Analysis
- max time kernel
111s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 02:09
Behavioral task
behavioral1
Sample
2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 942KB
- Sample260827-ck71eayeqe
- SHA256 305c574ed1ba600c731dca5201611080796cb7fd2dd2c1ff16961fb9c0958a75
- MD5 f5e12d20651ba3b9bfe64db145878d5f
- SHA1 9c11023e899d4903f5208bf8787c124f95b1f171
- SHA512 6b335f33270c8a7c27bc5031ad3adc551613aff9026603ba5a4e7dd408216d598b70df3559650c78301cc60d1b4072953b4f258ec046ca0811b2415ef51b2a19
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmC:t/sCv7rTiw24xKJzD5TvinrmC
- TLSH T17025071766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/4556-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f00000001c4f7-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4556-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4176-34-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018985-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018987-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a65-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-282.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-301.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-416.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-483.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-643.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-734.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-754.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-805.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-867.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-944.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-963.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1056.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1075.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1107.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1138.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1196.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1355.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000f00000001c4f7-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x0004000000018985-201.dat aspack_v212_v242 behavioral2/files/0x0004000000018987-208.dat aspack_v212_v242 behavioral2/files/0x0013000000018a65-227.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-247.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-260.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-282.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-301.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-416.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-483.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-599.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-643.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-734.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-754.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-805.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-867.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-944.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-963.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1018.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1056.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1075.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1107.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1138.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1151.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1182.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1189.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1196.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1257.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1336.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1355.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4176 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Windows directory 24 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4556 2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe 4176 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f5e12d20651ba3b9bfe64db145878d5f_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4556
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4176
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 942KB
- SHA256 305c574ed1ba600c731dca5201611080796cb7fd2dd2c1ff16961fb9c0958a75
- MD5 f5e12d20651ba3b9bfe64db145878d5f
- SHA1 9c11023e899d4903f5208bf8787c124f95b1f171
- SHA512 6b335f33270c8a7c27bc5031ad3adc551613aff9026603ba5a4e7dd408216d598b70df3559650c78301cc60d1b4072953b4f258ec046ca0811b2415ef51b2a19
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmC:t/sCv7rTiw24xKJzD5TvinrmC
- TLSH T17025071766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 8d3b35c58d19f75702b41df999b91694d1fcc0341bf8d2165dc52915f40d4a03
- MD5 6712e177fb0f36b26c7514d52eccec6a
- SHA1 7664d3147ed5e0c4ecfc04d996b6855369b4c96b
- SHA512 28a5046d09b4759b354f02045e1860686fe761b3988315062fe9a225702e4487f22fb06d3fb36c48f95c9061b6d1e69720b7d845151011f981ebb6d2641695aa
- SSDEEP 24576:t/sCv7rTiw24xKJzD5TvinrmC0Le5ji0hmxNrM:x7iw2HR56rTPji0Aj
- TLSH T175651916B6A84B60D07B9174C5E58656EA73BC451F3087CF02A49F2C3E37BE1A939723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 966KB
- SHA256 e98c1df192e6cbb3c5bc7014833d89bcad59958e6d742e2ca10a311494c97896
- MD5 745db46db9a6813a0f32a5e28e350acf
- SHA1 8a9573bf9b0d0a90bcf0bf29681f6e391fe95c2c
- SHA512 f3ae679dc64bcdb2f095b33b067a04261b3f92b2fcfc7b827312aac26022c014b8c60319eb7ca071dc3780e0b2327c03ab791961a1d870cf3d073d8a4f5a252d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmGZ:t/sCv7rTiw24xKJzD5TvinrmGZ
- TLSH T1B025081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 966KB
- SHA256 ba8959e0aa159b36b00970b0434bd6563145cd1fafb7f5008bd66bb02a5d2b3a
- MD5 a508868fef1c161fb410bb1e4154c33a
- SHA1 026555d0cd652cf23157fef0132cf5c90646b8bb
- SHA512 a23609d9f58aeef4d49b51c0d452bcb4a2da730f9f55475decc98746a70904fa6d887314794ecfb2d97bb588c7b84d14cedd21422dac0083c9b23d8c554d31ed
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmx1:t/sCv7rTiw24xKJzD5Tvinrmx1
- TLSH T15825081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 966KB
- SHA256 722cfd5b50262c8d1a92ae8134a3ecef4280674024c3ebcad6c2c7c6c94007ed
- MD5 06060d279f3a47e430cb8d65622ac4cc
- SHA1 5105e122856a8bd522861190dfcd1cb2dd5a49aa
- SHA512 e121f8e0c802265c0d1eeab315de1ccddff4b4809ce4bbfa0c670670f715a9b09c918b45cbbd8f1e5be0761e321e569b85d85d8e7037824a7520b839cdb20a0b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrml6:t/sCv7rTiw24xKJzD5Tvinrml6
- TLSH T1E625071766E84E54E47FA13089A54615EA73BC551F3087CF12689F293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 966KB
- SHA256 1b2055ada3691ef321e17701d8f6f9020291d4077f12227958dde63bb4c4be46
- MD5 5f9926d2b72166d083f73962f4511cd3
- SHA1 bce00b388d346beae050285acd800f93c1239b35
- SHA512 2edf8a68a97d56ca718621c332da191a0af79c14cb805bfdbe0fa8529dc0c2928226e0356f4e8f454d87ac172149faa65f92c55c954041aac79f35a005fd34de
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm7N:t/sCv7rTiw24xKJzD5Tvinrm7N
- TLSH T19325081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 966KB
- SHA256 37a7bec9569ad20c1d0899d4c8a3bdbb0f7c395eb23a821805ce1b8344e93d4f
- MD5 cedf3b656d4983e751805fe7407218f0
- SHA1 e2aa147e658098a149020e3d00c95b96264f5c36
- SHA512 b216a49598c1a346ab76524ece6c80712cfc8d44a2a889bacc7ae269d86c7eee68d0b22130be062f7fe82905a24aa954b93c661f017f371b3a9ee38ca2fff495
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmZf:t/sCv7rTiw24xKJzD5TvinrmZf
- TLSH T1D725071766E84E54E47FA13089A54615EA73BC551F3087CF12689F293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 966KB
- SHA256 080b146e6bb54c920e229287c0c3a906315c283f613673a38ec6b01e65fdd330
- MD5 7cc101a0a18c58094f473f3ac90888aa
- SHA1 a873da361447fc27dd5ef655b7c205434eb4ffeb
- SHA512 147c082d2b8efd629d5c54ef61f12b07fe41fcb37695b248cb4c75b9afaca33b95791a0f9ae51799b28e20cc4aef249406213d1cb966475086f1999be493819e
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmbo:t/sCv7rTiw24xKJzD5Tvinrmbo
- TLSH T13925081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 966KB
- SHA256 a3127a3f3f3857daa5c6df542125432a85ce6472814ad7b8635378476bcfcc90
- MD5 57a03d580543412b38ed5534a063fe49
- SHA1 97697b4aa250f49569fa6af7db597d2f9b0fba42
- SHA512 760642c45eb6433de532c06f70151eb408a999901d61efafdca39ea950c8f6d75889a1344c888a705d04bc9e59ffa0024980cd9403a8385f66002b61a98b0111
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmPu:t/sCv7rTiw24xKJzD5TvinrmPu
- TLSH T14525081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 966KB
- SHA256 2a08741caceb42bd122687cf0187f9fbf994b29eaee8126ea60687a75f505059
- MD5 a98d4110cba1a598689b36bdf5d10b5b
- SHA1 62286180f04e2675de628918a0c9c32af4f122ef
- SHA512 547ac7db5dbe8a4257ef7e46b2750ae8a5a00d8d767e9b2c1efb21d32590e541012a6fe9fd3182ced76dddfbedcd199a9e275ef0b4ad19582e186b838ec9af84
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmd9:t/sCv7rTiw24xKJzD5Tvinrmd9
- TLSH T13825081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 966KB
- SHA256 ce189b301d1892cc64fb008ffbb4cef3919c296eb57905bf27f0f62a5dea444b
- MD5 c5d7daab20635ecebb38e8f909e52381
- SHA1 046a1ebb2783493d84b99af21b646ab85f1cd72b
- SHA512 ac5afc4a29410a66530352268c8e90c7171093fa2ab1c8549fa3c4fa97ae8cdbeeee20b224fc0040d926fc1812e8b07c1febd97a38fd97f51c048eebd505924e
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm5c:t/sCv7rTiw24xKJzD5Tvinrm5c
- TLSH T13125081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 966KB
- SHA256 805cea7abb8e8a7289c81d1114c9b8ba80a92c75520f981df46553cae8058686
- MD5 05ca430d54b869fec16c6621de9d744e
- SHA1 049f28384cda5c1e62555796e760112d1e6c1ffa
- SHA512 b3af76ec0e64b3400a28d88e75c855655506cf7ddb2814cb9a81a914bae7800e61bd04320140cd843c126c69938dac111963cb2e6774532759833e9e2cf80752
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmyp:t/sCv7rTiw24xKJzD5Tvinrmyp
- TLSH T1D325081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 966KB
- SHA256 c35f220a6d561cf6eb18e5549163837c9fe85ecc8dba68fd628ef094a4c7af3c
- MD5 5a3726d6c71e43bbefb4ca02f1e43e33
- SHA1 04665b0f2b313f91cbcc8ec21794d60dbc4c3149
- SHA512 39f1426e763b5c048ee40e4aaac912fdec03c007a2b6446382781e29271eea328e38bc32320182bcf11822f31a6a64d78165c4f81945f3a3fd35c29c2b782505
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmF0a:t/sCv7rTiw24xKJzD5TvinrmFN
- TLSH T11625081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 966KB
- SHA256 8a5215ecc7a789abdf374e03c46946433f173c174a4f42998ee0bcf7204537f0
- MD5 a1f918725b66083dfd0df82d50d26e19
- SHA1 57d7758ffa31189935dc340dcb83bbea9c42d187
- SHA512 818fcd4fac949e0b310e2dac437f9f34e6c5a2d3c908b6e73474981ded943499203d92ce6e081faaaea61528cb360565411564773cfe03b8ca61e9250b1ae315
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmXF:t/sCv7rTiw24xKJzD5TvinrmXF
- TLSH T1FF25081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 966KB
- SHA256 9c32adf5cadfb05f1eae1bfe6815496e66109f3cca2e8190bd9db852bed9231d
- MD5 d104f042bffa6cd3c8cabbf41b3cfd92
- SHA1 9f4a6b5b0e2fe579ce15e3eeaf0c6c00a9058b9f
- SHA512 d5fd512cf70aa1bd9f3c13efd7f41dfd024f4d7624fb029c4826f39650cedd7c4c85ef433e90778764bfefafd95de0f5340f62bbf49c6654f74ce4526b93be2a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmoC:t/sCv7rTiw24xKJzD5TvinrmoC
- TLSH T19525081766E84E54E47FA13089A54651DA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 966KB
- SHA256 6d21cb419f77062457ebfaf8fa4b718be3365028fd44f1e812e74fc74c7d0f9b
- MD5 569ac66c4e7f8c7824057f828d5a1863
- SHA1 c00b7d2cb129f66a432ffd5f9211c098362ab774
- SHA512 6a734d840bc44e73f3754703ef1a7f66d3a19aba24e0f1d353c22d2d0d443be80072114946f178bc4af094eb689778a71e6c4f21195bea27813af76408b58eaa
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm7w:t/sCv7rTiw24xKJzD5Tvinrm7w
- TLSH T1F025081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 966KB
- SHA256 7402285c6052695ba3b9f59080698b1a9a5fd0270dd00040b856b77f7b2ea037
- MD5 af79253898027eb80dbe77cd8a81f2f0
- SHA1 692af881cd5bd146088ade4d84eb5a225614df24
- SHA512 4e497c153438164c5946b36d273af68d79236825ad37c59641ef137506ed57c7a0b95c05cff2acfdeb1c3e3541c6ccb6cc60412258904cf27499a44e6d2bbd50
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmCT:t/sCv7rTiw24xKJzD5TvinrmCT
- TLSH T11525081766E84E54E47FA13089A54651DA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 966KB
- SHA256 b0e12cae7184a5951a93be67f818ba821412a1aff2706db4dcb056522248fe39
- MD5 b053eaa23b285bfd574db03d916ed327
- SHA1 4ea5f52f93dfb42d41a9409c93946a8824f1b07a
- SHA512 bd386bb237ced74cd0b3e8f6054fd12298fa78b3f23dffb1a50125590f7b4888eee632f4c1004f975071c9b22daa9a921e5e01de298d4f0fde0838e8a502d918
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmSu:t/sCv7rTiw24xKJzD5TvinrmSu
- TLSH T1D525081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 966KB
- SHA256 63f0fe8812e283bbbfb442d715ec11754158c007362e23beb21d95d11bcce26b
- MD5 8c572004b60856c15062cfed6afba2a9
- SHA1 c8f7744311c3792fa3a9bbc80282871ad38e1b9f
- SHA512 1296261074bbb8694eda3860ab89e273c8c380068c53076001d02f45e328a5f9bc61b5c29f6d2aedf7f5344006da85610811b6da5e1a8d3f045ec3bb27383b7d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmMb:t/sCv7rTiw24xKJzD5TvinrmMb
- TLSH T18925081766E84E54E47FA13089A54651EA73BC551F3087CF12689F293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 966KB
- SHA256 fc45c73270db55fb2d351205945c3956cbd366c2a80997f5debd55f3a5b1eff4
- MD5 0630ecb6ded075d01d163361ea0d1f9e
- SHA1 8b8ce51a52c8b3c1c557c09ae01f88aac50a2b14
- SHA512 4dc41f058bf4561c609ba65589f41798e6b0ba28f4c629caeb697538126416fafeced222c4678a0b9aea46f37605b136f13d179a42400134f044d1fd37387d03
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmyf:t/sCv7rTiw24xKJzD5Tvinrmyf
- TLSH T11825071766E84E54E47FA13089A54651DA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 966KB
- SHA256 890ebd192c54b92ccc33ff39d78d09a74289164d3ec7088be22d407096b5d923
- MD5 28bb7303ae9ae00f95576b6cb1faa1ac
- SHA1 c356c21969eaa353c92227414b8de81a76ad1766
- SHA512 c08c731d03c703dbb7e2506066e5a256112753239b3674c1789d31b8930ec864673dae9394ddfe18fad100364ea054b1c669e2dbc2e7b6a580eab4409542a9b7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmfK:t/sCv7rTiw24xKJzD5TvinrmfK
- TLSH T14B25081766E84E54E47FA13089A54651DA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 966KB
- SHA256 c4a0ca6548e684fcaed780706ca40625d5321a34247d518784638603635f67b4
- MD5 a892c4bdda24f1cd1e1fdf888b536ec5
- SHA1 129ede9bea0183a17dda054ea1020f7bb392e718
- SHA512 2ae4bf98ba1319b2fd22d4d588d2df13f45f81c4758bc46115fdc4e0b9a946c4cc11c217d6b039ba81b4e3bd70ba81bff240b8f4d9369d16c9c4ef8f101c02dd
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm4k:t/sCv7rTiw24xKJzD5Tvinrm4k
- TLSH T1D125081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 966KB
- SHA256 53da93998673f1c01da906155ee333313b23061414873d130654ef5511983bf8
- MD5 b2eff48d6398fb537fb3bf5c9df47edf
- SHA1 5a92e6038390128fdd7b9976796ced5a1123cb4f
- SHA512 62feb118ab78966b30a033274abe86be0da1b8b5451fa62c2e20f15466e11f61e203070fa89913b86042a684e852bf7d2fd2be26d52775fd3a4a4da351fda6b6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm50:t/sCv7rTiw24xKJzD5Tvinrm50
- TLSH T14C25081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 966KB
- SHA256 1c7b4cb291c50dced28607fbd3cb74f11d568fc0d66bc3be3d1e3acc262c29b9
- MD5 2699e898550265b3f17dac149a629cd5
- SHA1 5618e86eb5ff5a8741a8b1431eb14949ee896a5d
- SHA512 3c5bb816790533f6a38cfdaa464f1c30c7be5a3cd23340780285bb3807840c33ed9f609c9b5fff5d91328fa5a9bbda305ce040f5091f88b015e4a87f93a819d5
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrms70:t/sCv7rTiw24xKJzD5Tvinrmsg
- TLSH T13125081766E84E54E47F613089A54651DA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 966KB
- SHA256 5dd9770f0220064c3fcf21073f688ae8b80a68c6b4ad9d188ccf60e64974be9e
- MD5 a9ca2afaea478fb846ab4a18306c64a2
- SHA1 bd184214bb793528a6a3b20d7068b67a391ff80d
- SHA512 7530cadd82f8fa2f969d678b832e0de27b6e52ab700c10c3f1c208d09a77873f687e5dff1097b14e8587ad3e0dd153bec5900cc36cbb9e4861a1cb54436eb21f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmJr:t/sCv7rTiw24xKJzD5TvinrmJr
- TLSH T1BC25081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 966KB
- SHA256 e9b671041f09b4db56326d873c8321d9bea6c9af1484740c22f005caf6d9bd4c
- MD5 345850794ed6ce7906df7170acc8ab62
- SHA1 8a172f302983e3a1b3aae70aea603cf87410e734
- SHA512 74598c2d396f314aa429e0fce2c78ff7e97a20afb641da34349c50ad822f06ba7877028985848abc19c812156614e7822b164033d279dd3b7d83fa4e0315b832
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmrn:t/sCv7rTiw24xKJzD5Tvinrmrn
- TLSH T15025081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 966KB
- SHA256 2234027a28a8e96fa164200f67029b87abd728d3e1790e92042bb58d72c4ac35
- MD5 e789c4d044e16b8592c68835a63f4e37
- SHA1 98d994b505509b53a3acfab24bf58cedf69a6fbc
- SHA512 01fdf93258d8f36e3493dfba57e45448dfaf1ca6a293f9c6257c3bcdf62e5265ef2d04f892f1e9214327f64d980365a633571eeb4fcfe1526aabdaa0ab94a5c0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm3x:t/sCv7rTiw24xKJzD5Tvinrm3x
- TLSH T1D525081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 966KB
- SHA256 29cef583def5d7ce4232827c68f6d5e9e79fec321a0afeb8d1e2727a684524f6
- MD5 9013a90f0ecdd8e78828f700f6b83cf5
- SHA1 6fd293db211d7cc986e915be69a127abbcd9dbc1
- SHA512 c3d36393622dd597320b5dce929d171cbe3064a3c13641836cb59b9ff076e984b65029ec25455fc96afb1b3233728bf09b2628b1df018bab5362e646214ff270
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmtA:t/sCv7rTiw24xKJzD5TvinrmtA
- TLSH T13925081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 966KB
- SHA256 384855071d914d7092a43f6c605f09910ffb2e3044486a22ab3b8a15e0963ddb
- MD5 5c82a6a49197959e909f2218f5feee06
- SHA1 2b77974e013fb65c4cb01e6d8ee951c223e59fc4
- SHA512 a693c914b99ad785af7ded55abe3e88486e2f0cbedbc3f417c4b0f09ab62cf166037db6a0484066be12b15efd5117e2472dada6d85f892c363cd72afd34a9820
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmm9Q:t/sCv7rTiw24xKJzD5Tvinrmm9Q
- TLSH T10725081766E84E54E47FA13089A54651DA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 966KB
- SHA256 604e5283ace4f0a3e33df00805bb7b216921fdd54a33dd0c1abe04bbc158501c
- MD5 dcdc9a51db7527e54de680fad29ea769
- SHA1 38fa6ae35b99abd263b3af618f7fa81dad02eb69
- SHA512 b3b19c4194959c11b0fde253c3493a7472884b3d9a24e94ca575d871089f5d4fca46130aa18eda3945a4c727f77d77ac635a8daee82fa6a6bbec65ecb025a1e0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmD4:t/sCv7rTiw24xKJzD5TvinrmD4
- TLSH T1A525081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 966KB
- SHA256 30353615440baba1f11f1490098517ba7797562e7fca2b6c6a21cbf46d4865c8
- MD5 554df0042ba599244c4ddd6e7fe7df9e
- SHA1 60bd65239b3ceb0c475eeb87f9e93ece5cb98c9b
- SHA512 32d25cd4aa12da38ab19d434186c86822b05a0e79cea0bb2d93d3448f979ca77d36304f66d99595e91197f500029865f1d7825ac7ee4ac2bc2b781a2a98af45c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmqu:t/sCv7rTiw24xKJzD5Tvinrmqu
- TLSH T1A225081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 966KB
- SHA256 093962c0a65f85bfbe16a7bb3ab40742e9e4799b6b181b59d139dafc6f5dde05
- MD5 25a77d413986dc8fde06d81a5c88f41f
- SHA1 3cacfa473bfe849bb6a39f3b2d7cbc2ccce9e502
- SHA512 0c750eb48985c1863ee9d06cd4d0b82d8f18cd648df2b93f24b0bc9834c5f52811501c1b9da85b3dede003e59a0fc19cd62be0af613615f69e506763ebe6439a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm7j:t/sCv7rTiw24xKJzD5Tvinrm7j
- TLSH T1C825071766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 966KB
- SHA256 76bafc0df8466ba628a697b79df58077d69c6f6413fdcb8e9ca0627c6eb37131
- MD5 ff70cdf338cb0ee7c67ac78fe7548d3f
- SHA1 56e9059c3d49cbe577a5a6d8b99a16c57b49c308
- SHA512 0aa0a8f6ff630f37d26846d766bea285193b922b4edc1e9eebcb2102d7fc61877e9b3d3a9e34969699b6bf6878df78cc38373f0295e92fc562cd4c3bedb04392
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmGg:t/sCv7rTiw24xKJzD5TvinrmGg
- TLSH T15C25081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 966KB
- SHA256 03aeaa7b94944ef99ee7f2f45cc48a98ab321ca062a6e28add48186fb0bd7d12
- MD5 76245ac80e8e25c19b697a43752a7b6c
- SHA1 addb4a7b057fcb34879785f239b1c38fdde5993c
- SHA512 52d58abc01c97c9f083d421b0d975086a6d7595af65c506109a0811dbc253b0684c7df486195b2685a4c0cada9f96372a5b229f9b4a006b9fc01e8deec1f45b7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmpI:t/sCv7rTiw24xKJzD5TvinrmpI
- TLSH T18C25081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 966KB
- SHA256 34f537f00c53675c0bdbef0e9a136bf0e0f15a928836b82a80bfde793084594d
- MD5 7ed818c19559455c440f500e5ce031f7
- SHA1 1e20bec531c79820ac435c25e88344b7678e79db
- SHA512 e69efe06168bb18d1816f1ec8b3c7cd4895239bc54274edee454be82ef0b0f1520ee45aa485e52221d5846f239fd9f728eadba7c75ac88a027062def4745b67f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmLo:t/sCv7rTiw24xKJzD5TvinrmLo
- TLSH T18925081766E84E54E47FA13089A54651EA73BC551F3087CF12689F293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 966KB
- SHA256 ca896d5451943bc49cd1b64bee2c5e0c83c722c9b3c079f5247bb085d09d4dd3
- MD5 61f2c90df71cb3e4f1eb321f1ded577c
- SHA1 dc5acc40585ad42f347cac44a4077ffb62300b8b
- SHA512 a4ca6dc015f386e480e305d027f9e39a0a88afb94d7002c48abde4efa4efb91ce19023fd3469c37ecdf97ea87ca5cfda2b82d74080474587b68841c2c041628f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmw+:t/sCv7rTiw24xKJzD5Tvinrmw+
- TLSH T1AF25071766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 966KB
- SHA256 ecb5001081930ea1e6607411ae18da5535a204b0b0bd68c6c72f9c5646516694
- MD5 b7ce0fb5ef92ee447526a44c22ad1aa0
- SHA1 0ada1d5a1f6f56cb721d5486ed065dc8a3b6f420
- SHA512 0b3498dcbea6d637eb5b78dace5c9fea181edf328e989b0e250a191a4efc0a099886557920d19fe62ef723f7a9b4232b1ab7c4861d4646fb467da2c90ef5aea2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmIQ:t/sCv7rTiw24xKJzD5TvinrmIQ
- TLSH T15025081766E84E54E47FA13089A54651EA73BC551F3087CF12689F293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 966KB
- SHA256 826cbab2b08d03491b41839173d06b924a7c1deabec0bda16e955de6c68b17a7
- MD5 4a65a8e3edcc1d82a37d740251c7de61
- SHA1 2077f53334053f9a638f8338e9faf6a97b12e1c0
- SHA512 a10262a01ea7a6419ee426b8497835e4c326dc04fc1867c2cfe9c73c6fb63542bf38b864b078d4e82078d9a2f98cb0423ae606b48ac212c45cb5d6c256c9be06
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmBX:t/sCv7rTiw24xKJzD5TvinrmBX
- TLSH T11925081766E84E54E47FA13089A54651DA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 966KB
- SHA256 46df5373f4dfc9b374e147746a49fc57bf67c013e52104e73e4884ca65add769
- MD5 ecd0a8daef850577a96067255cf1d4be
- SHA1 265316b971e7c665e8dd99f98dbfdca57dfa67f9
- SHA512 c3b9f02dab5dabb584b675e59d0a75e4ae012ab60869ae69a144be1313051c8c6985c6bc78e80a2755b1432f5611b9af5bc954a6a7505db6b1f7a7254e6caf7f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrm7L:t/sCv7rTiw24xKJzD5Tvinrm7L
- TLSH T1BE25081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 966KB
- SHA256 019afe8e4d27c73813de69473768660132d5a8aacbbc800096a393415e88b32e
- MD5 c4f3e3ffeec4bdfc78fecb5947f55b74
- SHA1 eed0bb91952fdf6ac61545f339012cf3f29e1a51
- SHA512 ad55850996ebef0c9b358ed3f80b76e1019fca1d37bd6efcd015fdda742028649512bc24add261719bb6b73f501b52ef35155feab09478032bf3959c460651ac
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmBFC:t/sCv7rTiw24xKJzD5TvinrmBM
- TLSH T1A825081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 966KB
- SHA256 cf581c537724c267bca3f32a42566ba78c47a59e4705a1577577c306f269d198
- MD5 b56947075470cc6bb7fd7876b4092387
- SHA1 74803ad39bfad2e2538b54db4bb9112fcafe2aac
- SHA512 19e76a6aac639e0499d4bc4466e4f3037fc746539a06c38be82ce1de1f07c801bf38d5c4ffff56c359b5df8c5bd432d7b8490d18328549724157920214ae42d9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2JK/pKJzD3JeU7vinrmqh:t/sCv7rTiw24xKJzD5Tvinrmqh
- TLSH T1CA25081766E84E54E47F613089A54651EA73BC551F3087CF1268AF293E33AF0AD38B27
- MD5 SHA1 SHA512 SSDEEP TLSH