Analysis
- max time kernel
110s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 12:18
Behavioral task
behavioral1
Sample
2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 924KB
- Sample260822-pgzk3sfa27
- SHA256 aa3ca44a2ed68bb604670e67c17b49b6575a661dc01ecab3dc495d97a711c3a0
- MD5 784e92fb9d89334a857c3eadcd0f2580
- SHA1 72fc8eb9be2a9569b1cb649c9c91d4cfd21f7610
- SHA512 ae2fb5371d7827efcbc8c22d033f80679b0c3381c3b2d3918308a9500902a4f9477120369cab598e5f7656acaa5ccec08c149fd527ac3fdb0d454136cb0887cb
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70u:A3IqJtb2Iu56rs
- TLSH T1BE151925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/3184-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c585-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3184-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4948-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8a-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-659.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1214.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1400.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c585-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8a-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-244.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-264.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-445.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-579.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-659.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1010.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1053.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1096.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1139.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1183.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1214.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1323.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1376.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1383.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1400.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4948 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe - Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3184 2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe 4948 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_784e92fb9d89334a857c3eadcd0f2580_amadey_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3184
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 aa3ca44a2ed68bb604670e67c17b49b6575a661dc01ecab3dc495d97a711c3a0
- MD5 784e92fb9d89334a857c3eadcd0f2580
- SHA1 72fc8eb9be2a9569b1cb649c9c91d4cfd21f7610
- SHA512 ae2fb5371d7827efcbc8c22d033f80679b0c3381c3b2d3918308a9500902a4f9477120369cab598e5f7656acaa5ccec08c149fd527ac3fdb0d454136cb0887cb
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70u:A3IqJtb2Iu56rs
- TLSH T1BE151925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 0ed780e7df191573d869f699a22fe8e923ae85a85ef83da0ad8fa84fcad37272
- MD5 9f34e867a7fa04f10304cd49e8759daa
- SHA1 f15cd6f2d6162f85b33c8dcaa58516d0509bae38
- SHA512 ac0c3f1c989ebd6783e30be209778be029c8800af3916bcfabf4d7d82e7d45f005bdcdb259c810a9570e9775bb638cd3d1a017b590b46bd23bf16db2067ccd94
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70e0Le5ji0hmxNrM:A3IqJtb2Iu56r0Pji0Aj
- TLSH T1BC651915F6648B75D07BC0B9C5D2969AEA333C425F308BCB0285DB6C3E276D6853A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 939KB
- SHA256 5c49596c957ae1950971f7c68b03e240df172b5d763e6c25fd725d16df0f36f3
- MD5 77f9cf79caffbddee32cb09d831364bc
- SHA1 08af41a75f144ca5b3c29a28f4a47bf2aecc23a9
- SHA512 c75dcaacf49900ab7e12b61d959f663a40c750f13d2f1f87c9d8b7c6609589bd824c4bafdbee075076865681e31862328697a7687d78eb021b7d0a889a3949f4
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Ya:A3IqJtb2Iu56r
- TLSH T12B151925F6688F61D07FC075C5D2969AEA333C425F308BCB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 972KB
- SHA256 a1083ba4768016f168cabde03765fab777d78c9af82704c9de7c6152d37d81a7
- MD5 c409715aafb264e15a4280259b317b97
- SHA1 96d2df7f4fd8bd9f3cd9a6fb43ff1dcc8a326e35
- SHA512 747f22ad05619e5a44614b588c4eeb392819ae30b52f4bb7ef354f0d88c2bc9854a28accb18ddd3a01526015a202083fb2dc5d878383902386f1b30d1282f331
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Tb:A3IqJtb2Iu56rdb
- TLSH T14E251815F6688F65D07FC075C5D2969AEA333C425F308BCB1285AE283E376D1993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 948KB
- SHA256 7e7052f3d6dd926284335d40cfd9420f3aed7922349214d5180c570aa38d81b6
- MD5 af28ca5b0c77b638a5fd7a835ca69ca1
- SHA1 1a73c8f74d1bc072c0ec689d66889a1f464219de
- SHA512 e8dc421a42fd6ed97837aed3a6baae222cb54005ab5ea7cc595e294dd5e8d3f9f315559e7adf651c68cc8250cdcf4c0f4e9c69bf92838e9f72cd91924b4a33cb
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70x6:A3IqJtb2Iu56ri
- TLSH T14E251825F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 948KB
- SHA256 82e3474d78c90d295013852ac88c1030968737975a3c3892458d6cc417d0b131
- MD5 d5cd39ef0809e9fae80cf2d6f07b3b96
- SHA1 36982575100d5b9258df2914fdd9830c9a596b71
- SHA512 302e07476e752518f4bff721f21a657be5adfd697703573de11e641811eff4e4382d05675cebd66fbc72ea0c219a509c5cc848d6f544fc36b8dcf7fc9ab6ced3
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70bu:A3IqJtb2Iu56rQ
- TLSH T173251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 948KB
- SHA256 dffccfb7e2a843e86c8b113419d6dcfa78d99f856f242962c31ba7d5dbc9cbde
- MD5 770c7b646a88cdfaa993248cb8f22091
- SHA1 037250493af96c28c5814d4103309fea271a649b
- SHA512 85b482a78679c53ee800f214f5dffe76c88c8db7e5088496b03517a3dbe43fa2a2f50af981d2a4224abb6a688e659f3f949728eb29117feb1de137beec760158
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70J9:A3IqJtb2Iu56rl
- TLSH T125251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 948KB
- SHA256 832bf1944eacc7a20ad44dd8872b377a83beb223470d6d1981e3bafc6a539e22
- MD5 08ac123217272a8714bc8d729bb11182
- SHA1 ae3b9ed1cdcf5e9ea16b5180376532bf9781f115
- SHA512 c068b4a537487b9b4021ee4f347c4d949e2e73e271a5f39006e3a22c719dc35bab304531962472aedc9809dac2e3dd8f1dadc13422f3b07821d05d01126a7697
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70lc:A3IqJtb2Iu56rg
- TLSH T1B7251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 948KB
- SHA256 5f26c6e10f3ea4384a7fdc809754948745cb846fec338aebbe75d59ff0f9bc3b
- MD5 89bfaee6baa0ebd6cf819630008e7f29
- SHA1 76c806126ceef9c72c8c66f789b4ae7cc8304092
- SHA512 86fa5a14f5db962c216214c8c69552e16920e72242027a114b5bfd8f5d9935b956ecaa0962b0045f66fb3f35e98b3e4fda407578be239fdeb1babe0b28572bb1
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70ep:A3IqJtb2Iu56r2
- TLSH T1F2251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 948KB
- SHA256 07cc28215b0935811d188bee0380133b67b94d0fc8735f1383f3d7611552eb47
- MD5 09f3429109890d576d7f3c30dae97197
- SHA1 128afeed976ab3c753756ae1410641b69ceb04d6
- SHA512 fd2bc3c06cafdc9bc9f34222299e8f9c8c3534787921d01d3c5851d79430b4484f5ecfc320695437da052d0c834021f3b20d34890c77944568d6a5ae3222490a
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70RN:A3IqJtb2Iu56r5
- TLSH T134251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 948KB
- SHA256 a5da1d3de00284be162f8868e56eb602d58e3ab8576e55e4daa1f91f02e57d26
- MD5 ac6fb0403020912a1ea0e05416bd74a1
- SHA1 8148c25c2ff984bd96ac0d763f39ba6048728133
- SHA512 5228f8e0de4001da1d0f85826c983be7b7d9b36831f2239c7e8bcaad4084377df4985997979dcad3e5bbd894c83141d90d11912e6ba4ac8c8112f38da133980d
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70zF:A3IqJtb2Iu56rr
- TLSH T196251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 948KB
- SHA256 9358e60d35b3ea798e90df2707fddbb94878d15ce8af81fbbaafff861879d888
- MD5 60fae61f623d81d4f023243c981f2f58
- SHA1 82f75d34baf14d6895e06e216c680ff6892593a6
- SHA512 30c2122afde2c17dc6f29549515ff15ae012e9af6dc2541c8c3a50cf536aa107ad706a4a0b4489ea6541e350fc673f353b27dac30de3838ea2fe83b85c79e4ef
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70cC:A3IqJtb2Iu56rH
- TLSH T1F4251825F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 948KB
- SHA256 8881a507acede308664dcea05c26ad3b81e3d16315a4c044a8ea469d36918473
- MD5 afc533beeda2dbf4a104fddb16736cb5
- SHA1 e43277129de16b7df6941f652584bb45dde42d65
- SHA512 4efd9ecb12f67eafc21b5e2d30de62ef810a1a49c79e1b947a89b6f959c20e08bd27a39904f5603b6d1f55d8150eadbc997e8096dcd515621a7c8facebd73d36
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm703w:A3IqJtb2Iu56ri
- TLSH T17E251925F6688F61D07FC075C5D2969AEA333C425F3087CB1285AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 948KB
- SHA256 8bd9880a2364ef4faed63c0f0677700b4e9e0bc66ba7c12ec80f5fcd2c8343e9
- MD5 31e11455d18ee83b533521955cc1dee7
- SHA1 a0930687e8947aa0c53e1cb005283bf726dd21bf
- SHA512 cb03987fbaa6e22a92c620b2876c83c7ec4343086d1701560e5a688a6696033ccc41f80b9b4b4588ad3c99266463ecf7814ee6ac83b78d15ce28f795f2d2355d
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70mT:A3IqJtb2Iu56rS
- TLSH T19B251825F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 948KB
- SHA256 d1928a7e867f9f062f7c4bdbe63406079b0929f777490a36a6313b0605247a69
- MD5 432b5ad04eec8d519149ca469f19d833
- SHA1 7e6cbdaf156a39ff2f54773dca629b4361429cb6
- SHA512 c04f4f37f5617889e69cd04c12eded988da4ef583397a65cff785da95b03d06ea938c9e8137c3b1081c371783e8738c9209ab206b9a4f33af6e5594190a26e8a
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70eu:A3IqJtb2Iu56rd
- TLSH T1EE251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 948KB
- SHA256 883cca2d3a40df72e30b87c42bb605cbfe0a900d538f79dcb1d2c66d82e7fe3b
- MD5 3131fa7e7190634ed8fb27f642c4e9ea
- SHA1 9ccbcf7955e0eca9f6ee9b1787ec8cf8daaaebef
- SHA512 ff34018e279ebe95eb9298967ba21db36fda68e15f6f489526c7e70e6340e4e6fa33c9e1542304ceced5eefd682d22114743574e4af1cea211a4935298278326
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Yb:A3IqJtb2Iu56rs
- TLSH T1C2251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 948KB
- SHA256 b648cfe661c026d4192ff46efc62ed4cea479019ef12f2b25e0a0f59949d86da
- MD5 fc882fa01bcbbd476520f93fb8ab8bd8
- SHA1 bda2dde130d6aa9b1d1ca69482c4c5a843f23df8
- SHA512 8efd708b4f07b8f1bc368f2fd91dc1b35545d4522a921aab52a9343a2be73e336efc873bf852c112020258c4394746ac2c565596a24b19342e58be9c2ac5db3d
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Gf:A3IqJtb2Iu56rs
- TLSH T16C251825F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 948KB
- SHA256 191424a3be5f97947002692a5b750c7d4f95d04484324e65ab379432ace34299
- MD5 deea9435ff563fb1864ad01114e64da9
- SHA1 6387ef3cb548a1ea3533d8eb669a5e200ece6d07
- SHA512 ffe01b2eaf87591374392ea9ac7a7d1ab957ece4b031ed4d6a57750b89c0dd9d2d5f426697a5d19017d5dafab69e5d578d104fb2a08f75e24099cf4428c09b9f
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70DK:A3IqJtb2Iu56rc
- TLSH T18C251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 948KB
- SHA256 6d3cbfe52638f5e1c8a4aa165b64b62d9021d46ecea42a7504e56eed75fb00ba
- MD5 9dd0345777f62e7a7cbc19a0f63cb74c
- SHA1 a875245885a2596180006a3afba8934f15f95738
- SHA512 0ca2d7de56cfa49254fb85592194d59051bee7a7e9ed243780fb74710ffd3933416e45816ea60e6754f8e9e232a49c8e511fd659d0afe49aee4738eec12e2231
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70kk:A3IqJtb2Iu56rl
- TLSH T1FA251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 948KB
- SHA256 948ef2bde86122a7f55f84a07ae4445f071865909b01d41cc08cad78f8ab3453
- MD5 ff7322a6893e4d3c222da6c8d5098cd8
- SHA1 a1f8b1be74b774ce3791784d2239fc707776588a
- SHA512 ebec671fc82ceff1edb9a975607c97418ddc359487afac28038f41d8cbee1be95c40eb08eb1f2724b4e8e97523789ce727345e867315dd01f9f9dcce31ac58a2
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70t0:A3IqJtb2Iu56rY
- TLSH T1AF251825F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 948KB
- SHA256 28bc7176d67dc6c41df6000f1a08e365660f588613639dcfb5315b36bd1de87a
- MD5 2e1744f66cbe438eeeded91359671f16
- SHA1 84131e75bb39246b75d433d074dae26868a923f3
- SHA512 d92496ae79a21d06a65573b8032e3742f806dcaac0820602dd1a2fb516769d2039b45206f5e810375fa76631a4c0acb5189296aa3d38efb3ec9b5112f1a45b4e
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70wg:A3IqJtb2Iu56r9
- TLSH T13D251825F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 948KB
- SHA256 92aa64b854fb13c93b321f270a7b404002631cabf686ea3faf6a1a02779c6c0b
- MD5 cf25caa12a6835d67bf3faa618b53548
- SHA1 50caf222125e25a30ddd3be5ebf4e86c906eaa85
- SHA512 0a0604079b1338b1c58350350339702178547f7787f0f1f47e8e99a4143e9a210bc907725a37bfcd01437d16e3faac0d7a2ea360afcc982e993d3bc87fad1ded
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Fr:A3IqJtb2Iu56r/
- TLSH T19D251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 948KB
- SHA256 382596a240c76c5da1f36a1a52ea1382479314c60dca20e8fbbe363481d06fc4
- MD5 19c2e15f1c2a8800ea005def8aa38c04
- SHA1 ce5e31776ca2df8a467b744f1c85e29562ed768e
- SHA512 94f33e9dc9bd22fbabdb6d9ea965f6a7449bbf57f7860a50f997dc426075064b7b7b25ecddb91adc398e90f69a63da17c4256c2d0fec9db73387d7750d63d123
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Pn:A3IqJtb2Iu56r5
- TLSH T10B251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 948KB
- SHA256 7c691be63998969720f4863167f380e3404e4ba341f9d634397b04d284b736b4
- MD5 00b1925a86637f759516aa2a5e04db10
- SHA1 3ce183fcf9e0ca731604e3eafc4bed0e48b128e7
- SHA512 ad8e7851b08aa64439dbfea32551e4984fce72c7b94eb0b572619c18971d259d42616b5b98e96257be91c6a30e69de32fd85aa39d1f539dd087a022d6e27266b
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm707x:A3IqJtb2Iu56rX
- TLSH T154251925F6688F61D07FC075C5D2969AEA333C425F3087CB1285AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 948KB
- SHA256 891eb211dbcb4baa1ed1835ebeaa26625ceabb02c40c5830434057cb4ec33df8
- MD5 fe502f6ac220363426f76700d47e6acd
- SHA1 e787ec09cddedb5a2e7c17bb8acca9c6aa052447
- SHA512 10097b4b153387f4df08bc2cfd6b1ef69bc52262715127bd87a0bf633b64c59d7c997cf0c606e1e7c849d161d6014bb13868907c179011fbce51ec2900a15bdc
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70pA:A3IqJtb2Iu56rY
- TLSH T1A3251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 948KB
- SHA256 74491156e71de7d5e717614ce96da80fc063fb3f75cb11511ca7f51138d0a98e
- MD5 7730185864cf117d0e4c27469669f0a6
- SHA1 fe3d37d145353315b6f36d8866a306bb3be6c452
- SHA512 2fb7ef23f0357e2454bf3d74aabc0ef8aba373f14d097a56cdba4908c3defac854873f5d6647cdd33be926b5868211688c1af83ea04377e040eebdb4dccb53ff
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70i9Q:A3IqJtb2Iu56rB
- TLSH T1CC251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 948KB
- SHA256 15403c6405016885cb65fcd547dd110f6b1111cdb11eae392d6b116e85462b4a
- MD5 90c09df568559a6e1c149c67bb218dd9
- SHA1 f4da68097761023a38dfa8c5e2b3f1e6dfacd2a9
- SHA512 05c6b0becf41d942c925ff5a1df44b17eafa21d8a582357ee89f984ffd8abfe6d5e6f5633c52114b7ef2fddecac01f4ad513c60399802b4ff354c919554ae5f3
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70H4:A3IqJtb2Iu56rm
- TLSH T1CE251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 948KB
- SHA256 8ecc9c415c71806e6ee5227c3ba744a5e03b67fe8b3fbbc3c6409f83060857af
- MD5 ec01b29339ef3dca9d92b4be8b1bd0fc
- SHA1 f7a6c72e7f03b3ebfd33f6605b5ffd1f70f43c4e
- SHA512 e7a2ce35a6887b29ee8d5b26374a746ea5413cef28be033c717c762f589ac7526b5c3f39553d4fb04109731a8ff4080a301ec410539dcdc225298cc060094b51
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70mu:A3IqJtb2Iu56r3
- TLSH T146251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 948KB
- SHA256 0b2357a6eb7af743713325019db6459396f55ccb59e6a57fef51be4c8415a71b
- MD5 438c706df2cab838a416d1e699f490c5
- SHA1 df3123025cec299c274a7fee7667bb437f408a0e
- SHA512 43d2f13212f215acafeb8cb77e31b9fe1dc8a3b40d78db853e54cc8eba35d878df4ca6444088eff01482fd2929388707e45f963cfd3fbefd328d85fdc87a638b
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Xj:A3IqJtb2Iu56r5
- TLSH T1C1251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 948KB
- SHA256 e3042d66e0a7f4a85f2845c4b9a18ac729d0bc8c37922fd82fe4fe47f82322e1
- MD5 bd3a7b6afc3eaa183e39260cd33fe4f6
- SHA1 5bee3eecef39a41fdea1bd012ba50ceed93d8222
- SHA512 b14d6dc9b9dd9f888719660bf5628f274eff2b30fe8142755c367c81f5ed648cd1d7573e6e9b9568a23a333ef713d842060ea15a520851cc0e19cad6e6c5222c
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70Cg:A3IqJtb2Iu56rN
- TLSH T1C0251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 948KB
- SHA256 888e2dd24f24c712ba69b37e9385f4fbf751921576dfe978048455cacf575ab2
- MD5 1c5448f6a8b5bb5d5598c8743c7fd299
- SHA1 7f1f17158bd1dcf8fd2772c0dd4003ae53fdc052
- SHA512 9c6b70f4773d146a4848dac8270052e6b1757264285c5462c200cb8e8f7749ce061b0ab3278576767808448b9f21f00411d66d4ebe4f575c24a3add562731930
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm709I:A3IqJtb2Iu56rE
- TLSH T195251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 948KB
- SHA256 17c2d2125b3845269a15190c09a446082c97104e2b162e41284ce59f1edad328
- MD5 898f6546bfa435edfce7bced875e57c5
- SHA1 31e928830f4641a37da67d101329da5a2b0a6ce0
- SHA512 b8d02d305216bac1ae5a85ec2d2926dd9afbcfade3794c6c02bf6647dcb867ab3ec14b5348b672542268fbfd59091c9b7b62332e2b03465294c250b455e3d940
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70vo:A3IqJtb2Iu56r2
- TLSH T16D251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 948KB
- SHA256 daf0a50ad7921f590560f6d48e0e4135e7452bc3e2eae344c8ce761677c9446d
- MD5 2318f339a65baaed5388e8e97f72a8b7
- SHA1 94baf1b009e63050f7c7f523d77fefd92645148e
- SHA512 201507ce855d9119d9bf10cf2eceb9999f7cbc702751690cabb3907920fee836d21bf0da7b781ffac4772c63282748444144c2ab19f1e942fc7cfb986ca221d4
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm700+:A3IqJtb2Iu56rj
- TLSH T170251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 948KB
- SHA256 a391e0e887a0bbe896ad625428847d4f718a35014b11e3c4d476bed4476bfd43
- MD5 738c1ce33000718d57a2d7f58a0e735b
- SHA1 12d3ec2f50643dcce437e132f960b2efe486803d
- SHA512 80f79021b8db46774973cbcd55c1807f6784e91db3127f5243d737beb72c4bf082cc010f180b5f3bef74b3b09c19c7b42d9d364d5960979d250229c38e7123dd
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm708Q:A3IqJtb2Iu56r3
- TLSH T191251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 948KB
- SHA256 e180227eda319102a36161135ac5f7690e38ff7f91ae5925faf8bae0b5913906
- MD5 de93daea21ac8365c66bee2f4673e35d
- SHA1 8da2aba561d3234dfac8c311c661ba7c3ef55cf8
- SHA512 1ab894e52c757f2dfaf5ea5121945d1de1500365c45303412aa557f6f5ff30428c7cb9803052c310a84390131a02a9ec3916ccc46b9b355ecdde5187a4cfe699
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70lX:A3IqJtb2Iu56rr
- TLSH T14A251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 948KB
- SHA256 2b4c4df9770957d8d09be3b5819e3a29e34a5556cfbb42b8932418d6e91473cb
- MD5 06eb4a40e62df7c7b9e98964c105e00c
- SHA1 ccc9158d5d53f4804fa6c982923ddc2ef95d1799
- SHA512 91450a82e898da0c6aa40a011e6ca0b3de3a8223eec6ab3ab55c90b04f8baf1697945295ac6c7b3bc9043379b1593adb373f2e16b64fc3091a72eeea17f53c8f
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70HL:A3IqJtb2Iu56rl
- TLSH T161251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 948KB
- SHA256 f5611c9532e51fc41b367002a4c2beb5821adc11b1020a675f841e213c1a5113
- MD5 6b6b66cd77108d21839e9d5eb44a8879
- SHA1 428632dad43ac5a6ae17f6b26c3dec8087ee9c4c
- SHA512 b51a823218119ae22099527a4feb990f9089df9de353b64b6db88eb516de26a00eb88dc9c8deff86ae6db56ef544b82989e6e1088610ee38227131fcf72f98e6
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm709M:A3IqJtb2Iu56rc
- TLSH T149251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 948KB
- SHA256 804b296d98118aeff24c4f3d0d16c5c9bf2026878b28429b9edd16c0bff5ff36
- MD5 94d5f36584fc43e322a79c95f8fd5a27
- SHA1 27155a210423449226a9d8d473321c8cc7e909ad
- SHA512 2f182b6d9949c495bc870a87cf544172012b1e7fc3ba206b01490743d0b50f009cefcec1675ec716606a4e5e3aa61e992cebacd45273d4a18deb6160833765d7
- SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5Tvinrm70uh:A3IqJtb2Iu56rW
- TLSH T1E1251925F6688F61D07FC079C5D2969AEA333C425F3087CB1245AE283E376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH