Analysis
- max time kernel
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 03:10
Behavioral task
behavioral1
Sample
2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 877KB
- Sample260827-dpd4kadj7w
- SHA256 2e633d950161be688697ec9ce1de101beaf2306a22e9e3a7f18455084e6c27cd
- MD5 f14a6b9b708cb9908b83f593ece66fea
- SHA1 19dadfc78593ef78fd59a7677b1a8a729163581e
- SHA512 1db63db41a09aecc6e826312c9aeae2d710f2bb14041832f8ebc5b09c47b415e64b501e79fa02c8c870b0a05e3a49c269c9bd98651c869ef49bf31641247c0dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaf:A3k03kHRJK
- TLSH T14715AD13EB9500E9D10AC1749ADA9A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/2368-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c508-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2368-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1516-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c3-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c86-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-443.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-577.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-763.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-843.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1045.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1064.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1107.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1138.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1169.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1397.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c508-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c3-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c86-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-274.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-443.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-577.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-621.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-647.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-763.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-843.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-868.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-984.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1045.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1064.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1107.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1138.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1169.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1182.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1195.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1322.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1336.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1356.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1375.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1382.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1397.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1516 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2368 2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe 1516 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f14a6b9b708cb9908b83f593ece66fea_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2368
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 877KB
- SHA256 2e633d950161be688697ec9ce1de101beaf2306a22e9e3a7f18455084e6c27cd
- MD5 f14a6b9b708cb9908b83f593ece66fea
- SHA1 19dadfc78593ef78fd59a7677b1a8a729163581e
- SHA512 1db63db41a09aecc6e826312c9aeae2d710f2bb14041832f8ebc5b09c47b415e64b501e79fa02c8c870b0a05e3a49c269c9bd98651c869ef49bf31641247c0dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaf:A3k03kHRJK
- TLSH T14715AD13EB9500E9D10AC1749ADA9A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 fe5cff63d298bcf2564d106fbfe3ee1e99cd6af380e301d27d54e29ffe6bfe0b
- MD5 7ef99afc21ed0211969c483a7b06aefe
- SHA1 761cd9162a58eacd10f071c7aac85538bca22ace
- SHA512 edcc476c61c41de5398cbc68605e2724ec1c96cb25417ba38c980652cb6570f4b0295dfb9fa82d52ca5c11fe4bf83d08ff2e54d81b28fb8163444884b9a0e1ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQa60Le5ji0hmxNrM:A3k03kHRJrPji0Aj
- TLSH T10E658C17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 892KB
- SHA256 a0b95e9d5f0c238d3107c8e3977dde4321bdd14fcb44ef696408c229d6eb487b
- MD5 fa1e866b3e3ce0ec5d48588cc79ecc17
- SHA1 a6189b8bb19a983c23a60c3ec2aed867214b0299
- SHA512 092416a9f616fb4851497b7ea35ded0b35f39d7719b39a1c547147d383698f0f60e2632bb5ec72634ff4d521e6911cef5c5b35c417e2f21aee26bf45725ac307
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaUa:A3k03kHRJ
- TLSH T1EE15AE13EB9500E9D10AC1749ADA8A22FB75BC56177093DF2358C6152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 925KB
- SHA256 cfea92e0b796e9b4f5f474b273fcafecd2966400f8347dfb21bac2c0a265856f
- MD5 82c4ab5a2b9be5f962d8723e41ac701a
- SHA1 f3af05f21a7a58b83ca4f8ab90f3af7a48574dc4
- SHA512 6099df1b7d549c4de8db7572140c10634c46b9dcc42171c7cfc5770a3bfb3af7711e0b73bdcb3881f4f57bcc3c9508816c8a4b537777bda41c138e0bd6cce709
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQa/b:A3k03kHRJOb
- TLSH T17115AE13E79500E9D10AC2749AD58A22FB75BC562B7093DF2358C2152F63BD06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 901KB
- SHA256 e953b16cebc0f70d5e1316759a15a2769ec90d550601169a1e9f4668c5c83049
- MD5 ceb40464943ec7ba6027da1cc16cf625
- SHA1 9d520988debfd8586dd65bcd89c56baba051639a
- SHA512 8ed427caed82909ebb9d9b0d82e30e171e103b9c6a1c7f6e71c8d5fa93b9c3dd840bf829f674e4f29b60787af99d646d4669a03ace6274b71d5f112e7b73b6b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaV9:A3k03kHRJ4
- TLSH T13215AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 901KB
- SHA256 0c4c58473b3a32578bf9c5f7235dd9f65f0ff676dc04fd67131e861e03550d19
- MD5 f828883ead960172187bf9b14ab6bab7
- SHA1 28b6bb361343a4c9dce8cedf2459e21525f52c67
- SHA512 6a63b6faea4f6f56c331a7355850190f1b18244a0e5af6271d04eaf22677a07a804ca49ae0fbaa6c006c640e2792669b2e39d12be51508782945b021d09cfe03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaxc:A3k03kHRJ5
- TLSH T16015AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 901KB
- SHA256 fa6743982038f3d7c0f531e4dfacc9f4aa3abf6fb1589846b29ed8479a9c45c7
- MD5 d21ce6cbc42707f594b7b1c0eb4bdbf7
- SHA1 bec6904f3038b5149b8cb0f284347d96ec485675
- SHA512 fd8169a042dd438eb95a3a748ea039de3b198496fb640b428a256dfbc7df6cf6caf36469739643788549ccddfab62abe361b6f0be1e8a0fee89c4719e6d7c143
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaap:A3k03kHRJ3
- TLSH T1CB15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 901KB
- SHA256 f3fe275ce8ee14edb3218dbd21b4ed3a3c91d25ca2267244a4069490b53beb04
- MD5 085dbcf71909db52f0d9cb0ccad30606
- SHA1 8c5b3df3bf27f61c038f612db84a17cd7e297d24
- SHA512 3953d1f462b5f8d8dc016f7d22a15a03d6dcc66b7b3170c01bb80082351659ff480c5242b298a3ebf88c10075953cf7c5100fb4835c93e3b6d9b5bb196599453
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQa9N:A3k03kHRJc
- TLSH T12C15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 901KB
- SHA256 8adcc7c0ab27de5728a8e9467b38864e77bf9bdfb55688b1fc2ea563745dbb21
- MD5 2f4182eaeffcb767e4a73568255f8141
- SHA1 14f04f5cb38c60d8f15aaeb9a606eb3039cfaf79
- SHA512 7644b974be5ed54c341316549e51f8cbc94693eabae592b1d46a2bca9a70ed952c3d08a810c77daa8a9126f2aed7ca0e76561fe3a81ba526824326db70236f66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQavF:A3k03kHRJq
- TLSH T16015AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 901KB
- SHA256 8e00abd62335c818ab56dab84e24a3838075a6d5e981ed46234cef1cf83b432f
- MD5 ac899b6e5a1025061f8ea8309668e7aa
- SHA1 7a9f24c45e205a739eb9c0b77511e6a45747f68a
- SHA512 4fe8cf395763e747d21c6b255d7f50f188254d3a9c54ba56a81e19acabbf8b342b1454eb939f03d3776388fa88a721a382be205c299c4f8f873a634bf04dd715
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaQC:A3k03kHRJ+
- TLSH T1E115AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 901KB
- SHA256 006fbad361046990c3ec7f903a7d58fcc49cf94e6a17f7d20519249365bfdf4a
- MD5 d508435d00ca92536ca38cffe4715505
- SHA1 4ecc4654be9e2c2ab00f96ffbc4090702dfd8d2a
- SHA512 bbed21c5bbd12721305f505e0883fd5f08c9d824f341a875f55b76693d30ab94922738822fdb073342c6969e9e09ad3c0a4d1086576aa6deb71043cbb189205f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaDw:A3k03kHRJL
- TLSH T12015AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 901KB
- SHA256 2b60fb55865bfcae8660167bae1c99a04808754a4d094a297c0f990153b93ba6
- MD5 30a1428b457be2f1ba9edcabebd4ff8f
- SHA1 f645aeeec2dc85729795549d6a057e3d6eb1425c
- SHA512 e95b3b3ecd7f7d44ec6fb6d9972cb9e91bfef85d7c3e1b58a5a5b0655f19f3e158e3c6ff77a24279cc66dbf966229b69802f6bb4a83c990f8ff3bb4c444d1314
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaKT:A3k03kHRJ3
- TLSH T1C415AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 901KB
- SHA256 13e9e344959782a95ffe09a98abafd0e11ce50b0763f58d158e35b45c0a3973e
- MD5 e141cc88d8951cfbedd9bc55a608ec80
- SHA1 5095774c3e063c7b77b5014a53227490b16eb567
- SHA512 dc3f7b0ca6fbd7e526647c6a25a4e8bb1707be9fd2572dba6640d6bd6714d3ca9323769705756d99c0a26df836f10ea6292177d492ec7cb4a4d32ee6e2e08066
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaqu:A3k03kHRJ4
- TLSH T18015AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 901KB
- SHA256 7c5d0e28d21ac2381c0d746b4e8e7527b0ccc4c39c4599d0bcd436c74b1fc376
- MD5 bf4bdd36cfb728b85b0b13812fc1ec62
- SHA1 9789f6801fc94edc4514b4ede0d8e3dd0d0e7967
- SHA512 c9df432d91176d7dee74b991e12eb9090865aa3320602bf2b401e4912f6ccd84dafa4b70fd1d1e34f6b9d1b726e3cfe21a69748e3ca4dbce2f4ab19c9e995282
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQa0b:A3k03kHRJh
- TLSH T14A15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 901KB
- SHA256 db9dcc4c30bb9c4a9c10101d1b38f7402174ba1a4feb58d64fbce2d3ada0b1cc
- MD5 06578f7ccfe6d708295c0ccccf9d33a5
- SHA1 686da9a06406cb9e21246ba5b0757b081a3c3745
- SHA512 34078c32006c806086ea3e1683ba64d038db3475da8a1a71ef128185c10d89f9a3fef864839600dffdab3d4da618e50ad15b3a9f96987efc2f8848834f111d25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQa6f:A3k03kHRJh
- TLSH T10F15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 901KB
- SHA256 4c5447a3f84aebb8a37aff879feea7a0a1afbae71773f07545a4381f45b08e2f
- MD5 bbde6107d290a66d81fd33160440aee0
- SHA1 b5ba9def0ddf335d9e7118d80d898075bf2dee91
- SHA512 5d13465634f88a0d43e9f410b5cffc25801de35ed264daac45a5a4c29d59017e4d81df909a1b171ac1ac22b2cf79880991d0317e741b4239a9fe475faac13c39
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQanK:A3k03kHRJ5
- TLSH T1A015AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 901KB
- SHA256 ee23df67e20975b2369055b096cba80ebc04f29570954d633ffa863ffc11e39d
- MD5 9400a6b7911f0361d31cb5cebfa339de
- SHA1 7486ed3f7cca737cf490d871c7bb5ade3e911618
- SHA512 04716f7fe9360330e3ae5f8844ac5ec0aafe0fa9df29d5dd4421bbe08c48b014d88cf0cc1b2af2a94ca483514e3978b9f1ddacd05b9e0dd08a8114a76cdd6a93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQawk:A3k03kHRJw
- TLSH T11115AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 901KB
- SHA256 bb0e4055b1939f1ae767bc7b325af292868096b6463e7a65c44cb49be9de68d6
- MD5 45b31867a77ffe7ec5bf1a3ee7891f33
- SHA1 180f59e3ae193e92287923952a97219b60eec21f
- SHA512 6a702fac1b64565c11d98a4799f82066642d6e0d5b0ef265b08099b5adb2189262f23037541f1eadf5a3397883fbccd906cf97898592aa700e063e8e0889f878
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaB0:A3k03kHRJZ
- TLSH T19315AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 901KB
- SHA256 19d22fe2279f81c0f9fe611668ab9273cd2e38f3fc3e3501b9a13ca5895edd81
- MD5 58928bb94299d6bb92cdcf8854f5dae5
- SHA1 140a480ca225bb833a2138e880398edd28700499
- SHA512 0e47ad61fd1e4a8bf20e29d91a32c9f09bd8cd3718881e9fedee9551d45022a2c10253c2a5352c116f8afb08c17934c86ee17f225d9f24f28d09bedbd09c6054
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQa0g:A3k03kHRJI
- TLSH T1B115AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 901KB
- SHA256 1e5aafd79ab42f424add180500b25ac734a37e260d6d76e8e2875cdd516ba485
- MD5 d1ddce45cbfadcbdec646ff1d8733b01
- SHA1 10942453d747bb30d6cf2be59725cb296ac0dff2
- SHA512 3788030b2a239b1b22cd96b39cde8bf2a0ba498057f121a5a012da7cf6ff7985d5d970d27b67693c17afca98ef23d1532ecf944298f1cde0e3a241dc228bade2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaRr:A3k03kHRJy
- TLSH T1A915AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 901KB
- SHA256 b8a3071ec43f9a09d155cc78fcdd7166c9aa9c344927b0654e6706c420237dca
- MD5 42aae5f8b0d6b89d11bff78c29a7831c
- SHA1 7f45f11b487f3ff7fe116360d269d25acd19b684
- SHA512 998f89a4d6b0cd3af8b08c2698f05dbb3ae0ed9090fde7d4da9c819d836a925e2ef8042acc54c9a5d3a1f4579a29eb4c79e0829c08f802f886882eeddb8f0aa8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaTn:A3k03kHRJk
- TLSH T1C615AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 901KB
- SHA256 c8dee38f245b363f30a93d45b5811be2deb1a611441616b7286eeba686b888fa
- MD5 bb99a6b1a8b80f4da946578a0a78aed5
- SHA1 833e64fcf807e0e1e255fc9687f870892b73b387
- SHA512 21db3a63aadc85cc4287088307f6c07c269edcb74cf3ff6511c5bf92f6b3215135baf8c10a305765cf17a029515c3419aee44d8606e82c4e329fbb2ce07abfbc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaPx:A3k03kHRJC
- TLSH T19D15AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 901KB
- SHA256 bac1d60ef49631626f4bcf20692d9b1730d1d1bcefec3451f674a97f980d4e44
- MD5 d451277368d46c8de11ed750455eae74
- SHA1 8db7e73375280e0fe53fc7e5813f45b53a45c477
- SHA512 5d30eb434e7446b5f6a3209db852863dee6d3af0da02e209626370fa945c9ce2e0847dadbcec1586b28fe7bd26cd51242df613d109d6e4120ee97d97ac805b83
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQa1A:A3k03kHRJh
- TLSH T17D15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 901KB
- SHA256 acfc6a0122fc02d02403fca22b08faf9f56c9304043076e33b28d8039adec323
- MD5 8fe49bba009419d398b2977918287849
- SHA1 a1f91264892870c2f7ece79ceee42b8725a6a3ef
- SHA512 781990d0057caee0f843161ddf0823a61d43dda179de113bd36df0c0675265d9b89eac59aabd6f32326abc601b08d2f1698bce78b353c844d0ea3e5a90e6ba50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaO9Q:A3k03kHRJY
- TLSH T10615AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 901KB
- SHA256 eda513a263b0e78f702b166310ad3a01d03fd80031b991731b450efd9f2716fc
- MD5 f6752257e872231f0ae3c0c562fd4139
- SHA1 d55aed33d3d7ca80a7fb467c2932ee05371d84b0
- SHA512 94c07ffa0856f4d586903e1e7261cdf1a6322f0a7a3871b5883197ab1ba66e1815915e0b12f7cce68e6422858e5f14f2ce55f6f946c8a329ce34c3a130f952aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQab4:A3k03kHRJj
- TLSH T1F515AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 901KB
- SHA256 064b3eca63d07020c9f4339e668de3579a924f1bfccbccc0f7035d19f361709f
- MD5 65dc6762d74b9cf9fcead05aff400be4
- SHA1 c378c1b59a00b880aedb49ecae2db77f33280564
- SHA512 176c66d68a7895ac0cbcc63f0cd8ffe2e2eb4df3d765af9d8eabce6b98935450a2959e99bbd249cbfcd231c669e4c2abb12c7c083fbbb838c860e9d63c599069
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQayu:A3k03kHRJG
- TLSH T13315AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 901KB
- SHA256 afb72de776baf446fafb2882a907ce4a48d52adb5501803b2d1e370e10a60da5
- MD5 0d7118929f775380b1d6fa4a55a1b52f
- SHA1 cebe517fa8608f12662198213985a6de22b33401
- SHA512 46c1df1ac9d87957a34bfe7ae20bfb7eb63485a96cad1ca7f45139442bcd4e4904050b1ef9ab859dbcb7d1caffcbb2eaeeeb2faa7a5309d173854bb73bfc418c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQajj:A3k03kHRJ4
- TLSH T15115AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 901KB
- SHA256 9cfe27e0691593cca76d02c14bab60b5decc9e03bdf4bbb07ff8140fa5b153fb
- MD5 c8e633b5b1d64e77f7bf247e7486ddcd
- SHA1 38d38db57d714a8c90430fdfb273a2f8a7d0929b
- SHA512 e51c3988175b1dbbf2bab781731ed149c4c150103397591a0c6b832aa8c3737999de0986d4fc30bd3f8901536504036714b4ede5fcfbe5d1754c66e740e5e101
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaOg:A3k03kHRJA
- TLSH T13815AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 901KB
- SHA256 79fec443b4ccb65f1980a3a0686fecaa2e66c1208a9facdc3893e2307c314d8b
- MD5 f6b0bd49d3aded1ea9ab076dcf1aaaea
- SHA1 ae608f8132156efb465212fd747c4366d93c4026
- SHA512 334d7635d54faae754c6fc9fb36cf24829afeac693983cb5b24734028f64017285c3dd2b280ec4033ef301711247b34ad89c6a8435ef76e1590ead5f4f2d6c7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQahI:A3k03kHRJB
- TLSH T19A15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 901KB
- SHA256 6ac355d19277d1eb7282986bec1f0d4562bab3863b34deb2403e8fe30fbe6312
- MD5 6b5d4c9f684dfe3b6b423250c6163b33
- SHA1 d52bf8c4a0ac75a9fa5fa4e2fba635a5dab921f0
- SHA512 18050ec1cb6f2c852ebc3a991cb0e226b5e2cf0518fce4ac6c8d049c5a2b53931bd78fb4ccfbed3842c964781f4bc29d0391ba3ca97c4fed8f21c0adb8b8c108
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQajo:A3k03kHRJf
- TLSH T14615AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 901KB
- SHA256 56a9390daa1361a91269b9627a6d8b8444d8313ed740d28276a57286f5ea3f10
- MD5 209f8f8854afd17e8888aef08b752519
- SHA1 0931d64bf867d664b2c70a6f0c601cadf0adbbac
- SHA512 14fbb6039ab3110178ba18d0367291450eb54e9e69ca42721c7a90aa491c7b12e889c0fb16f53ffe9fbb62af35573011f251c8f69294a2cba66ed3d3539d47e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQao+:A3k03kHRJq
- TLSH T1F815AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 901KB
- SHA256 3f3db0298f33086f1c55c9a19dbc6fea8591cd9b7f3bfb17cdf21afa68e37051
- MD5 fc6460e6344dd59549788af8ade743dd
- SHA1 15a392fb9d2f20bf51df6872256e1f104f8fb396
- SHA512 40bbf756fd9e5a0b991c51b68979dc197d98be893258eeb0194b47e68773c4c3d71a3083517b47e8a7dbe9e1ea4c6ffb8a87596928143899cd0d2cfdda08aa13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaAQ:A3k03kHRJu
- TLSH T15915AE13EB9504E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 901KB
- SHA256 23e4a8f01c8aa18bd59cb5cac083c6d3be966f957a7057137ffce4a1f6703cc1
- MD5 c2f1033db2fc04450d5700de1d0bd2f4
- SHA1 3950323a45ddef394f5d72ab7de4009578777749
- SHA512 894beca12e206d9c8ad61e126c0824b45207ed5a017f768df8e19bb22cba5b36d72b51e144287e24ab1ac595fae16b3af48314c3e279d7d78d89bc661e00bf81
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQapX:A3k03kHRJu
- TLSH T11C15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 901KB
- SHA256 3cd8fda69d09f0985717c51ffa6e9025761430de5f0c31605157fa60fea2f25e
- MD5 33d1da2e241a143460ce10805b28bf02
- SHA1 b1cdacc7581de6fff4974e9081abf17f6b402378
- SHA512 c75d4b4859eb4b8c612e6bee7dfd2f1b1bb050986ba576cf6df6c25fe60da5a9b2be6683aa1a03d405659b61a2719a9fadfb1833798bd1a3b011df290ccf8e4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQajL:A3k03kHRJA
- TLSH T16915AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 901KB
- SHA256 5b6fb28ce2d64daf75429b3d4bb4012f2e5aec0072950aa4e3981681002f92ee
- MD5 7201482cbb2410bb5c091b6d86f619d2
- SHA1 7604fa4341802c294b15bf3f19b3a2e50773bb1e
- SHA512 b213a6812c20c072484fb5b81023f410d0f55ca729595d3e937064ff518f448a381bbdb108816d5bb0742a66226dd6e0ee66be9fc6a4cb0bc7305cfd75667b3b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQaJM:A3k03kHRJR
- TLSH T12B15AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 901KB
- SHA256 42d29e4df2250cdb9d44e11c86e9c8e82abb853dd1732c0e5294fac71d4957fe
- MD5 a66adba103cc06353cc516b2fc9746e4
- SHA1 26e7a4813d6e8a10503f25ec6c4735cd6f7498e7
- SHA512 4a0c91b416c58f6a5d2ac004b054f9ea17c77ad54975ebff81010c9c832f6bb7edc0810bb834516889b58b863c338ace349bdcc34c15699fd0e33cae247c35c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TO9jdQayh:A3k03kHRJj
- TLSH T14815AE13EB9504E9D10AC1749ADA8A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH