Analysis
- max time kernel
103s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 16:51
Behavioral task
behavioral1
Sample
2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 862KB
- Sample260811-vcsvmatwgt
- SHA256 16d4f9daab72475f51a16528fd38c92a7104b42508c22ae25bc6a4ab98d8c671
- MD5 b6b3ef9a412541f72c01abbce2af270e
- SHA1 25724aefdb1560e62ee03bccd9bd3b58acd60eee
- SHA512 e97c071c6929c2fc483f618d9a8a8a40513b1a7749f3ef7a0c0f4c1ac2a36702f67c54ed665c26ed09c1f3cd6880c24ebbd5c597a1fc92595d4e940fce0aeb44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fv6:A3k03kB56rL
- TLSH T1F7156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/4084-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5ce-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-33.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4084-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5436-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-276.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-581.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-618.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-667.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-759.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-840.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-974.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1092.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1321.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000064e2-1996.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5ce-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-33.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-276.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-452.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-581.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-618.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-667.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-759.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-840.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-885.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-949.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-974.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1092.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1174.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1181.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1218.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1321.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1340.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1365.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1372.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1380.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000064e2-1996.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5436 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{32D54D7A-68C8-4A48-B601-5B27D66D3DA0}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4084 2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe 5436 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_b6b3ef9a412541f72c01abbce2af270e_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4084
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 16d4f9daab72475f51a16528fd38c92a7104b42508c22ae25bc6a4ab98d8c671
- MD5 b6b3ef9a412541f72c01abbce2af270e
- SHA1 25724aefdb1560e62ee03bccd9bd3b58acd60eee
- SHA512 e97c071c6929c2fc483f618d9a8a8a40513b1a7749f3ef7a0c0f4c1ac2a36702f67c54ed665c26ed09c1f3cd6880c24ebbd5c597a1fc92595d4e940fce0aeb44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fv6:A3k03kB56rL
- TLSH T1F7156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 963KB
- SHA256 a7435486b8a1c9597a85c1894f70835ed6a0cc1d2ca6d0886cda039b411e2d0e
- MD5 364c93522d1067116a6e36eb75c7754d
- SHA1 285fa2712627df1aaa0ee0965f3684c2ec4261d8
- SHA512 42c65650ad513318eb55c231eebbb726deca08a8e9b7fa01e75511f9afb550377f03a8635dc731363f00f3aa3430793a1038135cb3cbccef7e068920ae1b6889
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvVT6Nr:A3k03kB56r6TAr
- TLSH T19B256A03E6940FA5D01F81749AA68672EA737C125F2093DF2354BE153F72BD06A3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 e4c054e3a0a0f098b082f47fe1c3addc5c6135e15e0b9446a748ec5f8acdb597
- MD5 543e73fe6f3cc77c7fca4448c479d5df
- SHA1 604c80804ce67fce4114bf2e5343118a8c13f8a9
- SHA512 21e4e08909e67836a1ac5a2d32b173f7fb25d23f92239010ca9151edb915648a5e13a19b214dd345007a1bf242496e42d10818f84647f9c9a58c254ced7a3df4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvK0Le5ji0hmxNrM:A3k03kB56r3Pji0Aj
- TLSH T153655A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 877KB
- SHA256 154bf2cc195ff8777fbbdaa63c2a2c92929d5f86d2471324b7d4ccf60db9c28e
- MD5 d12e09579f0202ba0d3a0b3115a6c3fc
- SHA1 d71854b98a76780b488f2e171470ef9859fc9185
- SHA512 f59142717f362428c21fb944b2234dbe29be53d61297da212c0429d47a1f26f52a4201b1aa93e4f1176b1fc5b9f9fc429d6ed7abc5e252fbe1364a70e88664f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvEa:A3k03kB56r
- TLSH T177156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 886KB
- SHA256 ed6b45d5afd60f820bc66842f6c7489f7b6956b449e080266fd318ab3a868ce4
- MD5 148c3047daba034d6b0b5a78360834e3
- SHA1 9b74cb7fc65659c36236f64c1239256cc628b147
- SHA512 dfe455a69c96e7501f68e3d2e3dc66379062a92430f449ae007a6da27cc7ffadb305c666c655457e510646c8ea726f226a466966cc8be36def6084cb358eb215
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvF9:A3k03kB56rs
- TLSH T180156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 886KB
- SHA256 563deede94f1cba39b0b75af43e82b451dfd78c3b6f9e2b453142aa11d4eede5
- MD5 bb9131b795a42bf1edaf868e6dcdf5a2
- SHA1 77da7ad9256b84d4a74e219010f0ab5ff5db32ae
- SHA512 48f34e19e159395b4ba1ea596bf3321419fba21dff1b0e6869348add0885f4dea84cbe824ef3af8baca22b9c253922a979e2b50847913317d4c5df58a8e94725
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fvhc:A3k03kB56rl
- TLSH T1B1156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 eb27cc7054b7b88d2e3faf87fa07737f59a4dbb1834be188a6cbd8f97df0cf3d
- MD5 7614627e0094bbd589e7dec8de9100af
- SHA1 ce1b0746bda3ec8223f16527418ddc70b7803c4c
- SHA512 34e3fb1271b5bd31b88c1913aedb79094b685c8cbec728e9078e463e207a55cfb3bb9b03fac3d7cd90aab53eb868fc630887b89f4e562820dce9cc42ed9c7c77
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvKp:A3k03kB56rL
- TLSH T185156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 3564e41ad60546d304b39e7704a6d7c6f26253a23eb7155fc1eeed21c9803142
- MD5 5c27559eeab7f0345c9bf1b0e6059329
- SHA1 5d47461f05d849bdd38730f8eb3a78bb7213216e
- SHA512 49a87d507fa41b4a7d5dc69c586f744d4d1d0e5a9ea2220c825436858b27104a7fd579eac229f255795d4a953e7a6e00de8e12062911ba3f3e218925656fbcf3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvtN:A3k03kB56rw
- TLSH T166157B13E6850FA4D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 bc26fe0fad9ca145cf755cbdfc44fcb5f446ac2491923e7a4aa735126fc4cb47
- MD5 5a91d7fe4c5d242c6fea999a7a17c9b7
- SHA1 600f0062cbc3ffb40e469bb481cbae26d72aacb6
- SHA512 2f37d3512f92ea151ac6442b1298bc2ee3901a788c1ed5ebb760492170f161e33c937b3e26e75c4a1820db37f08ff890a78c2f9d1127af81bc25c3cd5b4c3c22
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvfF:A3k03kB56rm
- TLSH T1E7156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 4d00b8ad8df5fd82f82e021928723eeb3e498b6934cb88826a6296637148c141
- MD5 ce8f3b0d7fdad9207fa2daa23bb1f635
- SHA1 157d1f56bdd82d8af38811efa6d26b6f793ad73f
- SHA512 90926877a6c976c7335c3e034761e11460f10c00d854bcf36b577c2892f392e42a2d4c98dc9013de731a56a1476ba58090227b699607c3c3c5963c8ef525649f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvAC:A3k03kB56ri
- TLSH T184157B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 5882f67688d79a251797bb5ab68365e4ff4a8a56cca062cd104c0b31b7c5877c
- MD5 5edb5bdceb5b1e580556c8c2f7cb7c58
- SHA1 852c4c10ba8f93e3d65b270c65b8eb2be6be2c6b
- SHA512 fd6abcb47586872c0649e9d7595b131b66379670a2873c490980ef28de49025c1ca6e9ac0a0e8a56f0969d75627c5f402c6ede654ce7128b35a976d340f2b113
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvTw:A3k03kB56r3
- TLSH T1E4156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 afaca298782de6a744f5742ca439e06b106a67c7a4d1ad68ad597ea2b9f12441
- MD5 83d109c7cc9d8a42b380a153fd7d89fb
- SHA1 e7c8a350b7ee1bd29877691b9a2b7b54ccb929d5
- SHA512 3230157b9a920beebf75bdcb9c50a46f1d78efe0ceec92bb00674ba27e7e2b45c01b3efcfb962d6c174bd856234e7abfed4fb1d59fa54cbc7e4e3c4f803bded1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvaT:A3k03kB56rz
- TLSH T1EF156A13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 5c666c3e7e7163fe03f2c2923ac2667191960ff0ba9bacb49bfb598148339b1e
- MD5 ecd10046b53e1a27cfe27e2bfa4afd44
- SHA1 c0ed5554fc8f5ea7ef0a7998a78d9cd937a51f86
- SHA512 d1365b174e289fd1f7053ef5b57228d530a923469e2466750e636f44d05fd1e605431414d8432ccce5675e5ccaadd99fb17a7c702251fd31be5ca4b912ff5fb4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fv6u:A3k03kB56rk
- TLSH T1EF156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 eb7277f36a9101934d7f39bb3c95315e7e8bebc7565189f9fec42fecd8baea45
- MD5 8f48ef397d7ea3b040acd37dfd3fe627
- SHA1 06209b99f6f4c6c636a224f103e5c64f468b4d77
- SHA512 ada322e91d53f61a4b46b38427bceb612cc9a31fdfb4df7b9952908272e834dd017263d4523bcf1ea092d2460db20cdc13510dcf49c8e92164b37a987f91c208
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvEb:A3k03kB56rN
- TLSH T103157B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 0c6b5ba23e1fab4b189fdcc44e87d95f89863dff2eafd7e91e68b8dfdb860013
- MD5 408ae3288a1979305f3f03b7ccce89b2
- SHA1 372c63cd46d0d8f2b3e06f04e9a93660b59bc398
- SHA512 b4d0fb547823251596442cb0fa92597c16a3962ee1ae1bc342ee06e74308a4735c9f8f84a6047da264fdee4ff7943d85260b40e8d80ba2de3306f3d078bd66dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvKf:A3k03kB56r9
- TLSH T148156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 0482b28145e53439234530ec3b5cb985380fb399e3133198d78a2da6170f9445
- MD5 18e9e8d59956b56f437a4afdc519966e
- SHA1 689636b7514c4e18744f89314c211b765e5f267c
- SHA512 996a1bb695705e2a51c531f6cdfca012135fd875f0baa0d9beb404f5d240bcaab517b4789371f70ce3f0456639ff59aab4f6bd864926ef115fe1815ee1dfdf1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvXK:A3k03kB56r1
- TLSH T1BA157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 a436d001b95f08ad87feada64c9d388c122aa78106bd314a8591953ab3036278
- MD5 3ee0e6382d7e8802d2db94676c6ef55c
- SHA1 3f9e43e7807f5456c9eb34294319826d067b6533
- SHA512 0034e8b2155898af7b0117ad72e16bf259b9ddda1dee2d3c3a7ca9c3b0be7dd8861571f6f27c485a13b9284ef82c135387f239e0c698e612e3c4221d1ef7e6a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fvgk:A3k03kB56rc
- TLSH T1E9156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 7a5ae3baeb1cc4d74de874b188f6546416ec2f11bcba5d3ece21545e1869c44e
- MD5 6209de0c21eb0deebed06f2b9b78e9b3
- SHA1 0bb278b116b479886137a5d2ce9900075b66bc6d
- SHA512 588482f143cd025a9a3b41c49dc80899d449fa75c59c63329db40097db4a71c3eacb54be85d2d8ecb1534d92e2d17830a257210cfd49f1ee1d56b2d20756d17a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvR0:A3k03kB56rV
- TLSH T10C156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 862404f8e232d0833f7408329196cfafd4e6aaec714320270cba3107216402aa
- MD5 59d81558e0d8296670b3938427b553ae
- SHA1 787e75fce25c34533774d41a18187f61594c0ecb
- SHA512 03583aa0f3f22458d0d15e981462dfdcd6ffbea80175e5b8c03304b3b1b1797079532e9ecf8b11013ff3f147932ef99f229d180c3594115fd518e70050f79612
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvEg:A3k03kB56rU
- TLSH T1E7156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 e875e7a367cd1053bab824d20014c5e36fe3b45e503cd827bbb454cd60ec3d34
- MD5 ec748d17f05244b9fd2108e66b5389bd
- SHA1 7593b8d8540b85938d33f730e4f297b4bbbecb51
- SHA512 fec9bd15856b26946fbd26bbce15cc360617fbe5eea04484c97a18f533d9500f649c16e597ba6602d65dddd45e34c0ee584a9a1d53543fbc4956a96aecb41096
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fvhr:A3k03kB56rm
- TLSH T11A157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 03fc18f85f93993ef880c27dc4454974c4071bf360adddcd37b7c5017c1031d0
- MD5 56b6f0b9154c4569bae46f69f61be329
- SHA1 3ad196663af19afc0756146de51a1d93697bb634
- SHA512 c63c0e468303ac7d076acf5fee4750e238091edde4a009e8794eb2bb78bc657c1908623c4ae487585db26ddb5fe79f936f0bf393f8544f9d9e04032839973aa4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fvjn:A3k03kB56rA
- TLSH T127156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 cb68bd24d624eaea435e88bdf2a27e8fdea6b7a3d67d6e33d4213d71e5fada12
- MD5 08094d3332464283e26ec710674e70bc
- SHA1 22d094d7cdad0ad0f8fec1d965f91f9f3248ed24
- SHA512 37ef4f61cad8c4d49e50e3f0e0eb5927721412abf108f0461ed2fe401aac2a41799fe737051c772da6b52372f17f7d39b549d86557d15f253ba3de0d5561b907
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fv/x:A3k03kB56rG
- TLSH T147156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 c4f205cb6ec7b949e8277a2f1d45c8a3301b0d29f470b8578827240a47ac7fd3
- MD5 890af12a942744861387eaf548dd1892
- SHA1 e3ab9a48120ac20edce63af03ba8d4985180b8ff
- SHA512 2d561e872c067f91907e93d6dfec0f3297f96c903c958b44a24f48e7fae557b6d4ac7e88de03c7a686b4a94a2afc4880154609555e5d518e5d387f51f7db89e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvlA:A3k03kB56r9
- TLSH T1F6157B13E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 9a5e8911da7e7590b9bbed391249f1a012bf69da01a2b5cfa9e8ecabac6f1bc7
- MD5 0eab1953f9cee128c4f93ff698f1f3bc
- SHA1 5aa4e6bed93854c3a5fa6d2938e54fad08d19bcd
- SHA512 61105896dd17fc493fd82288ba2bd68b97d9909eb785a073f9186ed2ae4e8babb845ef100e1ad1a106524ac2b4b6948125c74bd40a7931ac7ff1cc11b862f608
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fve9Q:A3k03kB56rs
- TLSH T16A156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 441ec380642f03661f8cba8756a209ccddcbf403523284d526835629dac2b878
- MD5 1fc54ba86fffbd47ba740b17505e6e36
- SHA1 7b332783abf1e26e6374fc60e1c79bff2db68788
- SHA512 b171c1cf5a25433751dded559171e216b7b41f269b0f300356a2669f7b13ecbe622e42c8222327707275fe0ea4a118b43507d6f22997c061a3dc07c59e7fde1e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvL4:A3k03kB56rn
- TLSH T137156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 2a5c199ed50e2a47afa852fecd5795a9f7097a4262005e37e90915c20fc5f006
- MD5 f329f51914724c8f38534e7787966106
- SHA1 3fd7f35bdb44d17b1c48a41bb3ea8011c936e17b
- SHA512 5e95d882d145141f2a35dd2888376402dd1fab911678c1056c1e113d6c020e616f29c8af477db79d59532e1a12a4de3befeeabdc99b588f684b428d5e5167429
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvCu:A3k03kB56rq
- TLSH T112156B13E6850FA4D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 c36eb7639171f5b004878c65d4b8f8b110f099a62a2e811177c9f99ac24945e6
- MD5 e081263d60f511d55d9535ee13d40276
- SHA1 321a51523105774990074e23aaede7e7165095a6
- SHA512 f7c497b11a76e33d5a42077790ffadc7fc4f3b2a70f6a66c8e72000320901e82fd1781afb5000112055479d20f970bddcecbef970a2b8ab5849fe33797e54e22
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvTj:A3k03kB56rk
- TLSH T168156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 68694f72450060d4e3ee2fc8d52ae1d32b4eeffdaec9c446d271a4f6e54493d7
- MD5 84d8284f2b8eaccbffe988c45e4ec14f
- SHA1 49ca045e9c87840bdbb2be3f24b0b3c55fd00a13
- SHA512 a3112f5608a2b911d1d74265f83c8fdf183bdd154fd2e9408c9a32763bf96e8eb5cf27e3c9668891c075485646d217a12badc597e0cfb6eb15f4f07882358a7c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fveg:A3k03kB56rs
- TLSH T1A4156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 f405df230c2c957436387217f92f0aac71b3e39b44449bb4f1b08e9bbb22500f
- MD5 4e45985d8c724961203fad2a4b6d2452
- SHA1 daa689a40f933660aa921db3b6d68e8b2626f8b5
- SHA512 37cbb701d7f5fb867b4d9b275c7dadd3509cbecc11bfe5cedc66273b8393f883abd64c8d5adfb7fe9e22e92e42ec7b75f4c29d825279e43a48070d202c391a69
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvRI:A3k03kB56rl
- TLSH T1E2157B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 4ca0786f706fb4b67edbe7208656c2711071ec70f6df7424ec77434ad556bb0b
- MD5 1b0ffd3bd46d256e7a4abd9199c0800d
- SHA1 85a6db5e7d4e3a2bc0d1fa79ba01345413313315
- SHA512 00927d7a2c1d32395234cff1034a8b745e8dc13266e5be37da6b680c12a96dbd560dbc364e849319a82dc4f86001d4e1818eb8d042d05cddfe38837e7f5440e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvTo:A3k03kB56rT
- TLSH T1DC156A13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 f7bdf5b1780e4a68e934c575c6788f2085a127f65540acbd5ccbc7cfd86716dc
- MD5 a97f8af96ee7af950673d25564c89970
- SHA1 0557382610d056432bd05ac9d8d3c98fa9535928
- SHA512 3b09e8d76005b78c1b3d43da23cefde4895c25e4dabb589a7fa88b65f3e500f07df24e5d17ef052584c95e2295b6b4bc36129086c30baa758d27900aa96d7b01
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvY+:A3k03kB56r2
- TLSH T157156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 7861ec63900bb5f3239ac3aec6d01db764823ffcf45cbadf1c8d80f678924641
- MD5 0bf41d07181fd109368ee39f08972d94
- SHA1 76ef3adb0a043304d4987df84527a53123d01c5c
- SHA512 dc99b71f65a345158ebf89617d3b32985eb8bcec7fb2abc0c577f6566d7a535b61fbd8004a55d9e55df7bf5c90920371c64b60f94525cc4a34bd8c43a4fe36f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvwQ:A3k03kB56ry
- TLSH T172156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 f6e978d3cb3f3639d1048b434a774d9f76c798a9e4a96d2f1afa6387fa98eebe
- MD5 6b5e8295aad632f7187e417eaed566d6
- SHA1 d1fee7b71a1248c880f24a0e99f785161f242fbc
- SHA512 1c8fbdab805f3954e2b6e1175b3c948ddf9329dbccd6ae863029781f5f300ccbf410805b56700e01b2d8b3e8c7d58577a011daad82588737a7988d498ec58305
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvZX:A3k03kB56ri
- TLSH T1DC156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 4db3b16ed6f0a99d445ec408f663d5a04699c565608e40322aecdd85d4b30c1c
- MD5 696642d309eb2d513b2663437aad0320
- SHA1 a91fb30f8469a7f5a52818bef9dd066e547f905f
- SHA512 c0d8394a069c4ee263f02607c5390909b0846d0116d0e6b30fa5317995cda8c027d65a50ba304b19f41622be8f0441458c4a74be0d8f856ee42467307472f280
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvzL:A3k03kB56rM
- TLSH T1FA156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 5f9140e42587b36d072051e961d83564480173362c74d53da49869c0ad04ba45
- MD5 d6116584dfefbf404ce09ee53c971193
- SHA1 d8b223d49bb6e4a254d89483be9ca3452710f13e
- SHA512 06acdca87e861b80a9bfa94d9ac7c241487f0224c8a9e42f0af0a6b30e37810bf844cf93bf5c39d9b549e344eb1a9c6f61f9b755cb84978b81061511841d7a52
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99FvZM:A3k03kB56r9
- TLSH T1AF156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 38481529e4038963ef509884d178a44d9485f79c02b7118de05a2ad4a2b0f151
- MD5 82e03605505cd13b800a52fc9c4e5e87
- SHA1 d7c5b735b132c7b7ebe9f2aaf1d24782343015c2
- SHA512 6fda7b5e3af830c020e138a3655a64b956941e3f9aeb79a69c49458f25ad1d6aeda05f13e46e29c362c7e133bcdcbc8bd804d2492e4e7fa8884690ebca61a352
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99Fvih:A3k03kB56rX
- TLSH T1EF156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH