Analysis
- max time kernel
115s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 939KB
- Sample260705-d323jsg141
- SHA256 6d2bacca4d27e4684a6c20fc5535db5bb46caa635e89e5a2062b21a0da7d7372
- MD5 b5def590f0cf3dd2599f378d75ccfb0f
- SHA1 8a19e94358366c28e660f90afd16c6c624361fc1
- SHA512 c5801c52e0a7b6849795623a99c8312f7c61e4265db19ea8b668cf9dcc2a67ac455a1f0b736090fafb7e6054ca7be82b2724ef54ecca80bd7d37ad09c9771625
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqw:cuytJJ8y5iTvb
- TLSH T17F259E1277E444B6E162823489E19756EB76FC620F20C7CF6394971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/3168-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5bb-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b21f-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b8-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb1a-238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00050000000198cb-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-314.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-528.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-699.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-761.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-786.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-842.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-867.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-925.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-975.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1006.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1080.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1093.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1130.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1309.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3168-1389-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1212-1390-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b926-1550.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1212 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3168 2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe 1212 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_b5def590f0cf3dd2599f378d75ccfb0f_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3168
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 939KB
- SHA256 6d2bacca4d27e4684a6c20fc5535db5bb46caa635e89e5a2062b21a0da7d7372
- MD5 b5def590f0cf3dd2599f378d75ccfb0f
- SHA1 8a19e94358366c28e660f90afd16c6c624361fc1
- SHA512 c5801c52e0a7b6849795623a99c8312f7c61e4265db19ea8b668cf9dcc2a67ac455a1f0b736090fafb7e6054ca7be82b2724ef54ecca80bd7d37ad09c9771625
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqw:cuytJJ8y5iTvb
- TLSH T17F259E1277E444B6E162823489E19756EB76FC620F20C7CF6394971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 1.4MB
- SHA256 0cab3f62b99e0be5ba2dec038a24901a68cd7bafdc37ff6b5b9ba88048fed6a1
- MD5 db0b8ca327220a259f02b705162ad63f
- SHA1 eaae56523d95810ede007bf1b711c36571ab5040
- SHA512 c916459fbc8c673bc9a64e7568d60c093582bd05343c3406051feadabbdb64213f15b15c9141690b0727fa002be972f862a35af65b00e0dcb3d9482a4f4b6fb5
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqM3Td9CHKy7GZO:cuytJJ8y5iTvbTd9CHKyao
- TLSH T107657C52B7E404B5F173863489A19712DBB6FC660B21CBCF2394561E1F32BD19E39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 cadf95eb56533a5209777a7e5bd37635f4341358db823430bc2b9eed07f17c72
- MD5 5e99417e087f146de84cf99908d14db2
- SHA1 f07298e161bb9a1edf1dd7098d3ec26881e8bc12
- SHA512 7af4a22eec16108e6c705d5cf8eadbf8ebca62c3d6330aad32b163128a1116ed015904957ac8c3752d6cd2ff97baaa448e9004cc919b86f263d9d0e34474ad98
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqI0Le5ji0hmxNrM:cuytJJ8y5iTvHPji0Aj
- TLSH T15F656C16F6A44671E073C175C5D2975AEA7278520B308BCB5384876D2F33BE29E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 59b07b0763db882e79f1c4106e6306ef7f5f3a2573ea58fd4643f3efec73e876
- MD5 6997ba7dddc3ba791885ec43f0d82426
- SHA1 dfeea320fbc0390d4997418dc6fe677beb3b58ba
- SHA512 cc58e29b8ab94b44dc183ebec6e213db83f4faee2f0bf704455021b58e719b0b63ea20ad1a047bd43cbc117597291b593e59a786d88ed078a7d77f55fa7c328a
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqya:cuytJJ8y5iTv
- TLSH T1B5259E1277E444B2E162823489E19756EB76FC620F20C7CF6394975E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 963KB
- SHA256 8210a96d20c5ade9d7d6f520ac9052b1b93a3344485b3f528ff1f837a95d0008
- MD5 a1fa41b6a6c505e07ae118c8440e945d
- SHA1 cab4d13c019a90959b9712f3a7b450bc92cf3916
- SHA512 2c18e879948b4e409acc1648e15f5dadece73eeb829ae3661cd94bf6be830eac567dff415d6e25cad7124ccca45a98f712f9ded851dccdc925fdda41f69ab9cd
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqD6:cuytJJ8y5iTvP
- TLSH T1E7259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 963KB
- SHA256 e5b58c39fae30288d9f7b22920e966863f89716e1f44650e0810c77ff5c7a488
- MD5 76d2652a95f5dd7dc6b715022b62d2b2
- SHA1 25d5467059c914e93110f5f6a26cbd1f34c26f11
- SHA512 6d5e3d49c5d3b337e60bd66c092d111e3ed65ffc99aafccf0c72df71715b9b2731e8da02654a3ac5dfdfdf4cb09e3f4eba1aab7c03c277106f101650cd70e2c1
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqNo:cuytJJ8y5iTvv
- TLSH T127259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 963KB
- SHA256 5e2d3bfdeaaf67efb398af2c0a411da2443f22b1b258dc2d3a560084e4f3da2e
- MD5 cf68e8d826f29eea976e84ec9039ad54
- SHA1 4181c42dc67abeb8b19cc419be8013ee7e1b2bbb
- SHA512 3ad14cd239d470dd74a20b23f4bcead1691bc4be39dbdb876f14dd9448d4fc25d6eb418a2f7dff78711e3690e56f4c01d9a8ca317fe2c5af891c7118aa2b35c4
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqNu:cuytJJ8y5iTvh
- TLSH T1E525AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 963KB
- SHA256 3b9187e34277179640d6cc9da071c230fe83dd3d49f08c3ec2cb005b7c7990e3
- MD5 f0c27187b436b4f2f4fbf546c3d178b4
- SHA1 de15c7f88b12f1026a30d589c0df8e6206aad2c6
- SHA512 1862068e91d0ab851a706b67b1d86c48e125eedd2c95dd563dca813e8f0f3504acac6efd8c844fdc8a8f26fa87a20af22cc4886197d0a3c04d919d6b4604f171
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqj9:cuytJJ8y5iTvc
- TLSH T1A125AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 963KB
- SHA256 3d80cabe3931fb19e48068e5943b1f5b270f0d34a8e4ba398c624fb9d9cbc8b5
- MD5 246bba6c323a443626aa924ce843e255
- SHA1 d0de2d5407a09a5d2e237fc9e8616f006797abc2
- SHA512 0edf237b5bdac6ba95b88ba523a1579aa8265409570bdda54dbf9832da3fa8920a62a772da2937bf00455ff4f6fd7bc3b4f7bf04e4fdc9d3b86ca7fc6a03c7c5
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqPc:cuytJJ8y5iTvV
- TLSH T16725AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 963KB
- SHA256 63376260cfa26363820568c3888dd19acd487be7cba807f4a1bf4595e2f2d940
- MD5 6ec2e04424b190b3c1aae48f98c23770
- SHA1 63194c0254b6d77ff34dbf6d7370c0f4a4e3e748
- SHA512 7ffe08bdffa777c087b58e1bd6d3dab94825fdf10d5e0e57a783c1eae20e120c2e1b92e63a873ccffe18cafbe623b4d37703cf8f3028c1716b9e9f5ca4dc7c26
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqIp:cuytJJ8y5iTvb
- TLSH T1E125AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 963KB
- SHA256 c5ffdd27c5db0c3e2feaaaaf2174643850368f98c18b0770b2b8485b54ee6ef1
- MD5 987615c09466a1b591332eadf8945c2e
- SHA1 f0e098372fa1f2752e50bf9e25a98c40c4e695e9
- SHA512 7ebaec85cbb39ff3b9b916b768276f34ea642aed8642b6968a8d735728874ba3f1b52504887aafc054a2495c9840d0805440f67d650f08fbe498c69bd65bc9b8
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqfN:cuytJJ8y5iTvg
- TLSH T12925AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 963KB
- SHA256 481ee62ccb3cc76a9842e4c07e1c6da0cba3efd7627bd91cfb3e3a1d6d65cfdd
- MD5 6cd43930ae6cacb62d9943ff74f677fd
- SHA1 afc46f036e473d7c8603657e7ce0592307484b0f
- SHA512 d574ed645e5b0ea10ea0331b0d757991e7efe1fc54681213f71cba00695b5a92fa06ffa32db23d38c5bcabbc1c82fc8cefa96a9a7f07795ff7eabe8c682b942c
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqdF:cuytJJ8y5iTvW
- TLSH T16C259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 963KB
- SHA256 2fecfb266e3a831346fee520893c5135193afa7c4ecc23e2768dcc9bdb998641
- MD5 3229e526b36a12f4bf62a0800aeaf6cb
- SHA1 de9e19c3641365366cdafd0b918714009c6e1599
- SHA512 5c4e1bd76b110e2db23d9baa45bce1dc7d78436c8ea2f6ba4d4abf0b867008796e1fca8d8c90b6fb652d5bef521362447d5622f9b273cbac9cc0856fefa162f5
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEquC:cuytJJ8y5iTvS
- TLSH T1CB25AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 963KB
- SHA256 95fe057133e3c028132ba215a8159203d6c120a6dc43c702afe765cfa0a134bc
- MD5 af4530c71fb0b57c5ba1fb48062d6e47
- SHA1 60d694b55f25ca245140658cf3a2018379cfe681
- SHA512 8ab009b74e0d86bf96396c581a2dccea22f9e0586124342373edd2da93b692b7fe17b79bbd40e76a207e8a9d9e9a611d79041760e1f6da66495665c36c3487a2
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqxw:cuytJJ8y5iTvn
- TLSH T1C525AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 963KB
- SHA256 92dc95b75df54a910e13d5131cdb9707fb072e3c65b093f7eff2f0675024ce33
- MD5 811dc576e486b7499846673137fbc878
- SHA1 ecba372765d89cbb427158ecdfe6daa27ca042f3
- SHA512 5e258a08dcca2d2f32d7ce387d2bb47f174b2dbd99af2a1779d9806f2eae3ea6d0e7b8bfa9a5710db9c897311a1cfbde702576e97dfc820580b26d4a1327ee05
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqYT:cuytJJ8y5iTvj
- TLSH T1FB25AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 963KB
- SHA256 e56d281675fd4f2664a907eb54958d06198091c5d8805a0cf4190feb8cfa161e
- MD5 7ddef7a1739a29cefddde91586fb1ef3
- SHA1 daae01f61e0f27722221536113da2627c70dd69b
- SHA512 a5318d3373eca5c8b41edcd9f6563fc94dbff89f4f4eef5789ec35b170c8a046843d61540050d833417955005b1d11af3e9854451ea3053f91d9f21371cc2a1b
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEq0u:cuytJJ8y5iTvU
- TLSH T13B259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 963KB
- SHA256 eb0362727bc98c9c04057a4cf79e55bfe6f9d033118444fb183cb8af11889fc4
- MD5 1abbe4f5a69cbf58c4d707d6aa64b398
- SHA1 4be3a71a94e045d3d659eb89143d17b44148af0d
- SHA512 5e1e844af391a70443f806149f98ab9b84c587142167c265f6f7ad4f84046644dacaa22a19e4c6a6c099013feab7c3a49351813dd9721f5e13deddfb16f407c5
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqib:cuytJJ8y5iTv9
- TLSH T19D259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 963KB
- SHA256 52d867a7de05321a4d65cea1fd8098b4c16aa2c4adfc21b1e5c4c8625f566c48
- MD5 5062666bada019e3ac2f3dba53236664
- SHA1 7636b23a8c51014b8c12b14d927ffa0fb627282e
- SHA512 1ddb951ff17b928b31a5be41bab582ba2337450a68160987f99e686bb332fcd5585f919efdd5b5711868d012ec94dc7620ac5f5b1b8bb05ec15df2838ab2deda
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqkf:cuytJJ8y5iTvt
- TLSH T1EA25AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 963KB
- SHA256 5b8ea30adbeb232e5474c60fb074fe819d63796bc8ca478941080fca13e93038
- MD5 7bde76647be277f81e6cfbaca54bcb54
- SHA1 0b1684ebfd368aff925277a117d6c334f0def7b9
- SHA512 fd4850768ca9d6f733a7ea107cdd2696d1ce2c1a6a48900e55763234da3a922b6a9786224d5b325708937748c528c04b821ab8e7764ee2d5f2196389136f3b1f
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqBK:cuytJJ8y5iTvl
- TLSH T16F25AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 963KB
- SHA256 39b14a12a62712e9b2e040c07f860a64fa43641548a36ade210fbd2a7df23aab
- MD5 392660975fddc4032516337e542520e5
- SHA1 95732c8ad4cc6a65b43edbdd215e7258db105a37
- SHA512 f17f7231b26cdea8573eca985a14c2fbe6f0e2c114c43bda9d58dc8a34b49d9a942e1e142d67ddb0427113337b6d7986b251fb2833c10f620138af9364b67769
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEq6k:cuytJJ8y5iTvM
- TLSH T11C259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 963KB
- SHA256 3f590152efb193d0368c2c924220489d660040779e080cea1cf484bc57be173b
- MD5 8a715ca1e537e2c968e6f6d01927b90e
- SHA1 3c574e19bf9dfd978525f2ec8039f7f835ce0372
- SHA512 d031362162f3afd15e7761c572bf03bccf999f57867deadd983557805e3743cb9d88c693ef417fde5a2d59c59add337871e58196b250c15b24c0d1b2051c3853
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqf0:cuytJJ8y5iTvl
- TLSH T1F9259E1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 963KB
- SHA256 ef821de465c6da1608b0658432ba5903f145c72674f7b04eec2d0ee852ad0f9d
- MD5 ae4c78a18f89d0bac44b0b93689467e3
- SHA1 eb8f1c9e3c7bd72872219be913d7df739a4d93f7
- SHA512 fad7247482c745576bbc6108fc20a1e2d9f21208e48f8d756919ce8a2acb4ac18e45e32c495388d646c46833ae976878a13910fc1717c1ee00d7e59b53cc240d
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqug:cuytJJ8y5iTvE
- TLSH T1C425AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 963KB
- SHA256 917282e16e4d264ce137d187eb811abc859e2a072173351060ecbaba017b8600
- MD5 c20a88f49565c53dee6d8a7ec2594e7a
- SHA1 d3d0493f5ad0887d9121946e22a3f9ca5cf2208f
- SHA512 549e6fc8f88bfb934440a4eb3444c2656dc5386f955700bbeeb2f899091e050825849c1acd06af9cdf8a037632f76590e037c432ebdcd66a154d877abfc08c87
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEq3r:cuytJJ8y5iTvW
- TLSH T15025AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 963KB
- SHA256 99337fcc7e89418b6720075873b4d5e13c3079a602f4454012922a46c8d1f0df
- MD5 a98f3223e7d3d7a29823b76c4c71a52a
- SHA1 8414cf38d6eec73ea63a733f62c7f02f2cfe62f6
- SHA512 78785040cd058aec47e29ef4b2afb8eac7a6a6315c6b28994050e07cbe2ca3536fe6c9838beeef1ffc1ef85c2f2e49c8a7d758cf0111b8aa1ddf3facbaba5e75
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqBn:cuytJJ8y5iTvQ
- TLSH T142259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 963KB
- SHA256 a9cbc1037f1dc579a5c351793e583740f28cb0aa2287a853297905846f68454b
- MD5 511231123e29aa820a82e1daa58ddbe2
- SHA1 78d60e850885c6544e1d55bc23923aef1332623c
- SHA512 ca9f69cec944e3923e727f6a1b217569365c0afe43b241223e39a827d327f060d9f6b45aa091c8c2060c80b70fdc13183b556d395fbba1fc192ef16d0066b3e9
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqtx:cuytJJ8y5iTv2
- TLSH T10A25AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 963KB
- SHA256 a1416c277d8bc467a2724bfe4c9dabf4de051da43debece8a117ea84c343eea1
- MD5 aa6f9dd232ae752fd379dbfc22cfede0
- SHA1 67ffdbf6ccccb27f84e538cf373755ac174da6dc
- SHA512 a18aae348cc8b8ce42b7a92050b7819d1174d15e94ba80a820b247ecd57b384fa69095703aec9d56bf31f2ad62ffdba9e35094c686d5b87f2ce1017151d60d73
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqzA:cuytJJ8y5iTvt
- TLSH T188259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 963KB
- SHA256 f3587835af7eb5f8e593fa9509cfa337755a142bddad37c19ddb0fc0217af064
- MD5 8c3ac893e50d26b88d40496eff139423
- SHA1 c334f75cd3016ecabd772c7e26982f9000f44f6d
- SHA512 bb863007cdfe224596cde61bbec925927fa84950666736b40aa85b6c16c4e087bbaa2f7323e838744b34b54e2b19f890f68d73ea0b4c5807ee048901c3d37a80
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqE9Q:cuytJJ8y5iTv8
- TLSH T16025AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 963KB
- SHA256 cef4d757619058447e55ac7133042fb7c914d27c70ee8555f402c817bb3b95e2
- MD5 19975918af264aeb593475bb817b811d
- SHA1 acc9b3f5a2849fbf91cf2599b5f1b8b75fc436f8
- SHA512 edc35ff4025c6c1ca98a8a9ff27a1a766f73896a0c30437fedbbc7c37b065a521c38de6b6918e81551be98838bd0b87da640ea3aa09c223cc4646c61e701321a
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqd4:cuytJJ8y5iTvX
- TLSH T10325AE1277E444B2E162823489E19756EBB6FC620F21C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 963KB
- SHA256 bb50b51073507d8bc1fbc44c1651da8035f7f00b8bba8f1108c1e8192bc89faa
- MD5 be09255d501ff42d51786785d3f2d1c3
- SHA1 0a1ec349b311926608347a1b42922b283450d2f7
- SHA512 2f1c14949b4c720e50d5e299eb5febe6c6fd83eea115c0a7f74c6436d6a71ae3a2a344937065e5bbb980897e76f5fcaeaf31e1d8d0eb851dea974ebf04273434
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEq4u:cuytJJ8y5iTva
- TLSH T13A259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 963KB
- SHA256 1f2e47a75be9935f4b34ca3609cc1ae181c56ef2b5eaac9009feb7406208634f
- MD5 78678297c470f6532c5ba727dfca2d69
- SHA1 729b93a4e2ebb942866a4867334b5bc1927f2512
- SHA512 fdbe7ed94a355bb38d1184cb46b67f5ef0384feb14429b578a78d8b8a8ded77511a0d273262f59d2aacab6d01e3a9eecc7a029616f641b04fcfc07ad7bdfa070
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqZj:cuytJJ8y5iTv0
- TLSH T11525AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 963KB
- SHA256 97ffa902729d8c49cb57b0ae558539d7f17b652915a4490e727a3df36d0de4c8
- MD5 e6edda87ccbc6896439eb734b40f40be
- SHA1 96fd0fb29a1172f9a12b366734cfd1a62edeea3a
- SHA512 495340b2604dcc9d0867e6d65515d9e6d084ae95f6b157077e31bed6e32ef2abe9153a39bdf09c1b62f36142be04a89f5da2a4aa71057eb374ae24eae90c8666
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqAg:cuytJJ8y5iTv8
- TLSH T19925AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 963KB
- SHA256 8edb1d03281487dfbad40c65ea943316fa9ff9101804eb3493cda4ab9b0923ad
- MD5 a4025399e161725df57367cf019c4ca3
- SHA1 ef2360bab34e1a3ce792be7d40d668133cfb91a1
- SHA512 11afaab4d8ab12a4e05cdace63627e9b14cf2c79077c454425c59d306cba0df3467fbdb616f58f749282b3c98483e0cd669b850e9897000c39de54b14e7fe43c
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqvI:cuytJJ8y5iTvV
- TLSH T114259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 963KB
- SHA256 9fa124ce50dc8394c74279c7fe035320a98aff333df29af0e61df5aa7482c940
- MD5 8eae1e2be8eaad5eaa2a13719f37dd98
- SHA1 169e8a27dc254baee1620759821f63d139bb7fb4
- SHA512 f0314a3a26bd5c25a24197d7726b1afa0cdd696472f9a9d517077fefc41977bd6082f43707c2bf3788d9f6085f82e553da17e369cd00c63c24f5a0222a95427c
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqVo:cuytJJ8y5iTvD
- TLSH T10325AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 963KB
- SHA256 a7c2733d5b19ee79e6e51fe8cdb2aee5836b34e070714cfd65beee653c5ed24f
- MD5 3e6a2e13f251e583c73829dd4f816449
- SHA1 4f15d76a2999207a88d0d5e817921cfd4ef5cdcf
- SHA512 a45ecba0a5b6e3b9f186bf3e08c0c3603228189c6eed5cea25f3d4029ef769a99eee207ff1514682c0d7f9a8e22f31c5fb0e69c0cdaefc2722d18c6f7a5f21b1
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqG+:cuytJJ8y5iTvG
- TLSH T17825AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 963KB
- SHA256 025357b7780971d4013a81657caf9f9d8fd379afd640e61717fae80047846778
- MD5 890295867456274cf2bb1f71ad7f592d
- SHA1 69de98d1815221d739e055d38405ee57e84f7998
- SHA512 b127d21ca494ba172d2bf0d0d721fd4471f55510622f28def1ca81cb2e19a2c27591134d34bfaa519d22bf9e5475a7192f19ab3d31ae5bbb8ded4007e4b13ecb
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqGQ:cuytJJ8y5iTvC
- TLSH T1B1259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 6ab9ab4ed658b1516103758c5aa6f1dc2d2cbbe1dfdb079bab4f16cd0481283a
- MD5 dc417bae32b170a5329fca367b5f6cec
- SHA1 25383ac1f743ad19b9e0a8029dc2f95d7a3e1fa4
- SHA512 b8e735b48cc3de53218ad64ea82503ee86b7322e33dc63b07162ac0e619c2ec15de1c7955b2e653c05b7b909ed460f2116e13970cebfc292da05a3e71eda7240
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqXX:cuytJJ8y5iTvS
- TLSH T1E9259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 fbfb5ff2616ebf0fe6084df9d3ad915d46e730c15dad947895c59d94198fb886
- MD5 246d20217c0aa38ded3fcc4313f019a0
- SHA1 b1f7824ea7257395e22596a417cf03009ddc95cd
- SHA512 564a63e075b59b7db41c0d09a07fe7e3abda33347a893c0b2b6b5205ce1fbcd5e8e6109f480b95eb709a05982e5540cf4983fe3e310fab3506cc87c25ad9d16f
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqNL:cuytJJ8y5iTv8
- TLSH T1F225AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 a94b0ba1cf6f8acb1842ad649d913d457263d5250a2f4486029d926bf6e7f087
- MD5 3709c62b61a91382f0afdb48c3832d63
- SHA1 7f8265959c82d17e80ca765d05825dfc28a63078
- SHA512 8a6744cda132e49a9915be6652f8e4f526a8a7392988a2be7b75df10d2f88ccc1fbbb649fb77b20c0222953dc334c39c79c21d07c6aabf8b9675977615baee97
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqLM:cuytJJ8y5iTvN
- TLSH T12325AE1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 420d58612d9baf7232029c2f8d0052d5ed701553f31fb10e385bfdc2b2028141
- MD5 d0430e10823fdbc2aff9435c38f66dea
- SHA1 89a74c009ea0c513a98ea029466d6080d46e2b1f
- SHA512 eda9858abe910aa4da32fc26ed79ec360bc927b96c0e48a2502685fa85ff234c9bc639e4aa9f87a0c157a3b1daa504a92e58560c7e6dded64cb1c6d4de12dfb2
- SSDEEP 24576:nNlwnnl12y2UoAZJJNK/Ry5ARToMBMEqMh:cuytJJ8y5iTvn
- TLSH T118259E1277E444B6E162823489E19756EBB6FC620F20C7CF6354971E1F32BD1AE39722
- MD5 SHA1 SHA512 SSDEEP TLSH