7777C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 928KB
- SHA256 9bc3d9118d14f1e29353b686f53a2f07f79766ef10596230b16ad73c7f169741
- MD5 e1c815881c079db0ae4e33f4dd521fdd
- SHA1 3ec5467978b94b420516554d32e6e28d2fc89037
- SHA512 9dd6220f73f586487d5c689b0237d320073f54c4688ff28c6f8e895a1ba03779a0f4e2a0fd36a36b38a468c89b9871a4ba021cd970e3a00f5a6f08701ac0c755
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Emhf:A3k03kHRJi56rP
- TLSH T104155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 928KB
- SHA256 ab8efef64f4291917ddec06fbaaa8a1d02b40f5e1012177c82cec2d1ddbba74a
- MD5 311d2331c8da361e2808e7e06ef42826
- SHA1 fd2693e1bc83c4bc0077740c8bbf793a3c6bfc5e
- SHA512 e8b4fcb8f4bd0f21d5f988e066806c6476d9690d87fe30f30fafae95aec630e1da3b73c5db502ca62278c2e14e392c47906da884732e7d05d1f826bd114b2a26
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmDo:A3k03kHRJi56rG
- TLSH T197155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 928KB
- SHA256 eb0dab874283ff95b5d7676bd720cc60629a4f9633337bc50a57f82714e3aabe
- MD5 8be4c852a1aa6501b7da5e1df86d52c2
- SHA1 9affb76ee9db170394a0c7e9fe2a324a61034094
- SHA512 e1c587c2a6864c4bc2dd0fd9630b01406fb46461a55919bf9724f3963e70124b0a219f9461c558c582e818d8c446c68261bb1747c50b189a0d521d742e728a01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Em3u:A3k03kHRJi56rQ
- TLSH T182155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 928KB
- SHA256 3ff5c672d7defc50aa839fe48230f63f8d980d490d22bec815e7acb9160e2f66
- MD5 1814d12fea3b0140a485d89effdc9cc8
- SHA1 41e450ceb582bd42e1f02b9cfd2ffc34d08a1edc
- SHA512 0259269a86adf7a9b370730d426039ca4834ce250ec8f895163a2c6c8bcc3f8569a4ffdb830cef0f180c3ca431cf3d0f5cf5abdf591e6f4da1c7f1110b20f64d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmF9:A3k03kHRJi56rl
- TLSH T1AB155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 928KB
- SHA256 7ee2d9fc19948fe7e477aa46031d5d7ddbd05e8d0c522b35db4deab2356845f2
- MD5 b3e4886960c467fc5353d6a38fc61da8
- SHA1 5169831ddb7dee3322c569848a053e6040cda47c
- SHA512 f322e71bf6cf2141b4dbe89a0946eba808ad570ec05df42404156b01576fe5afe196da01a5c37062705cc95ced21caa2bdca1c28450894f2b17c7ea30822bc19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Emhc:A3k03kHRJi56rg
- TLSH T1F3155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 928KB
- SHA256 2fb2e5cb59997f0bb72b4202ec7890fcb9788118fbc70baa27431d3e8dce04ad
- MD5 3d977a7993216c0976f13597b267950b
- SHA1 ed5cb1e22f575cbfdd4df19698d5491624b9f39c
- SHA512 5e7c71ce9ac9e8c92d8035283c394c716e01d12dd9fbacdab394433c66a2f3d2d6ca90a9bde14339fb40868b73e8c091dd9009c485958a1ac598694c76f61eba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmKp:A3k03kHRJi56r2
- TLSH T13A155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 928KB
- SHA256 c739f25a16647137fe1cae211c88c3566f68caba1b1fb9c8d2c82b40759d3dd9
- MD5 71b6d008cb1bfbd4de17dbf574f8c60e
- SHA1 375ac80b6bb90d7ea0848305f1df8a653e3434ea
- SHA512 ba149f3b9655c66c409f92741912b7d9f17bf13faeac70fd6f8fc490a94e07d275ac39cdad9cb117331a30a3f2fdcdb35e94f24105d1caf889404dba03479271
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmtN:A3k03kHRJi56r5
- TLSH T1ED155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 928KB
- SHA256 8f87dcb486acc77267f9f3737cfdd7ba8d585c9c7bff95a7aaa50b0d890037d9
- MD5 ba08a3b52bdddc902aebef6d28860dea
- SHA1 b04c1168a087fdb7bf7aeb98e5d680ddf91d16e2
- SHA512 51d4a68c8d9889b433ab01159811af498c90f9a94846d503b5e47f336703c94691e439628accc77ed78523762d5fdee8b8f969677aed7810025fe979dd290dba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmfF:A3k03kHRJi56rr
- TLSH T189155907A6890FA8C11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 928KB
- SHA256 19adc52c68f9237ba10fd52813f7bb6878ad6de36c1d3e3ae59ff455facdb045
- MD5 dc572cdfbe6ab89a10d336e6a53d9034
- SHA1 76234dc2e4f06a8a08f19b3c2ada1b2f2aa0a330
- SHA512 e962f53a154f971ab569f71d2785b6d48f14390d89d2a16e6b0a2cc7f1326a03d0f2f09a17823ea2c7962b867b19fcd1fa2325362afa4adc8f505295ad83ea4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmAC:A3k03kHRJi56rH
- TLSH T181155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 928KB
- SHA256 ae7a9e81cae9f781450d9b479b86a841d6b5d22ba36b67ea88724b5d22d52971
- MD5 de0bd9dffda207b270257891973bd554
- SHA1 865a78cc5b1f4e45fb466d56deee2d5485b5f7be
- SHA512 61d6535967746089f85129112c47d291ccd0c3270dfa79a368ebdf5231df1b39a359f74e1d502b7edf77aff2a1e14db01ec9e5008125758b38abaf786869cd37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmTw:A3k03kHRJi56ri
- TLSH T1CA155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 928KB
- SHA256 a077dc5ef34ea286610f838d11f7f82881a7b84d24eb1d0d6e3b4cd410fbf37a
- MD5 176418fcf7c067bc081e51623a6bdbb6
- SHA1 e1dcd8adb23112fbf1846d89fdca92cef87cd9eb
- SHA512 f2d92cd4be84fd79a392ce6c088b5296b8f802e7e3691dc0050e5612ed09a2e11f85cf6739e51742860070e16674457cffb036235e1b4cdea8ed9a4078b9d204
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmaT:A3k03kHRJi56rS
- TLSH T183155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 928KB
- SHA256 85525e4724a9da81d6780c7b38b19122e767309a974f52cace073fbc5b4eea95
- MD5 378881c1c5da4924db21b5f44aaeb1ce
- SHA1 a5096b7a3b403b76eaaae09c968c61187dec4fde
- SHA512 f550a7e77219c2dbaaf63a6b3014a3e46b80d738693ad431e3e6837c7d61d88db8cc1feaeb34142cb2c8d3c7217f77ffef4c5606fbb0d0890c0f0f103b6cbe74
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Em6u:A3k03kHRJi56rd
- TLSH T122155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 928KB
- SHA256 5cc5a64d20d854a87402dc996193d2bd3388c0052f0e70e0bc943359fc78ddbe
- MD5 9069875fc5e15f36c336e822862c0201
- SHA1 e1b30669f439af5ac8eb37af306a2356275ab9b5
- SHA512 189aa74246aa3e6b01a2423c82df3993b78fcf705b0acf74a0778968ed9ba04b76bbedf7ed64c955ff585aab7d82865e1991f7f1cd21d0c341e2970e02bf190e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmEb:A3k03kHRJi56rs
- TLSH T1FB155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 928KB
- SHA256 5a5c77354a63dfb537d913d46dd730584549397acdb473eb5fa3a5a79599faef
- MD5 0b368db5c2846648f1bb320a41e37d12
- SHA1 bd6de70ca4d4902e4a2359c13b2da11625f2e00c
- SHA512 f9cfc80c6417aef1f86ff9267b26ca191d8b132dc59abb506086799509489a92bbe89e50a32df38ec1253fcf81e16955f53ad7f57f85ea2b0d18ea90fee1de67
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmKf:A3k03kHRJi56rs
- TLSH T1B1155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 928KB
- SHA256 b2c8667dfdd3c2fec4d799864a48f145fa7b692079f7d9a0a5f622b3222a0789
- MD5 ac338a6ad60c858b879cc9d19b304e4b
- SHA1 39e85817a49093b99df3aff14f7158b3b396fb61
- SHA512 fac7d096be1fcb0bffc90a5feb3c8f6b97e4ac7222535b850e6363310474795b742651058556c7db383070bce10250d67d3234981112f6424a7098b727e01bfc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmXK:A3k03kHRJi56rc
- TLSH T1EC155A07A6890FA8C11FC1788A968662E7777C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 928KB
- SHA256 97de7824606a0737d0e2ce41555866168b0bb29210b792d8defba58d0f530030
- MD5 805f87589e3e7e70e4e6abec494e8462
- SHA1 576feef43d72fdc3db6f7caf7b340bd8922a44b0
- SHA512 c257a56b4db0d621380763d2d4c871d557d39e52dc2e8385d48aa54e9d88a0da2856b2d559fed2016062826ec9961a43e7fa4763a967e723779c41c73432548c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Emgk:A3k03kHRJi56rl
- TLSH T183155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 928KB
- SHA256 41696340a2e4c0dd0516430118c0e4bee1cf1ba1b40252f68f4f0d6717f640f9
- MD5 f29d3eb08db2c9103fbada64fdb20d48
- SHA1 e49b93ab78ed0b66567f4b79c69a4aa182d517a9
- SHA512 4bc0b437b126987b88d30c90e44b192e0fdb7f4c3e0056c3630a2147c14028177e2164618ef66a1c117b5751ef68ea3915a7093a6c966112d874101e20ea730c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmR0:A3k03kHRJi56rY
- TLSH T159155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 928KB
- SHA256 6e817c220c4acb1f4e751a9715f5d994d818af0253d77f9e863331fd9ab8ba99
- MD5 5d8e65b5ebe233d1c56a47c0ed72261a
- SHA1 f91d89464171d787e225a33582485423c6599591
- SHA512 784394556413b8fac01c06accc9252b9f7afe6110ad58a1cae5e554ad2d4a86730aa466ef8ccb6ee1997dfa044fced6b1a71991a32937fde546ccd8dbd1238b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmEg:A3k03kHRJi56r9
- TLSH T1F0155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 928KB
- SHA256 448c2ed5eee141a3b551835d243aff52f65dc326b5f8c9c60c461ce46569dd68
- MD5 a12bd38904d6b465350441016264bb5c
- SHA1 d351c8d2292656915a4d18ceb935e5277cdda76a
- SHA512 a0cf1aafbe674d063cf27bf450a35c168d7bfdb324ddff48da8199d8bd22814f97b1ac1009131c609a3f3828ed04a4f924ed1b2378a46b2ec101eb90c402e91d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Emhr:A3k03kHRJi56r/
- TLSH T1DC155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 928KB
- SHA256 138a17dc883b61bb239f92527c6fa4144a359adc3f0d987eeb5b33e30932ce7a
- MD5 be0506b767aabcf331c6b36082d75df3
- SHA1 37653458cf0a4d5c16925341a793bb5dee77211d
- SHA512 82bc75ad99fc041a8ed289b71dce450bce87f577ab01a66b4598c3944bac63ca5de6418946c31e096f59a130a817e40f20e32bf113078e982b87e002a49f534b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Emjn:A3k03kHRJi56r5
- TLSH T122155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 928KB
- SHA256 d31c5ad98a169d50fce87ffd4c9d49ff3faae4b05e336775f2db736890f86946
- MD5 37fd691e54ef1ef51221a455ba62b891
- SHA1 f4c95911dd4d026808a276b6b0d311197bcd629d
- SHA512 9a81c98e6e0223b44dfc0e9cae98dae996fa84bf4b2a88f3e7e87c9a89c630aa97de1cb355a385c7896fa06d580869c37498a596b66958e7115e787ca73c9f2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Em/x:A3k03kHRJi56rX
- TLSH T132155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 928KB
- SHA256 93081295e46d224cc4724b7d271ea1d2bbcafc93790d6f1a120576a2ad3760b9
- MD5 d2dece48d92f4cf45ae86bf97b00a80e
- SHA1 e105ec1a46046ea674d4ced3b890550f2d5dbdf4
- SHA512 ad5043ac2f73d29d978a6ff7cae790d14d666fe4d5af4ea13785e198706296704b28473350d75c2ae15fcca7516f74486d26c29aa864eaa95b75b82d5c7c0e98
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmlA:A3k03kHRJi56rY
- TLSH T10D155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 928KB
- SHA256 a099210e7d8e56a68c8218f46d43a38128f868a8fb8f6319f3ffe73e8eb3cdea
- MD5 97089778eb22e61186982427bc1d4432
- SHA1 2ee77321f5133d45681c1e2c06d3c250e66ba66d
- SHA512 29600c1a068bd02d901fce525aeaae6b67b5aa3f9c0932fcf4507dca4ce796118034ccd698794e80ac91c5f40a2968e98fcb4454d8d9c9c523452e70c6f86b17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Eme9Q:A3k03kHRJi56rB
- TLSH T181155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 928KB
- SHA256 c7dc9bc0768a8948071f35af172af345a54d7cca30a64b23cc92590a5806dfed
- MD5 78b6da9b3a2c015daa6c6355bafd8e25
- SHA1 7aeda0064af2377d883596ee14d37861d4ff4f27
- SHA512 0f49c8230202df4bba4871572211817a289c42be92417f95d38346156df4ef366440527038c4842ee4f5685e4c71f26c351aac5f2f00957595b086de2644e07f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmL4:A3k03kHRJi56rm
- TLSH T1B9155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 928KB
- SHA256 8e3dded0aee6e51d33a978031ae3a93541351f68c22cb5e1a8e94bf4a0063e23
- MD5 ebb77e02d0863ac8ad5cc2c871ed5dcd
- SHA1 01d77f14094bbd46debab0c5545909eb5197b930
- SHA512 08b0e37c3a8e5a85cba6f3e72d4b224c716efa928e8fc757dba3b4b3260f3793c0107167fe634dbcd3cc1ada59dbee40d8b78f7fda9021c8d22e57603378e869
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmCu:A3k03kHRJi56r3
- TLSH T142155A07A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 928KB
- SHA256 775f6ef81505f675b2ffa721e3f2149a11a619738ae410856a3037ecd01ad2d4
- MD5 748603c9202955dcd5eb9e74fa0f3371
- SHA1 bc8f8ca60c6aa60f6a45a0cf5b03bdf054f2c199
- SHA512 e8a52b3aa84da1bf9cd11d22b01247827cc7cebdc33f09b61d93d142807252da7d9f98208c540a91479aa39daecbb10f97017711ed5c5b427507d95c99384b42
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmTj:A3k03kHRJi56r5
- TLSH T1B0155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 928KB
- SHA256 cf32ed1156abb34333e7aacb0bdcd7ea4be3415dc5799d14acb4648af3a90dfc
- MD5 f0b94fe7b93b2138aa2c9dd75c79e5f1
- SHA1 1074946627a66ebfbdb8217ebbfca6b09c1d67e5
- SHA512 911cdbc88f6d563eac99fa0e32edfad01872ef234aaf29debd511329369e9ef2f369634a427e7c6198727d09f0e60b0d97346ea4ea28e1ea7ffc51f1794e8c9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Emeg:A3k03kHRJi56rN
- TLSH T12D155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 928KB
- SHA256 dcb39ad93d1c21cc9f52e81fe0c074e1bbf174f4759c7f1c1d58f50f051350cd
- MD5 0b47b37b22f242db8d4977e0ef418e47
- SHA1 a5412eb60b7108c87ca85729c3cd3853a355ef41
- SHA512 92970b38916a2f431221199894b339ccc57234712ca2064e0ada5dded186c5b070715f2c592133cb9315b2921aa3ef4f057883cc1220c0ddbaadef7831185b3b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmRI:A3k03kHRJi56rE
- TLSH T1BD155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 928KB
- SHA256 cbff9fa43926805cc2d03d319be8b19a40c6f0a5ba3cce19f2516a906735a01a
- MD5 ed9ef2344738edcb5ea655203d96c75f
- SHA1 822456a8d053a86c185e56234463a8830b21f47f
- SHA512 6e440caf0cb3f347552a38e17a4de64aa088eb12feedd52a31dbf7d7b6b25192c45bffc90e5d84300ed05fc5aabed8aca124f7c97dc0969655912df9a6e15362
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmTo:A3k03kHRJi56r2
- TLSH T128155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 928KB
- SHA256 ef7ab22a361b4d00c2a1ec003f23a6772972dbeb2fb1a5a02d5e553f76054015
- MD5 c67c8972fa553c7315b9791965b37ee8
- SHA1 747f4abead2721f609a22a17077c8526794a347a
- SHA512 f8abaabe81d4a60a71f22bfe4072bd004d69a1bcc27e247a1c5351b866e704886422911b154a231a16edd03194b41c7999cbf649652b765cdce3febcb0f00bdc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmY+:A3k03kHRJi56rj
- TLSH T1BF155917A6890FA8C11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 928KB
- SHA256 59563f4c750f29b10de4c6ec0085717dcb8c7a0b2036583bd7f0f419f2b23a08
- MD5 74653bff08da77af7b269320ff75c91f
- SHA1 43df24090b806ef967ad919922bd305c999b6c84
- SHA512 1031efceacc82d15c799e01229eaf34021dc543abc119daa4e91093745c4bef62bc93e4514f057fda4ff3e853b852c864da65d45d4909441ef65b9bf31e61eb7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmwQ:A3k03kHRJi56r3
- TLSH T187155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 928KB
- SHA256 bb157adb0f18c1c0ebd56b19ae18bca1ea5bfb8a2890e9cc076aefcefb0a562e
- MD5 ab55f1c4a7460753b93b3c5640c8a008
- SHA1 4b85c5f825e1c0d5a0ab6e1a1b871a3f4156f487
- SHA512 df1b4d9c75555f4f8f1c88452e436a9e3a8b0fcc05e2221bc332613e538a282174cf20fc8d0978da4ab309f20ec7c4e1434d9546d8848ff7b7c9045bf64a2a33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmZX:A3k03kHRJi56rr
- TLSH T1CD155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 928KB
- SHA256 5c18f790a41329ded5b6a78b7e7e236be0415374f0389fab65652953ab7c03b9
- MD5 117e01a1b1dd8e19dc87ca713f9d8241
- SHA1 d15cc9be63863290e9e2376ff2c8f489462ef0dc
- SHA512 e30e0f67073d547665554181c2a49ed8e989dc1eded4c82761ead1417469a3756f2bd3d655c222961a7dccdaeaa9b34fadc967997004e045f0c132ce62984990
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmzL:A3k03kHRJi56rl
- TLSH T118155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 928KB
- SHA256 1a7cdcad2680ba2dc78cf05ba34789840755e8a04c8ee96cd125c8de9ee0e0b1
- MD5 a904f7ddf675134f382ffe90d7f4b3fa
- SHA1 32b22bfd1e5e428db621bb6ae7b21f896f38d10e
- SHA512 ac7aa69d152d28dfae17bea1dc0fea15c62727e87b3ec82b3439c603d3e90ee69fe2595df9758607b3bd34c13bed8e97c37c113b8eab0493c658ab08df548597
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EmZM:A3k03kHRJi56rc
- TLSH T1AE155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 928KB
- SHA256 d83665d8db16cae9b007ffb37fb43670e823e83bb8795478814fcbde5a424aef
- MD5 1b8568954ee2b0228f11b4ed50aba54d
- SHA1 86a5c7ce9e703b5d8503ae6cea003daaabf69950
- SHA512 b67b08fa95e56d9786a76aa01e2f31c187355366d704c9de521101001cdb05770c3ce8a98579365f57cc6b479c5c1f2ae3b2724fca2e76a1c7060f88d060d028
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4Emih:A3k03kHRJi56rW
- TLSH T1B5155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH