Analysis
- max time kernel
102s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 19:09
Behavioral task
behavioral1
Sample
2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 933KB
- Sample260729-xt41bs1ake
- SHA256 cade2670e9b8efeb111c6c121dc31d505f8e4c5c87c32d59490e45b4fa6462d4
- MD5 f20427d43bdbd05978883531ffe60780
- SHA1 01fca790f65d57e83bf32a85b41ac4fff0fb20bc
- SHA512 505bc3584c76a9290ce649ef9d5e37ced0660b5290f26f913fe076eac5f0892da715db1e0836f03de178bfe8044d66b6c7b57d40802aef628a69876a99978778
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5/:A3k03kB56rT/
- TLSH T1EB157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral1/memory/2276-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c0000000241d8-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bbc-33.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2276-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4000-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-272.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002344a-441.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127d-490.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-509.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-595.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-627.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021280-706.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-731.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021284-762.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021285-787.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-824.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-855.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021288-874.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-887.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128a-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128b-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-934.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128e-953.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128d-984.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-1009.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021291-1052.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1083.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021292-1102.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021294-1140.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1166.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1179.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021297-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021299-1326.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x003500000001f2d5-1339.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1358.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-1377.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202c1-1454.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002422d-1611.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c0000000241d8-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-11.dat aspack_v212_v242 behavioral1/files/0x0003000000022bbc-33.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-272.dat aspack_v212_v242 behavioral1/files/0x000400000002344a-441.dat aspack_v212_v242 behavioral1/files/0x000300000002127d-490.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-509.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-595.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-627.dat aspack_v212_v242 behavioral1/files/0x0003000000021280-706.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-731.dat aspack_v212_v242 behavioral1/files/0x0002000000021284-762.dat aspack_v212_v242 behavioral1/files/0x0002000000021285-787.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-824.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-855.dat aspack_v212_v242 behavioral1/files/0x0002000000021288-874.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-887.dat aspack_v212_v242 behavioral1/files/0x000200000002128a-895.dat aspack_v212_v242 behavioral1/files/0x000200000002128b-909.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-934.dat aspack_v212_v242 behavioral1/files/0x000200000002128e-953.dat aspack_v212_v242 behavioral1/files/0x000300000002128d-984.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-1009.dat aspack_v212_v242 behavioral1/files/0x0002000000021291-1052.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1083.dat aspack_v212_v242 behavioral1/files/0x0003000000021292-1102.dat aspack_v212_v242 behavioral1/files/0x0002000000021294-1140.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1166.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1179.dat aspack_v212_v242 behavioral1/files/0x0002000000021297-1186.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1223.dat aspack_v212_v242 behavioral1/files/0x0002000000021299-1326.dat aspack_v212_v242 behavioral1/files/0x003500000001f2d5-1339.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1358.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-1377.dat aspack_v212_v242 behavioral1/files/0x00070000000202c1-1454.dat aspack_v212_v242 behavioral1/files/0x000700000002422d-1611.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4000 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2276 2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe 4000 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_f20427d43bdbd05978883531ffe60780_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2276
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 cade2670e9b8efeb111c6c121dc31d505f8e4c5c87c32d59490e45b4fa6462d4
- MD5 f20427d43bdbd05978883531ffe60780
- SHA1 01fca790f65d57e83bf32a85b41ac4fff0fb20bc
- SHA512 505bc3584c76a9290ce649ef9d5e37ced0660b5290f26f913fe076eac5f0892da715db1e0836f03de178bfe8044d66b6c7b57d40802aef628a69876a99978778
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5/:A3k03kB56rT/
- TLSH T1EB157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 962KB
- SHA256 954b0ba75c2c4a90bd4fac08cc3224b0ca3d141d7da0f18bc689e8bd7903fb98
- MD5 443ead6d059187da62b8c0e97265cbf5
- SHA1 94854acff9b2c2497e06cf126d89479db14d80d9
- SHA512 b5c45dc0fde1ed59191916fe362465fd7694d95750421b4dddde1f2bc84f6df461c215b9196e0033ccadc61e337773c92456fb510d2594e9a82da3485fb042fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5VP:A3k03kB56rTZ
- TLSH T136257B13E6850FA5D00F81749A958662EA777C425F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 1.0MB
- SHA256 150ae6fe5f84d950664cc033d37a1c5f8dac4b55dd425e28475a86dc9b6baabb
- MD5 b9ebae76b73aa07e9d75ff657c2e1bb1
- SHA1 a3cf328796b66f67f775622a73f9a8c244f96331
- SHA512 6c12e1775d0a93eb3a401e8cc153d4e681267ae397a6facf9dc152c03b1e2eb37871218620478f6029b79da69e05898cea22d64c496763be483b957aaa32f4b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5lTjE:A3k03kB56rTlw
- TLSH T18E356A03A6940FE8D10F81749A958662EB737C525F2093DF1358AE153F72BC06F3A6A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 e37cf68e38844f5b6ea96fea1805fac67f7b66bf9da463f7b4668fa7ad8fe7b1
- MD5 70c5ca9ff9dafb245152333b4bbc03b9
- SHA1 ce82e30942f18b894c90a9f923304dcbc1f07d44
- SHA512 fa035cdeba62cc0d5d5d6a56aa623200b03247b4689e758c424bd96b4c99396e076565b4fa0c4672089cc0f3749dc3c55580bd7e7c2feceae0e400e8ffc4417f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5r0Le5ji0hmxNrM:A3k03kB56rTrPji0Aj
- TLSH T10F655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 947KB
- SHA256 b779e202e742c61b9659d5cea89b1a5167bc1b147b40ced830ebd8840832147b
- MD5 7eb0a1fef4589b0bf49b82e375035f8c
- SHA1 f838f4c81a77f7b77ef6859ab7ddd8259fc56d11
- SHA512 5a8546ec7538b63508799133a3415f2aa67b65f30290f12ac8d04861c5279862b8270960e054b825d8ab4daad35613b2ee6c996b4d6a4687759ab6bfe4102e4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5ta:A3k03kB56rT
- TLSH T106257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 8e7298f855d4340dff633969984c69655b83bb04e163b745e15caaf8098f15ec
- MD5 48e986ec23ff7b71d3512a4e74a3fba4
- SHA1 8ffb870351a791212f107f3d65322afceff32d98
- SHA512 60dd87f513361e2803612b7c458d53e2f88428cc5aeb0fc53c1fcb5a9658e0bb216fdef0746e3bc4a34a6ef30d1c65b7958423381962536ffa8c4fceccfcd761
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+589:A3k03kB56rT4
- TLSH T193257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 a9c00ec24e3f03727496d72c593989651769830bffa2cf58488861244fc41ad6
- MD5 c2c33cb4bf2abb6be0e5e444bf0d6fc0
- SHA1 f0b3d740ddc98a81136a93c6ddf111d7f9df870f
- SHA512 5b77751b354c0b8c418becd65a0609400065d3eba9cc7cbddd2ae3c9bb071adb749d35883277014b6332a0222e4ccff1a73eae3f77679f0285ad2d5426ba14ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5kc:A3k03kB56rT5
- TLSH T187257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 71973806b063f9d72e141da2e4bd2b68cb7087eec019ef1ea4388c06e451c8be
- MD5 7c3ef42e6a67840ff929b5f9793986b4
- SHA1 f287a3279aeba289888f486f31c27b99b17b35ae
- SHA512 bec5606a5560fed013de66307daeb93013555c15791ccdc3b4954a9e8eed2a8454a5ceb0c62e9f9255f2ceb8181fc30b962c041dd3ce4cfb7d25ff9f5ab7e3eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+59p:A3k03kB56rT3
- TLSH T122258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 3e29f9a80fa1bd7f91ba9a79e5b8ee60dfd0cb2c1d3cb85342e2651a1e409117
- MD5 6cd01de17889879c9b31f21b2a87a2f1
- SHA1 b412b7d6768bdbaf0c05ea54f746c0594ab23c4f
- SHA512 8b85fe3e7548468a4a87ab51c1024c6a2a603fb35262d87712df927dc98a0fd17a63c4e11570906d4c83c1bc7064bda9b697c356fc8fcc3cf607b7f36d136e03
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5CN:A3k03kB56rTc
- TLSH T1C6258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 be01c149cecd03ec6534e917396d70569000f99d55d2ab5d32da8cbe28f8539f
- MD5 21c21d749edc86835aadd56f65fe6387
- SHA1 cdbbb3fffaff79815e0d130d65feb42b4d8b9023
- SHA512 113f684f42087c9af5eb14b764f8fdb80c31b1e4d11e4d0fc965cc11780f2b03670478d71778fb46f4d21a2d0f2f8c405e96be268b5860c9baa42e30fd7892e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5mF:A3k03kB56rTq
- TLSH T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 c7017d0e6f63b35851fb60c97d6b11933aff42248bab131da5342cf18379f9cb
- MD5 9acfd960fddc5b484d6c0297e5ba6a89
- SHA1 bf93cd18d439da07b692f3a51a82719260286834
- SHA512 321dbf61ab9c24f56b1a6729751e41e3096c99b013d754bb9d525e2d3020cb068f14abbf7481fc7af45a43a4c7ae7498cffccfa78d9ed1e66c276c1baa653192
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5zC:A3k03kB56rT+
- TLSH T153257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 6ba47e6f6390fa37887a197180f45bf61b8c657fa91415c328c6d2d79b562943
- MD5 8758d148ae8d51183b34c8522731f074
- SHA1 8213d7bc9ef73c313c649fd52573e368ee5eb4fa
- SHA512 933ee807f263c5ea2465996602269596eb5f7b3f6383be8cdf1e9e2afe3e7b3b30bfa5a50aaf34dd1918e76a1d3813131b63c91db95f59ac1961708598c07a76
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+58w:A3k03kB56rTL
- TLSH T106257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 897e711647a7364519740fb173bb4e0515f1a3225a2b168a072a1f558f293719
- MD5 2dcaf33706d21bff13c507fec487927c
- SHA1 9806895cbf1cac4f994fa2ca337e0eba0ec17798
- SHA512 d2ebc15c81895f5d7b78b696ddd4bf17cdd4fcbe2abe4b724fc997f2e8ebe5edc5876613a339da330c33536bbe6e14aa040026aa24d18ead9cab0b37dd76c77e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5zT:A3k03kB56rT3
- TLSH T167257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 51cafaf1b5b3fb35297912bdef4e86524f38ca6594b7d2143be7ae9cd6036807
- MD5 74e2819f3795fe599c788d0f88beb12a
- SHA1 0feda832bcb1678e0c37902fcf2b3a70cc48732f
- SHA512 2f62064b30953b9f79684850d13f7b9fef46870343bdd43586f6e245c49462f1ef75fca8f4ddbf325f4877c99ae118c25dea225b414a23570b05a5288a4a65a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Fu:A3k03kB56rT4
- TLSH T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 9d191b2e3833026fa84caabffa7c96592eb375cf47e98fa4726be08b0bb59045
- MD5 973fed920df4b7b35c97ffe3719bb928
- SHA1 bf03f47011709957e11dffd59b047cdc6a165c79
- SHA512 a4f6dae946d3069ea33703c88341f8b06baddd0e46097cdd69449561b1e20fef7f492192e7abb0bb5343dfcb3c2c2938d9172fc201862c4d1b0795ee948ad997
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Nb:A3k03kB56rTh
- TLSH T1A9257B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 92af3308f4cb1c285a84a5fce7ccb4e1d4cb6832ead6127287a29bae1534517b
- MD5 57558c34adc5af600eea2f818b3ef162
- SHA1 4538a0ceb8fce9eff095b805a7b4674059eaafce
- SHA512 44d8502e2044bb4c70c5ddbb1d839be1cbbbb5be8cc819b13120688eb16bc2eda35c0b3bfc60d579929154c96c402f32f13c9f9ea8afd204d198f19cfd5999e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+59f:A3k03kB56rTh
- TLSH T107257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 b780cb27ab4605080a7243f33dad0da5c142d6267b0e35c3dc4516f4251b1ad2
- MD5 05f1d234019816d98e05cca5be3a1aee
- SHA1 49948583599d9403253eab75141739f1ed5b5894
- SHA512 50c00e0ebc7400a7d50f43a16f898db43a3f15c8d7083ef723deb10a7416d20dc8aadde5f5de9f75f2e711e7fce4b830b2ffa91a88cf914198e4a8bac48d5f71
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5mK:A3k03kB56rT5
- TLSH T1B7257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 b729e50dc8f4f02b32acd69ec3ffb2a86d36708bb1be43da1c6b3e79dbef4e30
- MD5 f6d44f1fe04ae5c8d44b5d3bec631a04
- SHA1 f5c76d72fc3bae79fb8d1e1cecfb94507d8bfc30
- SHA512 d8ce64cb21c20a39d4c25ecd43ff860778ac6e214f4d341f11b90f310ae43c71d259cb14744f1787e37caded154a4f6296ec86e3f6c8c1729b46336cd6d71802
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Tk:A3k03kB56rTw
- TLSH T12B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 366aa860af3d15d360d896e8293500ebdc402eb39c73566f89d3e4f508c5bacf
- MD5 3ed87d3470505180112139da9c51e9f2
- SHA1 ca87b64667bf3db68b1b68c75902b5481813f1db
- SHA512 b2dc93f70f9e6f1aaa625ff9fb4ab3ca2ac5e54b265f3ab89c4fd013844c372b1f2a319758dc85b05a554b8bba7aa619621556e707b5f229a32ef9434fe4abb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5k0:A3k03kB56rTZ
- TLSH T16B257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 b7f1a19d21ba4fa0aae949e9b13e7a828b8746e3947090118384d488c78f30d3
- MD5 66a549895d2331cc4639a85594bfd3f2
- SHA1 a14e88f3d80028180a8a78ea6d179bcf4ad5aef5
- SHA512 1c7ee2ec802d43e8d34e89ce5f66484667fa44c6b1aaf56fa195ee92b6572423d64866b57ce3d8f09fd9c4fb1e2b1d8e7631918ddff5745c69558f1d2267a94f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5fg:A3k03kB56rTI
- TLSH T165257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 4171290caf42090763da2e75963de8d9978d38b4cbe84003e8214d08b274311f
- MD5 043dfd921f6438af2fd685ad4097a102
- SHA1 6b499121c3092ecc0afe47dbf92e85ce928bc7ea
- SHA512 bd6bb4b85592dee5fdd7609fce8e33ca19dd40709a1ea507e864a85cd318244dd8ca1a6aa19ca3fa447d1d42fc38764c232b164ae6e55b90fe08dea80a46b107
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5yr:A3k03kB56rTy
- TLSH T155258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 ad96896417d43ba3b5a66f6a1affb8f1faa6f84855faf76d6d94bdaa20092173
- MD5 080b3b6531c772a88389fb76eca9f37a
- SHA1 b42b76b73e73baa28a54b87cbd7ce9f4ea2e1a4c
- SHA512 07cd9b0c930ef84bbdfd4f24d680f5eb9318d5be4e0280059b59fe863769368ead8346972024afe09934875e797749c0f7305d740b00ed4c97e32542838e2e15
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Qn:A3k03kB56rTk
- TLSH T1A3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 8d27c5c6864430eaa84a96863fe3ee7a68db6ed0bff396c87520d73d78b86f77
- MD5 a86e894fb1cb3f9494a11143c5add03a
- SHA1 32302a1a43e89994fb2e7ff50891a7e605cc40d0
- SHA512 c7a673ef4300126c8588650d58aff134a6fd153a5e9e27eccd36b8cd09b73a92843287445ad4c2fab15889ec58bd92995f985678fd74ceee081ed7b4226360e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5ux:A3k03kB56rTC
- TLSH T12B258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 40af1791c01762396246a7ac6d7a322b7fa54673de7de987353358abfe7876c5
- MD5 b57b6a97504b8c20f328de6155e9c032
- SHA1 88a4d7f8325d96bca79b13e9e29757b3ce482822
- SHA512 27bef6e6edd83f729e80f4a2bd18b87ce5563632390c6a0bbf400942467ca2739f6e58498db14e5115c5c8569f1ef2b3bb3559bbdb1aba71d89082715fe0e381
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5IA:A3k03kB56rTh
- TLSH T190257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 a8b34ea10dd834d61f675da29e9f860187c17dc0f0c11da34feb6c4f8aaa080b
- MD5 34eaebae30a784676734e52de6a90050
- SHA1 63f3f04df25ce941d42ef2f68d9ffe262bda9283
- SHA512 b7065b0deeed8f1fb7c9545078eae1eb8eee499075dd72db7ad29e191f5438fbe9960585c190ace4b0fca60807773eb7b035f8b50ec4472c92f76a075c43aa0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5h9Q:A3k03kB56rTY
- TLSH T1A2257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 84cdf5c5bc1eb1f46c494bbd566bbc49079fa6d965292b0e46900ac36cafb0c5
- MD5 90927c3b56754c8e0ecdf97f490c22b2
- SHA1 06f10b875dae36a9e68a0c29d26866bfc8489523
- SHA512 88ad8a7a5361924de3ca0c35228eacafffbdd38124bfd035ada60b9ffbfe826a7963b848f5a2403508d983e2cc662004d11888c511a5bc2a3471b20a276f7d26
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5U4:A3k03kB56rTj
- TLSH T1DC257B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 9d3968ac1952705ff162f407813a902d71cfc521c0e424ebc4e6dc94e23d9c80
- MD5 2714a39da46119791140842047d51b21
- SHA1 b4b68a577d3a42f13e480ece713225f8d29183e5
- SHA512 201a861a3092ce79b419bfc219ba6af0f6a756c751ae99a89e89d774a8cb525a898093b8b24b0f392fd0e8c2c99376006872ff8365dde9c25ef53a23d3ff1240
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5/u:A3k03kB56rTG
- TLSH T1EB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 911c1c607650a36b6637a0b51e7b2021c6b6d308733d6202bb417f0a0a9c23d6
- MD5 c41bf8dc4f591027abd0773906cd52a1
- SHA1 f42fe3025fc0ac0a74a57357d2daf1f24cd931b7
- SHA512 39eec317214b2c27b4cfe71786c7fd9a244fab2532bdd1abe15d6046f40865b646846c4de40f7289242cc7f10161e5b8143a948669e3cbe25c5457fdad64aa96
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5aj:A3k03kB56rT4
- TLSH T155257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 0ec9ad6acc2296a00e536a014571c39bc0a76150af88316921e10782543739dd
- MD5 dfaeab8fec4fe14379c5fc1d2744aa90
- SHA1 f75b9920d4d5378287f82754ef6176b7b7783b45
- SHA512 f2318f01a5916cf6027a7299401a1356c72dfc2d51f958911d95affc20a514cb89658e45dfbbc07a5e512e35f01fb2e17caf5a0b795b122042f379485926154b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Hg:A3k03kB56rTA
- TLSH T1B3258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 f4b5f1d22a6116e467cb874ab1cc360d1af3bc2820a06bf7a5a75c0c4db9d88e
- MD5 b2138027076b365d2360c04438b76f92
- SHA1 f16a827124ead3edfbbd300dc50db9bfeb74b6c9
- SHA512 efddc9e1e998ff052b33e989715056505d2e90d4d86628058c4fedc3cefdfcc218a16083e92790b49344079b826e51fe07f31d9d856eefe7478f10535df34db9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5aI:A3k03kB56rTB
- TLSH T117257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 6c6d2d6d9119a267ef74ea4ef0dabda7b20e05bf2e8e7a52ab9146c6a26f22f9
- MD5 7a8ae0245290680555a97e61ec4961d3
- SHA1 bb0dbeec22d707d0a1adccfc8883a9088c8166b0
- SHA512 6cf3b141da92a53bea857332eb95050a6803ec24ff554d9736675821193d12bb8dcf25d10733a0d3a02d239dec7e703a1aec147e32fa180426367d883e5030f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Yo:A3k03kB56rTf
- TLSH T119257B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 005e07e78101ac31e49f7248681481fdee549bc3159ac57a8a0c48a1bf3ef2f4
- MD5 9305f922195a6b86a680dc5c670a7dfe
- SHA1 204ec317ef5e11d3a112c44c659b42e39f0beb62
- SHA512 c23375ec21b983d8ee0a4add46c1857ac96ced0332b792c99bad81d40b48d1f9df887a23db8cb8ef74f4d31ef91cc00944daf61a8bc06ee011e2a040e4357af5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5r+:A3k03kB56rTq
- TLSH T108257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 996a13392367dcdb19e1e65ac156647e515771e3208289f4519155063e881d4a
- MD5 6817be65da616f04214cdf62d0219364
- SHA1 48741d384c35e65c4633c8a128a32a27b8d41ef3
- SHA512 fe506a12d04f596ddd6e5e123cad1b7cfc1b9d5e44ac1fbb11c670aa8d4af92316473de338328e88cd98f341d9f4517ba8d2431a1f6a9b87705513ed473aad32
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5hQ:A3k03kB56rTu
- TLSH T1E7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 d3862d3d672e1feba693c8034f5887c0cd16c5b7b15b8e47bbc15b8fbb3ba652
- MD5 311a1876a78ce06c67aec9a57692e37a
- SHA1 a97f786858df0696b263228687624d4ef3f115c5
- SHA512 6ddf62c9981578af7a955e51460b7546816c7bda07a860817d8a3540525037495a45fff3f01738fff27f7b8b12fb9c139329b85ab0ab9b2ea99242fbb311d8f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5mX:A3k03kB56rTu
- TLSH T186257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 b454bc46abecb34baf91f59d27d950afb7faeb9b6e684b4a43478a77be6a4600
- MD5 667046b0ad714dd0a7055c100478e520
- SHA1 11daf62304e330e8efb271778167d7a35c0ca2e0
- SHA512 f37a79b8f02f521e573c8320ee864947f6064882cbe39151cb16bca1e7bcb405f0af6ac1eac95c755a0aa16a645e57f5bd2375bf92ab45b21de2df5470e8004c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5gL:A3k03kB56rTA
- TLSH T1AC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 7d1f6ccc2cae95fe1ccd21f8470ed2e8b787fee970070b40f19b3d10b3dc2a90
- MD5 da62c160582435a84fbafacb938853ff
- SHA1 b351a24dc611e8261c7955d14ed01a0b7b0b8a99
- SHA512 0732c2a3dd959dafc4487dd65f03bbf0e2e33c8bacb94db062c6cc72e67db4ea3f0e76cc1f87bdc5a997a2dd26e0429c4d0a642d48d1cabac99adf1ac96f49f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5MM:A3k03kB56rTR
- TLSH T12D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 3fa93f0dfe05d0d0ecf6a8fb0e53a769dd2ba3c5d877e7a8154e8e0da08f21fc
- MD5 bf54a6acf7b247c89dc7124e5519fa52
- SHA1 92709e65cb3d2086a9109368816ac64e5d29a159
- SHA512 04aac460b38946f67418332ed5c8087dec7fd96dbeb03d3480623e876c5696589187c72159568b26751b77653543737f402dff0369314ba4dab8b57e4131de1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00m+5Vh:A3k03kB56rTj
- TLSH T150257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH