Analysis
- max time kernel
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 00:59
Behavioral task
behavioral1
Sample
2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 862KB
- Sample260807-bca52avcnd
- SHA256 da1bcdbe434a3f4e11d76799ff213991df27669c32347945788a3d6ab199882a
- MD5 277d5ae12f25153518d087df07b636c8
- SHA1 3675ac095c8840c5246815ee4ec7e46709e5b35c
- SHA512 5805b8fe35df0b8780ac2d65d5c5fbde75d9e5868d78d2ba9a84838842aa3015c58104da1a87065755d023e2f1a611773e060d5948000656cc55ee6d74c34ff3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPF:A3k03kB56rF
- TLSH T178156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4216-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c96-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4216-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1116-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb3e-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198ec-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-654.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-759.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-839.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-974.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1395.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5e4-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c96-57.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-270.dat aspack_v212_v242 behavioral2/files/0x000400000001bb3e-451.dat aspack_v212_v242 behavioral2/files/0x00040000000198ec-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-573.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-616.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-654.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-759.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-839.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-949.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-974.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1097.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1134.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1172.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1180.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1211.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1320.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1339.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1364.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1371.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1392.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1393.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1395.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1116 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe - Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4216 2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe 1116 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_277d5ae12f25153518d087df07b636c8_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4216
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 da1bcdbe434a3f4e11d76799ff213991df27669c32347945788a3d6ab199882a
- MD5 277d5ae12f25153518d087df07b636c8
- SHA1 3675ac095c8840c5246815ee4ec7e46709e5b35c
- SHA512 5805b8fe35df0b8780ac2d65d5c5fbde75d9e5868d78d2ba9a84838842aa3015c58104da1a87065755d023e2f1a611773e060d5948000656cc55ee6d74c34ff3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPF:A3k03kB56rF
- TLSH T178156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 8cd6397308671ae1dc7f77343e7cb8bd5d899ed29e63b50421c5417c06aa9cc9
- MD5 4d2a89730185e416b452a29fd91ea84a
- SHA1 8a1d563d3df3b853c25121ea1db5d1c70d8c7046
- SHA512 f2a9c79326ce67b9a32b2e085a72d6e6b4bb296c88eb728b555af0c6a863ae04928747877416a6d39d6cce71257654c3002d17c8d0801b6094d2ad86fec63379
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPB0Le5ji0hmxNrM:A3k03kB56rBPji0Aj
- TLSH T14F655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 910KB
- SHA256 a6933bd27c51d919377def193fb2f984475d9714752bfb1e354f2dc5e4c705fe
- MD5 b9ede2f0c2da1ecd5706e1c131736644
- SHA1 7ec7e2494b1a4fb27cdf8970f75617e8696da699
- SHA512 c7ef593578e0cf72dc1cb741529a8edfc8a3af0b335cdff058b6639c659b36542f58bed595f39fdcdd718ab6bc9729ca11691a4b902a23e106aa4039bcc7d868
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPQb:A3k03kB56rQb
- TLSH T1EC157B03E6840FA9D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 886KB
- SHA256 191161b3bad52e9b824732a6c881e7501920d2e414efc55b36685b3ef5211974
- MD5 56ed322277f9cc06b96d7072d96f98c0
- SHA1 f23a53614d88869991b4154e038a39b3e8c18571
- SHA512 01fbe192530cb50a22472b88b669e0178cc7ef3c6db0c71a0eeb177492477d11d89d11e7e83c3c7f0805b3f401719c3e2a6b0742decc03ae832c1fc157c17481
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPC9:A3k03kB56rS
- TLSH T16C156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 886KB
- SHA256 44bd96aa845e7a65ec8c6f21ab7f671160a6b233dd52ba12e4e66cc8f8b57783
- MD5 0d29523766e3427412f3f2dde447a7c0
- SHA1 f74a883d842a08add7d35e65af2fad922f035473
- SHA512 2fed9fd8b96465d4dda03680d1c3c81ad7a4a87ed8ada387e2587a59ee3d101802cc6c0786139e43b6cb8187f257e5a82af5d946f64b33341a0862395677b238
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPCc:A3k03kB56r/
- TLSH T194156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 872b12b768fe7a8a9e76a955f18dc15c71331a1d4676acbfaef39f32d42274d6
- MD5 32b703d0141f986422a0505c65671610
- SHA1 926980fbd6dbf65b5b6f591b21e9cbc85b908939
- SHA512 f5976e0b934e406ef12734c0013dfb9f858613360669520495ceb3b2fdbf57c08fa518b61a34baad836bfe7fc04bee266aca529ae364a25f1f6ebc8762e7c12e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPLp:A3k03kB56rV
- TLSH T112156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 2e6a937eb6187bb7341809b60ff21d41016995243304a9fd52fbb3b44c9f79a0
- MD5 b0907bee5282ea0f018fa8f84b651abd
- SHA1 e3b0506b1211d4aa45e7e9205c8569a5774c7f57
- SHA512 e0639a5745d5e7fae114c99f211d3235096fcf6eb6ce47213f4bf8ad9f85f09b78b14a73f093932b59cb83682e9c9e20de7c573d27b939e504ef563ef2f9b1e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPcN:A3k03kB56ru
- TLSH T198156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 d834d4d937b5e10d60a819636378914b9f80a88f099952040571b591023c4010
- MD5 bc371a5d96a0ce496223412fbcbc127e
- SHA1 518927ddade25c10178daaee6c7b0c1bd732bd9b
- SHA512 1a163746e9ef381bc22ec3a8374d302273b5e8c2698d7de642d79227dded77302a0dd9bcf5178e316ee3723c4332f3b37087048ac4a1bd9ed10f4d34ee32d340
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPEF:A3k03kB56rs
- TLSH T1F5156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 2c88486088ed05875d234b4ce9f9bded73981039f618735089d1434ae8cc6b62
- MD5 46d2a0d20b5f05d95c7d5a6fd6eea40d
- SHA1 48f1d95ba07d00412b16c25959983cf1ee83f8e7
- SHA512 f7575acd41216768fa552612a9c4fd80ec8708089182bcb948bff085fd74aeadc316c2cd0aafc73986eda7dd9d36b941f10e6134fa316096aa069d2c8e6403ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPhC:A3k03kB56r4
- TLSH T151156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 74f3d42afbc7ab706e44c582b23efe79bf13cbd95940486a402fa8c7431551e5
- MD5 44d0fc9033fa77cdc76e8155afbaee1e
- SHA1 0054d9e8ab465ab60ed17c744691786e4b6b3ead
- SHA512 0e2a96dcd0bfa470af9d2e2442569259e7b52e5fa436e7a5f9654927a477e37ee59fde926a92e9ed7419f662ba6b25a91dd53221ae940d055c44c5c67ef3ba77
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPiw:A3k03kB56rV
- TLSH T10E156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 7c2d10f3a2d1c6c3be38b60a0736d24c26645f6c934342ff8fa1de5666099fd1
- MD5 d5a3491f9252ab01dd45fa4b0cf4c05c
- SHA1 cec5eacd5bbb665e710826c7b75711ed172aac5f
- SHA512 40fc503b9db3cbeb783fade10206f785d8552781b1aa7e53c908e83a443735c956bcec4e62a4f30017d7721d56035694a05a8d00f885cff1f9772d0b0064ca19
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPpT:A3k03kB56rJ
- TLSH T15C156A13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 9492ee25dac3d4197655f8e88e393f4972e460328915db62444a670b9822670b
- MD5 b6d30e1fb02eca8a6b40a66da95fe013
- SHA1 83b43b0667525a34b3ddba4601d6b93b6663dea8
- SHA512 b1e9462499794bee5d39ccd12ea26fefa4b05ebfa066125a5c84041f4937097103325d832a6e3bf4f0e406e1b2d5df4b523f2e850e1ce086e8c317ad5d46bc81
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPHu:A3k03kB56rO
- TLSH T1E9156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 66cb3e8acba4056f300301b76ce7e9eced20a113745ad4a5c38b52933670d312
- MD5 788f598a8e44121daec52feeb096386a
- SHA1 bec1b47f9c52920c2d39d18546eec56bc913db7e
- SHA512 fff40ce960fc3ad97a4bf24a079bd5099fa303f9bec3a9545c0d5d7c0f726b81551f05dc233d2829306a7864a7a4f87498cf315eee3f92dcdecb11f5a6ad7f7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPbb:A3k03kB56rP
- TLSH T1D3156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 5489fa61614190c086591556eba5ee435c10881919a80679d70509bfb7a760b6
- MD5 412e96bf6d02daa02a2cfe6392d53005
- SHA1 b35b8b899bb3b800ffc7b395e289e5e7dee2daf8
- SHA512 6d4679c82b040a5c5d6fc8a0b87ad66ac6e3c987bdf01c749b73b584c8a164d19e357bb7c2d600521778e247136c22e1e99770cfe4cf07631bc6d23f77d656da
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPvf:A3k03kB56rH
- TLSH T131156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 9fc82c06bcc7a0af8e2935e8662ac1489d753252e517b8c2d58c5163824af41b
- MD5 57fe077a7a765d210ddad4646d6804e6
- SHA1 398416ead2c5973582bbe3611ecc27c47e090d7d
- SHA512 5b15627a778d61d775a7e8a99ea8bef775c4018c88f13ff800af9bddb285886beddd04ee9a9082063563fa1bddd65b4dd9de0791fbc4e89e40508055515cc1d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaP4K:A3k03kB56rH
- TLSH T1B4156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 ca458a5ee741ac081c4622b7b7a540f18cb683cb32e01c0e3c18c5f4da077223
- MD5 fe5739ed02fbb25977edf2e09db692b3
- SHA1 26f490ba41b86f3f867aeaa87e167187259bf660
- SHA512 6f59501e8086a88bc680a3a43315d6d51c28e7127ae5dc1411b504370538b5995b1110091d242b22b71c67fe9217e522d4a70918d3c7afa943d0dc11c4551a2b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPlk:A3k03kB56ri
- TLSH T19F156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 380e007d5b839995034cc1117f6d548d3f3133ddcc903a8019a6a5af13036d1b
- MD5 41596429a0818ef38f4e35fd0317e7a1
- SHA1 7fed7de801c139a94b2b786d0782ed3f27f554ec
- SHA512 b857ddc3f621604bd79dff2c7878d6ef36df475e32438129745c90fa3de72389d8cb57181d4728ac62bbe3f2ea2b66d54160e3d1d1cb9392e3aff7af08ec451d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaP60:A3k03kB56rH
- TLSH T190156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 4c751d60a91bf741a5e272c70f06516e84880f6c42a46d6fbe5a765a34f2243a
- MD5 f6e306bfa76eb51bc7f108af3325c7dd
- SHA1 fcd5f534c3a51715a8136a43fc786a2299be5e7c
- SHA512 c783d01b4ab3c0d5c3309006273c3def6b2e42e778fc4286d4f6c4ecdb458b1b070006898f9e08acd33df2cb9b9b63e72e2958a82639db3654f691763580f531
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPpg:A3k03kB56r6
- TLSH T179156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 b000e68e8c93a60ea339b1429b9c80899ef31c922457a8efbfaaa21595f4e21b
- MD5 8ec8c032ea5b80209c219a0a1584df71
- SHA1 3f5e8d167a4e372fd9f511e67afff4f1f49b40f5
- SHA512 99364b395ecddf7293b8c342665383934e8cf96708a8d364238cc9b03a89d4e782afefbff7006354ac6bdbecc12e09217e1b3ebd1aa167e58a2bb08c5f7927ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPQr:A3k03kB56rE
- TLSH T12C156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 6eba2c460ba8f6da1ea0b83908dbca40dbcfb001d944d95da159d78208f50eae
- MD5 1ceef9792a2ffde1f29b5dfa9dc732b8
- SHA1 a07c9a99b55d5a61c49a93e099f79f40d77af3b2
- SHA512 d368fdb789b64e057731e2fd522ff06b14851ed9fbb1ee9eb21d1abe994668e0093ad42d9eb922ee7fbedfbef551a26d67cb0a41f00c293e20e80d5a8f2928a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPOn:A3k03kB56re
- TLSH T1E8156A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 c718177610b0f2a1715b56863e0dba4d85abbd9997c058e4be2462c6c3506ed3
- MD5 19f6321d2cb3a3a7de3783d8f833bee5
- SHA1 89b7c03a4de0746e41c0d48caf8278abdf677bd6
- SHA512 f140dc273eb6c67db8335b514958a011f8aae3b7c89ff9e005ce178f69c88d66b21c396c779c28661a14cda6092dad03c30a817e0b854d4a13d85a414dac7026
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPEx:A3k03kB56rE
- TLSH T155156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 9d4c68735ccda590860596d89ced7628bb7afee29df7d6bd4dc56a3c8e31c189
- MD5 6fc68f932948b4ead52e48e17ba825b7
- SHA1 ef87e1f9b50625eb0f4b1fe71293c345ba675c59
- SHA512 aa609ef3eb14a7b94b33aa215515c62490ef2144f4a8640c10aaebe810ae3d9e07f053e366027d2cec384d5692ae8949fd7121ccacf287c2aedcf5124d4b42df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPOA:A3k03kB56rv
- TLSH T130156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 27942c3bd238038410b317cea4a42de63f27321285905588a047ad9b09e17828
- MD5 4f850ac4a1c55d1138fadb52155f4300
- SHA1 f0ad1dcfca243ac75c10a45d54b9592ad89f2057
- SHA512 4c668ae64e48ab6ee4a77f456965c1fe872456d7bdef017494dfb158af2693953444ad515c7cc9e2e5a98cbc8f58770055fee3a068296cbd9d3c90cf1a902cb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPH9Q:A3k03kB56ri
- TLSH T111156A13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 525a678f06853ad17254425cbbe35f8861dc4d2aed5d5b4daac741285b1c1e9c
- MD5 73925c34ea4d903c18fd4c6dfbf76d32
- SHA1 2d68e59570a91425f05e8696c869b67504daa3be
- SHA512 396ae7d3662bca0b1d583a34af7e4fe1179d20199909a69cd18cce24fea35ed08c2d2589dc019d73ffdb72ad1d260de5000263101756a4206d7ea35b748f5abc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPO4:A3k03kB56rR
- TLSH T168156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 4260dac5f6faac9e1bdde5cff587212179e6ef230e3f966efb11886a656d4492
- MD5 ab1ee28e58f1ee0e40fc5ffef36fdf4e
- SHA1 c6f5f4e680e2cf1ad2edefdb2d9f993796019f56
- SHA512 b4e7ac25b767fd7009b2c9260dfca088c738b1cb7e4b6465920a221bcdf60ed76ca400bcc5d6868a8270e1957af5a0537238068a402224098f70e8d93982de6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPtu:A3k03kB56rs
- TLSH T119156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 0a0dcbad2f6cc4710728b65475bad781ba3b2c58d5f99580a4b0c5ace4010534
- MD5 31080dc37bb9ab216d1f4b3c6fe7e731
- SHA1 7e8580b64c71f6bf3dd394e6213d9ad667a67f3a
- SHA512 f37ec0c27679b9275133a32297f7c7bb9dc730252947613b2b32d41f41dec34b36ff0309270504dfc52ae181380390bf138f6c5b1fffdd8eca4e9f208c5fdc3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPgj:A3k03kB56ru
- TLSH T194156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 43a2653da9a6e41bc993edba7634da5450e61c1b7f730a57702689b206671e79
- MD5 07726b2a4eb8c00c57ae9ac9dcc3da30
- SHA1 75e36e71038e35c5d59c6e21ea41199a38fffce0
- SHA512 4fe04828d661c4a4ffde586b2ddb4000758f1f31a579a7324041b2d0ddc7bc8589c490b3bc10c76054d4dbfa837856cb1c28e43bae580314ef48cf82e1691169
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPRg:A3k03kB56ri
- TLSH T18D156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 45a34301dc3e8f275d4430548ab5a3299fdaffb2ba79d6b1f090f4f094945c43
- MD5 fd6080edd2f6e4b4753b7848f0f6ea4d
- SHA1 0504bdbb3320594e1ce46f13546ecd2b32f16ffe
- SHA512 73703ad78068c47103afb1069ecdf17b02723517499e7951eb0cdfd9d79de859c062434e64650d5185dc572137f0cd836a2da72923344d0d2bb647f885f80dbc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPII:A3k03kB56rT
- TLSH T152156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 f6c9aabefab62324c66056769c0074b655eb1233db470962268cfd13060653e2
- MD5 f36ee90cfb9d7957ff4d2e6453d6e41a
- SHA1 ea5777470187c4dccc1c8a246e71d62f91fe29e1
- SHA512 4df2ffb775aa32b04871d21d6625358a21ef6d7956f642ab4c49ef73f5629b91f456aa752f081ffd40c6c04d3c592d0a8af6b88bcce2b78fc5c5f740754eff8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPqo:A3k03kB56rt
- TLSH T1DD156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 4f754ffd19a3264db8a0dc34b909a3889977141c07d9b9ed2a6da8094bacd2a8
- MD5 2f37dd219524d19455ebd83de9118f20
- SHA1 e07b9b40299b895bfcb41e08e0ae47dc4602b405
- SHA512 528fdfa57a8a48c513fdffd89a11245011c22cffa516ef36955f6a2b72ad3bc05d1773711ad5fa208a3bb74520c3fca3b2a92aa48b1f8543753c388508f06b36
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPB+:A3k03kB56rI
- TLSH T11F156B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 cfe6ba59f26d12095b8c444fe32dcdb6f8f55c5a392d288aa48fde357d05292e
- MD5 73fc48b1af08432edfe23b5f267a381a
- SHA1 09c33bac2402e7e5d2bf4395c69740f7870f8d8c
- SHA512 4ef96be084efa86a5b7a76779038e41808a81ebf9522b1ca9a71d80057e5cc0faf006b85d80342695f725a6347cfc4820bbf4e29b6a80a0289279dfb43d5ca2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPPQ:A3k03kB56rI
- TLSH T1BF156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 60a5c20d99c68f1be7ac94f7fc7a3d3ac92c6cb663d424e9e68c99f0ca6a994b
- MD5 056f61abc6bf54606fa50d4862908202
- SHA1 8c0a7b58c1e9e11635adfb535fcef538a8f2f630
- SHA512 583548888a5753fc8586d169c68e09bae7d2475f1b38e019ab40d408ad3e2a5d2db8779ed5c090a6b9ca7afeb7001defba666c58c577b2362dfe391b3292f25f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPUX:A3k03kB56r4
- TLSH T1B6156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 b2e48964a200e1f4030426e516481404a29fc796d54e709d38510be14c5f64dc
- MD5 943010856b47a2729d8f8a2464d55655
- SHA1 4eb2b720e4edc4cd5fa62f6c88c2f91bc4316eca
- SHA512 0d5ce518eb9fc9d3b10809332ff5a38e88cbd3ea1bd539a18cf08612bbcd2de31e862558b798bc161ae07e5d449aa68c4333072ad6bcd65d1646eb58dca5704a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPyL:A3k03kB56rK
- TLSH T1FF156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 af090c6771c3290e443238ea310c5700cb8d53bd31e1879a9f6a9d6b0658b9d1
- MD5 260fb6d13bd93d5315f236b42ecd1164
- SHA1 35fd734f3c631303a9f32014f1fd7b9750f6e7db
- SHA512 565a512f0ac9d5b8ac2cfe13773b5f062f193d686c75350f2de01d6ce908a61818c98c10a3477f9389de3ef9a3a81385cac670ba234929db3a53784f18bf38f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPWM:A3k03kB56rH
- TLSH T1D9156A13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 6b0b4ea976f5402a7a85102a89ba1b1343ae6a87141ce6ed97a99d573dcf3722
- MD5 276896e7e58c5fbfe7f32883fbdedb63
- SHA1 674e068590b38884e0c337f4528a7e24d06b4406
- SHA512 9c3cdbeae75918e418fa188a6acce7042297e083b0e587b31b13a898a27e8296dd1867343b38a9df7c8df8e7b9fc3b8d0a09ed7e4af12389a50f51b2aed54d40
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPaPfh:A3k03kB56r5
- TLSH T194156B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH