Analysis
- max time kernel
108s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 17:13
Behavioral task
behavioral1
Sample
2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 839KB
- Sample260811-vrpfrafe44
- SHA256 9d119cf85886ade64a7ab7646e3a6c743b4e11dfd2d3c1e758f13f79bfe45c49
- MD5 28e67d86f86c804c92258eb9843185bf
- SHA1 1da300a7eeccff6f8ee8703b5598446b198724e0
- SHA512 09805a67a4bb5e55cf43af4ae9aa985d62629b7a89f57903d592e00ede70e57467b6dbe33b3c4650ff18ce6b1f09d87d114c68a7e0309707207df66aa4fc389e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYW1:A3k03kB56r8
- TLSH T1FF056A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/2984-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c50a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2984-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2904-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb4c-256.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-287.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-444.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-923.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1047.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1066.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1128.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1148.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1352.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b68c-1910.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c50a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-12.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-60.dat aspack_v212_v242 behavioral2/files/0x000300000001bb4c-256.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-287.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-444.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-493.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-573.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-617.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-642.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-923.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1010.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1047.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1066.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1128.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1148.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1173.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1186.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1187.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1308.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1333.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1352.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1377.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1385.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1400.dat aspack_v212_v242 behavioral2/files/0x000200000001b68c-1910.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2904 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe 2904 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_28e67d86f86c804c92258eb9843185bf_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2984
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 839KB
- SHA256 9d119cf85886ade64a7ab7646e3a6c743b4e11dfd2d3c1e758f13f79bfe45c49
- MD5 28e67d86f86c804c92258eb9843185bf
- SHA1 1da300a7eeccff6f8ee8703b5598446b198724e0
- SHA512 09805a67a4bb5e55cf43af4ae9aa985d62629b7a89f57903d592e00ede70e57467b6dbe33b3c4650ff18ce6b1f09d87d114c68a7e0309707207df66aa4fc389e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYW1:A3k03kB56r8
- TLSH T1FF056A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
- Size 937KB
- SHA256 0ccb87d3b56aead597f7206ce09aafdbb4a262116d218a1ac18b464d5c63ea53
- MD5 328d43b7dcdf4c424e3dae4aa480bea6
- SHA1 3c2e171a488a3752a47f5a1f1cad6db72dde2480
- SHA512 a912fa3cb148a4206d9f0e0320af68211c9b39a5738c7700511f8202c48a7884157230f2d3aaa064ff77f71a245cf0fb7306eb1f8d76e641c7255bfa3918ca73
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWvbBPzBAU:A3k03kB56rwBPVAU
- TLSH T185157B13E6840FA4D01F81749A958A72EA777C121F2097DF2354AE253F32BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 3c773657ccb564ffaf1e9b314466466d3b65e4758ee813a1b034bd109564ad18
- MD5 012597df62969477e6857bf893bbe7f3
- SHA1 5905d965fc29ccc0603f3d12d746ea961a926a4c
- SHA512 e54351d008eca1ae4f234a9ef48647974a45f315c62645bd8e416dfc60955c7b61a6662bb5f9256ac0ca78d91ed7eed0b165baa286faf020c9a7272cc9b6935a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWx0Le5ji0hmxNrM:A3k03kB56rEPji0Aj
- TLSH T10E654A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 853KB
- SHA256 02a59301270370080de06a68bf28acc522adbba3d18847f5349afee89ba545ef
- MD5 aecac7ed7f6efb18bf7431af6e9470f2
- SHA1 138479722da7714067e71f9aac2b521eb26df605
- SHA512 e94188bbb8e748952b1c5d127c9a3cc4e6f30b3c4be9601b08ccf5312ae0edb71fac9dc57a48f030866428c2f24917c9027892b52b85b2d0ae386b9b98c4be9a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWTa:A3k03kB56r
- TLSH T1EE056A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 886KB
- SHA256 fa583caa40252ec50c78d778fe95545d9ec7e9d2c9babf53d29c6574816bce8e
- MD5 b6de25b02e3a6264c973568b1b96e9df
- SHA1 119ad1b302090f7d409078a84c749e8a9972553d
- SHA512 bbfbda846971c07522e6272b17d96debdb94fcb81d9004a12faf913d3de672496007360a4e12cfb41372b4d857c625f40b0180b07f565592684367bd1437523f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWAb:A3k03kB56rtb
- TLSH T171156A03E6840FA9D00FC1749A958662EA777C461F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 862KB
- SHA256 fdc9746637c27b2084da5dca2f5a9c6a5b24f4dd28cfe2aeb1fc90d84f3546e8
- MD5 6e636824c9a44edbead377171431c06c
- SHA1 249dc992c6feb564f386c95b342070b5df3e7ca3
- SHA512 06f887e24c93e5da8e85c22f3b2bed6ef53cb6a94a997030b07f7b57fa19ef6379d2ac45700a9ca2b551a2f88661271dbab5b8f1972ff61e74dfc6968a37a172
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWS6:A3k03kB56ry
- TLSH T1D4156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 862KB
- SHA256 2468a39c42364e804a687f2292920d6efccaaf4166a905d7832d8131ae572030
- MD5 8e761f78e147079b3b2ad4a8f3ee2867
- SHA1 18b11531d00b2beccc501919a0a4c846b884e752
- SHA512 6fde50c73a47ee4c0d633b4ec5409606818b263c6321f594254b13f1462a73920f68495b4c621a5782a045a90578571c09d157db2455eddb4a26352d5709da47
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWS9:A3k03kB56rV
- TLSH T132156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 862KB
- SHA256 c74d7caffe854de299244cf1746c2a6c92bbc13054399f03e01a7ccd646e3089
- MD5 8ad7f178a429083451efb9a1a25f0970
- SHA1 195c6e31bd637c075648df33caf113f74a744bff
- SHA512 1d8553e24045636362afb6cafee97818fc84c02db3acfd12fc520769e83dde469a063e9a07ca8649ec8825b1f9c0ed14a403173cc63b29059457cb3185b0fbf1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWSc:A3k03kB56rQ
- TLSH T160156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 862KB
- SHA256 41de17e429305190e292cdfc98891d08acccab464dc8b00b7271d96dbfac25d7
- MD5 92bf8c271b7059b0f3d3ac8f790db2e1
- SHA1 8e36734a9a823c816a3e3fb17b03d430572f091f
- SHA512 32ee33e921311f70d8435a9fb1942cda41df422f3ff6dd4fabd0f9ab88dc880e17b21518bb37a62fa6cdeba23d6fc429bf92a8d7760741be560e300d1f47bef9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWbp:A3k03kB56rG
- TLSH T1CB156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 862KB
- SHA256 2317082e211a3e61c820194dd70e350af5feee487dcf308790abfe2abc70f9c6
- MD5 bf9ad7f069e5105eedd1169ded8c9692
- SHA1 adb0cbdf6988a4cd424fbae1e1b6b0d0ec86569c
- SHA512 4b4e0b401334c4977c2f9d04225f18d962a06f50fb2ea8e1432e04234326567a275531356155e2e5c2bbceee09dbec63b6061b53f13779a5ee573addcfef0fe1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWsN:A3k03kB56rp
- TLSH T12C156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 862KB
- SHA256 1ee0ba2ed344e86e85ee36d8f96b652463f3598b8f7da545f0e788028830382a
- MD5 cd38de95d95840613c3cab5a1de9ae50
- SHA1 be42970acdcd9de276d8384b98fb0dcfb924d26a
- SHA512 8a3461e5e1e342771e0a9b9e170bd8efa87eb80f8912b521a6e044f7997173fb5c1885751e3eac142634b428676d07779f9386c172b38c1a3289a2fc63c9c5c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWUF:A3k03kB56rb
- TLSH T160156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 862KB
- SHA256 cdc70d0d8070421607891f675d38014db85a00b90eb2487b1a2155b177688b44
- MD5 0c01c5efd0291b48f391916a520d8e5e
- SHA1 20a4bbbf0f513d5a0ce273dc2f4b89236839375b
- SHA512 78e8195ff91db5dd9e65c81466f27490c0b07014fa0001bc153531610a28e1479fc124f660e1e84ccf423f2cc9b13abb6fc2d0211601c3826902f0adda7c5148
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWxC:A3k03kB56r3
- TLSH T1E1156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 862KB
- SHA256 b43e8da1a8f3737f07bc2266630ed7dec36eee7c5a48bd16caf58e050fc53821
- MD5 b679bcc8dc78ef7155ebcb9470ef8ed2
- SHA1 04cdc1687ddbea1cef1eec248cda97587372db70
- SHA512 deca57425c527afcf18c4903c8b881845377f8527804e240c7e999fd0b59e0bcf4736725126386a78842b2f8c52115d3868bbb141d5d0b11dd418a9e8738cb5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWSw:A3k03kB56rS
- TLSH T120156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 862KB
- SHA256 77833a574e8f16891b87041a339b8ddf115da97852d11e77d2f38e1c330f6d50
- MD5 41b5e725e6eb6b25995c2c553d1e1211
- SHA1 61db7ec922b140758d2b6b8d38f25d2bd22d616e
- SHA512 10681926b704db1197bf936de563dc666a705a7c26b8d5581306de6fd2ae85a7c31613926396a90964e81a23908e1942db85271a2055e33875b23b5952f32707
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWZT:A3k03kB56rC
- TLSH T1C4156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 862KB
- SHA256 f5766fa5d08ee745d421347e70f980a279e4a59f809ce63439968d47086dd483
- MD5 173d874ecca811659e0897fde3251b6d
- SHA1 d05ba2e3a97b88aac24d95ce0f5213c962b21077
- SHA512 f9a2651fec027093af0d907df1358f386e9e1730cfe425fc4f75618e7d8caa44421467ae12bcff4518f28f06b7fa9d1596e5d4ac0bd5742854f4a95145c3c439
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYW3u:A3k03kB56rN
- TLSH T180156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 862KB
- SHA256 6628d432a67e1adf9aba8bbb261618b3f61b0b4af40b7cce4cc18c7b11b542f9
- MD5 35c90b830a478edd3c127f8e5a3e40f1
- SHA1 ab40aa423ab816aab88f35734b31da377568b2bd
- SHA512 a68b21548474e12092d43d5a0413cf1c06302e83429fd15994b746f70cb93ce4580af43f9ed026279721f466dc0475e4e8724a97031929b5d63262211d38aef3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWLb:A3k03kB56rc
- TLSH T14A156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 862KB
- SHA256 111ab6d307cc9b271266e618c5f2f6d790dbc66a801a048948cc459d6a2ab411
- MD5 4de5e33715199208f1a6e2faea7417bf
- SHA1 41e29f6911b71ae641aa4b28bbc6bf3020574d7c
- SHA512 c39b0b909e2c33bb0bcda650a7ba7e6dbad3182e0ae8b4e6c9565ca17ab7638431f6827c704da7b465b76d8ccae98ddeeec4d5efb08f877864e8d0b840233723
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWff:A3k03kB56rc
- TLSH T10F156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 862KB
- SHA256 cdf0ae18dc2723c9766c893fc1c3bc729518939da7e916595a47a450b02fa1d3
- MD5 6de3857621b354a4b073b52c58c47837
- SHA1 fbfbc06336901b4e5a31b58598abab774c3ad980
- SHA512 fae73e09978058e4729ee523b891939fb8029380bcffc1e244c1693348998b481bec9f71340217ab1de8797c17429bcc8820ae24524ae45b490125b80bf68b91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWIK:A3k03kB56rM
- TLSH T1A0156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 862KB
- SHA256 f5812c9ba9911ec4022336175f89b483e5673dd9cb9b8dc760f6ef8629647ec3
- MD5 42ae9723bd3c3dcc466c802fa77ddaab
- SHA1 17cc78ac663d728541ec20d5140342c7aae15ef7
- SHA512 b9270c31345c362fbc21f1983643b64979849da3f6ff30a9f5a605162180807e2c5e84baf934c4ab4bbbdd50a3aa4139d47763e616d9df4468fcf2e10aefa8a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYW1k:A3k03kB56rV
- TLSH T111156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 862KB
- SHA256 8a0291d33f95f9eea78ff88923aeb0356fb7efd295f0fb62e3b709b4eae8ae0f
- MD5 0b4735ec803a544d6fc16c6138c8f0cc
- SHA1 6dbbd4905583d986d45ac236427436ddeaa2ebe6
- SHA512 b2bca9e59ff16aee6bb8be30ac859fecb924442aa4ea88c9a1caac5c19e031b170d4234eaaf7052166a55f57e69e2e5594c618979ab8e0c71f7ccf76e7ce64d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWq0:A3k03kB56ro
- TLSH T193156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 862KB
- SHA256 726b40289ef4210b8a4c03060dd5cd0d6b7c5e2f0d487ff29fabca8c2c4f9700
- MD5 519c2cf3801f3e93efed6e941f28bc90
- SHA1 5f1a4735563b86f84c00f2e993ef534f131ce3e3
- SHA512 b329ef837331b46dbe3e89b090e9d594554c3ec1364e9d70a3fe1fc196ca7bf57e9d50579e094745250f9c1d0dd96435668376f0818f0e92a5cf2f04c65be344
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWZg:A3k03kB56rt
- TLSH T1B1156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 862KB
- SHA256 656d4262cd1d7c3a083c02992eb99d4187575f908163f4a340f6b06ddc698779
- MD5 4d8e38c68dfd8f8162fd1eb394598cba
- SHA1 5add20987ce6bec883a48838e49c20e9b27e61c5
- SHA512 28f24d3dac8a1597334f9bcf394c2654dcd11108789957c876dc04c83fc2649b67b9097350dd46e5ab26c8efb00c837e45da34522382e4de27eed5dae5365cc5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWAr:A3k03kB56rv
- TLSH T1A9156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 862KB
- SHA256 86ae1cecf98483e7571cb8630460c6c31d1122eb294d20b5355e0b4ef2012ffb
- MD5 25da3747357eac6d3a07b9928ee39bd0
- SHA1 10746d09c78ad69cf335a166a45dcd22fa3ddcb2
- SHA512 f5ae47f687c20c78b8fa4f3af044e3241f44cc68c0fb8bef8f071684733fa3421ad568bd7c26739470353a5b67e149a1174437a5e25f814669a4a6240d4c0d93
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYW+n:A3k03kB56rJ
- TLSH T1C6156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 862KB
- SHA256 9c5c2b4dee880eebbb7f6b6fcd5a59a87ffd9e1cb76c68f27a8f747a83d73938
- MD5 b6777dddff7623559a980de15c0a6146
- SHA1 cb9dec75eb0f481cf587b54feb0164cceade295f
- SHA512 0230365b06ff3f9e9625a66af10fd723c94bc5da078bec4e61a134b7b24e5965f5abbdc946fa8b33572d004d62920d450795cc4f5b29f0c6788454e5d10fb092
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWUx:A3k03kB56rH
- TLSH T19D156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 862KB
- SHA256 3da150fe1e879f1e0d7dc99f821dfd35fda5a0078cf87dbd6a15abad9717a788
- MD5 51f8797bb9081c8a7af896ca6c6bfd0a
- SHA1 f4b4a53a3c089db6f8771a7aedaa95985b6e642a
- SHA512 0835fa933d114ac0e59c20d5cdd03327cd06732600e57a566dc484df11eaaae629170a962916c9356788b573d22385ab100d45a0030aca65f08162e46288f5be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWeA:A3k03kB56rI
- TLSH T17D156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 862KB
- SHA256 f8a6842f6ff82a624b710618ea1ee4083e496817bd7d0594b47b0efec636a33e
- MD5 b71c53c647f24053cb7745026fede8e4
- SHA1 bc79fdeec9792e6fe38002f743c05477e0c102f7
- SHA512 00e2fdd7d9eae502798bf97d28fccd568bf6140a64e3799e3008b05b997a3df206ca876b9f478d3a5c7da2389df7e124a156d98b1e0673d90c16295b5ee2cab4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYW39Q:A3k03kB56rR
- TLSH T106156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 862KB
- SHA256 13c8ef53933ed2523b49e173511144e89ac10391d7259e64da6e428ad7bf2d21
- MD5 17c3b64edb73f51c742650f0059acdcc
- SHA1 4ae614834acd329c220aa2b90421cce9d7838714
- SHA512 7ca6edecb1c013d43f934e3dce11d3ca2275ed782b7a3db9147e00f943ab0e586880daf9bee0ce5c3c11274d0a67ae65d31792ec3dcb4d9a24c126545148a58e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWe4:A3k03kB56rW
- TLSH T1F5156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 862KB
- SHA256 08401d878f14266f5b8af20c558e30b748296806e8810e62b5c89ec5f2bea4c4
- MD5 7db130dd90b2c3d490d7ea3ff252808c
- SHA1 c3bfe9070a5ccb14a62b8d3ad398021604f268ce
- SHA512 749a3f10b7dd5ea06d9e2f7582a01de09562ae8b5a1995eeb3126135f28ea340008540fcb4db79584af6a171cfa9a3387c52264cbfedffd74ba786ff56849d1b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWdu:A3k03kB56rn
- TLSH T133156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 862KB
- SHA256 eb444803bbbab75f54f2104176a1bbae03970872e2155e67c58314e40ffbd30f
- MD5 48e63fe27f49be9f660d7ef00874df5e
- SHA1 4f013d522e6a1e814fc96032622223ef6684a87a
- SHA512 c4fa99906b12662e575091e0d5adb3eca865be04ff14ef98b4a90ebab6a7eb3c8c10923064fd2d8df31108fb2e2f9c520e6c061fd1d0dc74929c76a6ae785aa8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWwj:A3k03kB56rJ
- TLSH T151156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 862KB
- SHA256 41d2ca8d227b1df1358124322a642cd3eec696c4134d64a3f336c7c1dd6de836
- MD5 a4520edee65b968f5e2a3005f03eddda
- SHA1 719ba3c50c2f5ccca66a406b77dbae8b5e50e82c
- SHA512 43d1ddb821f83cb9605f0e087cfa1af385b2408f143af277e718749cbf33d82b46746d5a202e4a13b880154b6c254faafa2bd5d63bd682e8f7dabea613a758a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWBg:A3k03kB56rd
- TLSH T138156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 862KB
- SHA256 12c80665d2353ae294492d783dc3ca84e6c0f71efe5ab63bb9dcd2d78b49e69c
- MD5 5600883fd88d08702241190d0b33508c
- SHA1 d43988b4861271acdcbcb4bf401f5e1463765e0a
- SHA512 2e3862b42511e524f878d85bf55d9d05fd809a69e20f986b4452de70a7e9bc36293556b30a12ff8be01f44d9a1c7bb7126a1c044d7e4d7d3cb717276ad567117
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWYI:A3k03kB56r0
- TLSH T19A156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 862KB
- SHA256 635c3ccc95e0df959c04cb5f22156690035fd6e6ba3e26f86a0879e9ef1b4eee
- MD5 6159de080cd8a1d9f586367930366b54
- SHA1 986d59ef1a2591c76d194407ce8463b8572e02ca
- SHA512 6c31b91992aa0264eeebd0ee32aa84b12e5f5d0e76c3a199f59dce65e047bc29262570de827287af5e2865387ef31fd16f726240fb96e60a7ddad026baac269a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYW6o:A3k03kB56rm
- TLSH T146156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 862KB
- SHA256 3e5199263a0e22ab207068ef88eb80e7b5808591616d8b7a1e574c72a81ccea4
- MD5 9f3a2b0a8da05ecd3a84fade444e3473
- SHA1 e0b9f9a04f657ed501c699ea29d03145d0e6ce83
- SHA512 79de30516f5b738e68e8405a31c732697cb49e76e742561b374cf8fe4f555e6a9a6c8d53ea84b66b3329858d592818ca3e9946d163d039a945c030beb452d864
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWR+:A3k03kB56rz
- TLSH T1F8156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 862KB
- SHA256 939de868fa665a44a8cc13f168a14c281edd0dd322a9efeaeb60ee1c3a2db3e7
- MD5 a3f3e60ce02b652e54e8357d53ccb71b
- SHA1 10ec50df6b22c30e106c14fdc9ed117a8ccb88a9
- SHA512 2436f00a5bff192f13022ca15ac6410b6f38089f8e113f96c83f0e2d3ca2cf20026fe913d8441c1a07e88d2c768a630a4db3f3a1529f34974a14a712e204974a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWfQ:A3k03kB56rH
- TLSH T159156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 862KB
- SHA256 c298ce061e5a6dd9637003bdc1bc84ca8d44a61b4adbdfd8af6783cc81c9acfc
- MD5 0a7a3676389cdc02fedb7583c84c2bd6
- SHA1 7312d59f796f967319eed05bfcd1468288b878e4
- SHA512 4227fdec8c3c73f4047af7a184472cf5ae954a5b53bc84da7801d3a1dca0c429d47b839954e94996e8d738a5fd15b86b6ed1f12915c08c89d9a62ad64a2ff42b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWkX:A3k03kB56rb
- TLSH T11C156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 862KB
- SHA256 e414a1ff8ba7fea07275d30c9cf4204027a8812d0c4dfe3c5304b785afc92767
- MD5 1043d99053debe8dc06920fa6555538a
- SHA1 57fb3a8b40777732cd54fc79825e240a67fc76b5
- SHA512 e69c6139957cce823e7d10e6d545c7a297f03608066199ff015005fe50683e20f6d8fae2d87664b349676648fe94ee2d369df7b816aa55b789266f71cdb0d7dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWiL:A3k03kB56rV
- TLSH T169156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 862KB
- SHA256 bb2d01aad2868027744c1c2d53a9d8c5d315644f074d42056792ae7e71bf42e3
- MD5 dc7ac33a80998bb1b45af9cc77e1204d
- SHA1 73971a34c66a1da699e9ebcef00978b595734938
- SHA512 af12f07d076f72aa8192f2ec98acd8beb19a277c20200d4ab5b7570a8d666f7e5b0d70b137fabe92b1352dc610b546ffaf8e072b39f8887aa235e3fd02fada42
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWGM:A3k03kB56rs
- TLSH T12B156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 862KB
- SHA256 2af6b5d77ae6d45e1f64967f94fde630cc71f2a8a36c251fbd62e0767f4ac45e
- MD5 200edbba7787ef9a2ac8ffdc1bbeec05
- SHA1 020fe841a54cf9f9f566afcf0d9b05e52f171ffd
- SHA512 353c5a0e8f5621343b966e34779dc3beabd2940cc28b775a4f0d9abb2e907c57c3e5f74da543cba94f2eb61a34ccaf253fc6cdcf0dba9c36ee536afd7a4d4d05
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTWYWvh:A3k03kB56rm
- TLSH T148156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH