Analysis
- max time kernel
95s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 16:27
Behavioral task
behavioral1
Sample
2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 918KB
- Sample260813-tyjcmsca92
- SHA256 7422733bbdd3a1d163d2a8d490dabfa66a6505c36c07d8ba411208ed611211c1
- MD5 d57f5106aab8407c047d49dd045eaf77
- SHA1 60efd384bf6874fd5856e9f030e46dcb6abad935
- SHA512 0d8e99e1477e634d739ea11b8f03e42808610c97c5534be3d86880e0276b5c81db609d94ebd7f206e688dfb880a499cd2f8c1b1005ebab52715b18a7698b9c2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjt:A3k03kHRJs
- TLSH T19415AE13EB9504E9D10AC1749ADA8A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 36 IoCs
resource yara_rule behavioral2/memory/1116-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b815-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002300000001c4f6-24.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b317-68.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1116-159-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5944-160-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb29-281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198f5-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-487.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-615.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-694.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-726.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-776.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-813.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-844.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-997.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-998.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1041.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1127.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1158.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1196.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1312.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1357.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1371.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b815-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x002300000001c4f6-24.dat aspack_v212_v242 behavioral2/files/0x000300000001b317-68.dat aspack_v212_v242 behavioral2/files/0x000400000001bb29-281.dat aspack_v212_v242 behavioral2/files/0x00040000000198f5-456.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-487.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-578.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-615.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-694.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-726.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-776.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-813.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-844.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-863.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-882.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-895.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-908.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-921.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-941.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-997.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-998.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1041.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1084.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1127.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1158.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1171.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1196.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1312.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1332.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1357.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1364.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1371.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5944 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1116 2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe 5944 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_d57f5106aab8407c047d49dd045eaf77_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1116
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 918KB
- SHA256 7422733bbdd3a1d163d2a8d490dabfa66a6505c36c07d8ba411208ed611211c1
- MD5 d57f5106aab8407c047d49dd045eaf77
- SHA1 60efd384bf6874fd5856e9f030e46dcb6abad935
- SHA512 0d8e99e1477e634d739ea11b8f03e42808610c97c5534be3d86880e0276b5c81db609d94ebd7f206e688dfb880a499cd2f8c1b1005ebab52715b18a7698b9c2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjt:A3k03kHRJs
- TLSH T19415AE13EB9504E9D10AC1749ADA8A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 84642dfa2daaa83e158a273e639c9683eea26e997d7cb0da0380f266f3305b37
- MD5 c53a9468fafc6386b6d698ba6c0a2715
- SHA1 89bdc945e554360ee1105fccb7092bb1b446d81a
- SHA512 bd8f037869aacb03d90cacfe757bdb108a1a25872e5666fa8083c089363e490cb4763e6e71876bece831cdc58aee975cf9403b27979fe5f433f0c9844b0c2869
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj50Le5ji0hmxNrM:A3k03kHRJ0Pji0Aj
- TLSH T152657C17F6A402B5D027C0B9C5D6966AFA7138861B3086CF1359C7283F63BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.6MB
- SHA256 f4f56916dded4ec2aa1d2f7afe4f03452a65e779dda3103157de0a870a1de6f8
- MD5 7799a9ee0920c972814ed9f328f25ab2
- SHA1 d152a4a414caaf80f7ced773d5cd22ffc711a2ee
- SHA512 c66c839a6d28a00f1103fc6b88c28a083641a3100340312a24e884da3a8a8fe7b99155af25a6e1aa996b34c4700a743797dc99272e64594ebcf240db07dff303
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjVVbqPb88hv/l+7:A3k03kHRJgVO88hXl+
- TLSH T1C3757C17F6A442B5D037C0B5C5D29A6AEE7238425B3086CB1349C7283F67BD1AB3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 933KB
- SHA256 f7b093bc06e4a690f39a5e14586fb6fdc8e58911de9625f7403aa8e883416e43
- MD5 dc267a67c3390f00ac701c77c5d1a384
- SHA1 3b40422112c7ca4f16db9b105f3b6244921af3b4
- SHA512 b5020d77c72afeb37114f06f45377fbce2b3fa6ad88501daeb73c7cba7df197df98597c80c731e73a761d880181a01c091ed78e475245c65a574d10790f81746
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjra:A3k03kHRJ
- TLSH T16E15AE13EB9504E9D10AC174AADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 942KB
- SHA256 27f30e52b7343444350ce17aa5cba482fae214b4dea4c542eb0490ce4a4247c1
- MD5 96429f7abd4207d359e9103fd1ad5ec1
- SHA1 748273dce2159420e294563e4e85156504388c80
- SHA512 e9317431e18df189954a640d5becea6100309aa6c1667f56840b06335047361b31f758bf0d87692aac77b4f86acdcfd5e5fcadc9e881c87b606aaf64b32d38b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjUN:A3k03kHRJ5
- TLSH T1C125AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 942KB
- SHA256 e6fc3e7691fe9823acbd5bb5dfaae5c98fe28f107c237e9befa7e654ce3dc02f
- MD5 d2c46741124cc9c07f1123261376db6c
- SHA1 81c13c567e15e585a332f536bde441639af631fe
- SHA512 8c5bb1861ab718412eb14892ef82e2c1b7c2ca881d9075281eea1fec02a2772da8faee7c29d9c698a83ee39cbbc8574daf36dbf669e40dba17e5cabaca6d72b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj8F:A3k03kHRJr
- TLSH T15425AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 942KB
- SHA256 73f45f47c5d48a688b22cf23b231e04bab0a50df11ba2e0f6c814c4d954761dd
- MD5 cd284d7658d25b61c2fe7671a7bb4b9d
- SHA1 07bd37ae2abc80bed09a605cbda29be13fc79e05
- SHA512 076ac6717d278216b736e9dcd2f12f4a452aeaa28ac6dbbb6e4235907fa3d7e4a8b7fcc65c6a01d9b026cdc4bb87f0e800aa78ac2d3712ff93a1d09b27874b69
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjpC:A3k03kHRJH
- TLSH T14A25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 942KB
- SHA256 59641de2c5b10c09677d0a761bf8070827da51897a0cd30642d6d1c04d969599
- MD5 9f2dfe8baba59889199c77a10b1e1d53
- SHA1 ae71dbaf7e50d46b2f9b4dc8dc7c8e226dfac74e
- SHA512 1fb6edeefc3669ad2317be912710c98efdefb47c1603ca76a1617e8f3aea2e73a75fd0e7896cd12be77d4ef75390cdce2ba8ecf5ee2a4c890f2fd46197dce5c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjKw:A3k03kHRJi
- TLSH T16B25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 942KB
- SHA256 7af520a55d332281affe33d88bf941b8e6d02f9df3a8d7a0f5463f3c54ccec57
- MD5 d5761bb8820ac7e565c65a6607c81da8
- SHA1 1b01c979e06eb23e0b59b5d477ff25523c0928ba
- SHA512 5433198c525d39abfc60dbab490c360ae5382391da9dacbb329aa67d5333661b11010415e49a8966743cdc57e68433a5966cae534d03c8490cfd040ac5e1cd6d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjRT:A3k03kHRJS
- TLSH T1E025AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 942KB
- SHA256 c665a7c6660c1e9392bcd5b93303ea6273055594c4326ccfe56ef4ebcb11d1e3
- MD5 ffc74a3f48ab2bd9e2fd59ad50976b65
- SHA1 4055dd2d962304b772defe1511972aedc05250ff
- SHA512 18d31da89d0da0095d89321e856877e3aab0c75b9fbf6b58d3539319da91de4c953b70f966609dd8208994e9e5e343bdb0b0731a7e2348029a27503659188be6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj/u:A3k03kHRJd
- TLSH T1C725AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 942KB
- SHA256 50ffc98be06e957e98955fa1ce4094fa33dee35d9f1a2742f1275046cd883406
- MD5 16aed573165b45ee871764f8d7fa5f02
- SHA1 8d6e017b06955d8052960d3f71c3777a52323cab
- SHA512 55b7eeefbf16eb2e43fcd843ec3026a0f0e28d06b53b1f6ba0acc16bddfd5dc7e46392ca8e910ec24413d0bd849772c52889b510b9584a2611c35460f69a3f56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjjb:A3k03kHRJs
- TLSH T1A525AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 942KB
- SHA256 fb2b6fedc1af861ec86eac4ed685f21a85a4c5243d89ce0eafbbd8f95d01c3da
- MD5 f42c112d071c41dc82c08e65fda1eb26
- SHA1 cd523cc201077218d9b7646fc917d5adcae3ec06
- SHA512 f009779fa9eaf3fbf669d694c6f4a98f51d3a572388e5862fe59649a4a086c6b6d01b048aaaabdb52de9d48636c0cee686fd7e626ca004877ae72f565c5a9271
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj3f:A3k03kHRJs
- TLSH T12225AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 942KB
- SHA256 83c7a6e6a1952ccf9a5b1167488e3891c939bdd26433ea5c3f1f89462a5101dc
- MD5 ca3218b8393e3e367e3081a705efb9ed
- SHA1 f272b69913eacb2fbdc04b389dafd6eefd53b88a
- SHA512 a4e47c964029e419ecbef02e8de646a49d6e018273ae577c33e2248d4e4324af97a9c1e40779cae007d81d516cc12cf769105cbf3d1302de4c47cf79040867d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjAK:A3k03kHRJc
- TLSH T1A325AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 942KB
- SHA256 821b4a4e301499617d3e056c1142c5a4ccfe9661bcf5f68ff42b7cede8163f4b
- MD5 7d05565e5bed6d4c10fdcadd8dd59442
- SHA1 ee24cdf2007b6b313e75409e578904714249b138
- SHA512 5cc5055dc0a00f989b4ed873750c32d2e5ae4e30540a84f4099c023474fb0dc8287423da763403242f5d1a7f76ee33285674fe956b3b2fc017e7e05026a9735d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj9k:A3k03kHRJl
- TLSH T1E425AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 942KB
- SHA256 f42a8bbfb7f7ff3693cbe4a803cb0d8b72d6ede40d376f96e2ed69786b710387
- MD5 f9760b142a6428425da7fe2c46a6ae08
- SHA1 47dbeb14b5475b438e1d04bbf5c90021327d9fd0
- SHA512 9fc7087e15f08d7eb4b14c0600e5f5dafc13d99dfa0fbd6757b608bb5191c3599f81228fa3214ab0b365787b35c05c365d470371d8f4e98e9d77c7c3ba7b6300
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwji0:A3k03kHRJY
- TLSH T1F725AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 942KB
- SHA256 007d7fff9eb4749dbf5165bae528329abb0da563c8373260bbffe959a1124732
- MD5 fe65dae8d10ff1d7e6905ac78fcffa76
- SHA1 67d76fa04c9e92e553701a45c03efcf126951d12
- SHA512 758d00e590ffbd2b5b86b2cd7efd97dcb9c56d96e374ba37552e92ae042273caae436912343722e53edd08b2a9377cd9e16b066330c397b313ef602aec659a0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjxg:A3k03kHRJ9
- TLSH T1F725AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 942KB
- SHA256 1ced4c57c2192411edd177322f27e4b5f048066a2f597580432e3053f773c6ee
- MD5 9bc2d15f5a4b22915ffd8ba789b83f9e
- SHA1 e0fa78299bbd4f6f157201266a3b80a482ef0eb3
- SHA512 9b4e9693872a5b7e762657d480b1cb0f8cfd6561d0346bc90cdc10916e70f28ceef9039a0e457007bb59135d6b6507d25214cee5c1b488597ad9060d03505e25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjYr:A3k03kHRJ/
- TLSH T17D25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 942KB
- SHA256 aebb833e244bf0eb8346da3302d6c3a107eceec8c00c208053a0a5ec82f5ad68
- MD5 b52b87be96dada4323fa8d488bc86b93
- SHA1 f058e170025c14c2fcab1577925ef9b5a3407cbf
- SHA512 434dd85c1b71ee96d99712d5d19a43476a688d2a711c5d2111bda6b385b0d54a95dd1a0ef8160bb95e46e863b281e06f3c53d65af7b02f8826ef5d897bb11cfb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj2n:A3k03kHRJ5
- TLSH T1BD25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 942KB
- SHA256 6f4e5021019cb1d0c5044a3968306f527239f2e6d468cc0f2816921650f44602
- MD5 26f4e82d086e17c0cf30f7b38e0dedd3
- SHA1 fed76ea861c6e7deb99bae78e50a69154678ae31
- SHA512 6532affbc6a54ae96d7be2b96d8a42de500a1bdf71039f86fc8e0ff69d3ca65a51ab737e04b0597f5b09634a9ea5fe7a2f3c14e7afd88a6d00985b18ec8e7ec6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjcx:A3k03kHRJX
- TLSH T15025AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 942KB
- SHA256 42f37a13d60094d6426eb4bd8073cc95b4b46815ed2a6323e63555d865a20d7b
- MD5 72a66952c6efc91bae9e5e6ceecaff3b
- SHA1 a146886938309cc7577c8a8537ca77c4e1e51297
- SHA512 9b686c599c97cb1d33bf415eb74d3640c8de5fa0a5924df35a0f6d6fd0346f9413a0e3b236970f5ad03db2834ae588ffb45342e3ffa6222723df9d87db6938da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjWA:A3k03kHRJY
- TLSH T12A25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 942KB
- SHA256 3bc0a7316d953cd0e5e4bbeb9e128e340265b7d07b011d03890f4d22a47eae21
- MD5 47a03fbbb37dc54862e6dfb492ebaf3c
- SHA1 6053bb1d2f86647a42e85b23ce09bc5d0ea67ef2
- SHA512 e19cddd455b8aca05b0043773631e3af05c204e15ce4b7a2cdd65e1414afc0497deacb20b30dec12082fca41388bb7faab566fd7bcfcfd058e32ec70dbcb25f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjP9Q:A3k03kHRJB
- TLSH T15125AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 942KB
- SHA256 6e1f647a67a53d963cf60db8fb1fcdeff5da4e26d57ae12042680ec0014fa159
- MD5 b9666c4a087a2822e07d172412d48a6c
- SHA1 c02580d04a91ea7ee205faaaa28d2d7073fbf530
- SHA512 16a2176ce6cb4cc8e94664995781701a5118b5408f167823b29bc1e6adb0083e796cc3813d355c6ba56292cca6e358ff9c820f46531b8cf37d85fd0cbcb74aee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjm4:A3k03kHRJm
- TLSH T19725AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 942KB
- SHA256 7c9452599b5f6d889c1d4fd9671cf5fc99dcc7fa62ff1a74e47634cc4201ac9a
- MD5 c2a9454453f16190327d9ea2647bdf43
- SHA1 762fdd504382bdb3d4e16ae8103f97daffda3b13
- SHA512 b3de79e0278e885852a6762b0019e6c48c1212e3cf78db30eecbca12d210b07f27524baf46d147025caf1d8a11904435f398ffcad0bc5e146b76128337783578
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj1u:A3k03kHRJ3
- TLSH T1E225AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 942KB
- SHA256 9f76ace5c289eccbcc2c4b6a526ca35509a68ec17b86e22419e3ce3e97321f03
- MD5 94d81603b325d24b9bd2c1bc0a276b5e
- SHA1 cbaa864a672b688fd0fde9c653c9a4bece30ea35
- SHA512 edcb231e176d15aa2ad9d7fe98f2106cb61d2e58b04559727066f501a264e8d62f606ee2b6f4b0915a74bd87e9874c42c726b08c2db34b864d340e1d44446250
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjoj:A3k03kHRJ5
- TLSH T16C25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 942KB
- SHA256 8161075eb47dc7056b451c650af7af0332daf5e9527db7d74dfd04eee9ab7b58
- MD5 ab87e43be05ac7d4141c1605355b0809
- SHA1 0b6ca491e9123a984b71d5940bc7e9f2120beefe
- SHA512 8ab61ae7429ad67ae621d0f4bc946b05226780de4efe06dba2919f37bb178ff754e675f097aed2366a303e38f82370881490f1e06ca30758adab874099e3eac1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjZg:A3k03kHRJN
- TLSH T17425AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 942KB
- SHA256 fa86ca0a91a33c270928567e6896e1c979ecf7e0df60021aa81bbffb36f97113
- MD5 f53e77e16dc95a88ca6d0560ac9b6a76
- SHA1 5be91e053b38c654a9ff0e5be64cf14b642f7fc2
- SHA512 48165e865721bc5c854f231b406990de32f7a6359d2f73db17c5eadbd66e3c67c7c79bc198b2acf22c5b17ef1882c91c9bf6b56fa3246cc1c08960e4f66c822d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjAI:A3k03kHRJE
- TLSH T17E25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 942KB
- SHA256 92cbef4e9c92e0db8af68b7395c5613f547058f9248a395ccf424fbd589bbeb6
- MD5 302935c5e637c2b8465396db1ae87f1a
- SHA1 6880bada22f44944deb6151ba486091fd4eeda37
- SHA512 23cf9bc4b9c87de007f080e6952a20f353b33f2c22bcd33eb6df207da8cafce189df880e09f61b57f39d1f9a8cab5be2dfa8eec2a89c5fea7299e44c92ddd4ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjCo:A3k03kHRJ2
- TLSH T16A25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 942KB
- SHA256 acf019b4ad986b1953aff5d3fa4d3d3780fec2a42c01efc163eb2b6570cc9cc7
- MD5 d1ac1cef8e8d58f8862ac2384e6fe725
- SHA1 15c0d6c1e745c4a7451adaef07e98d27853181d2
- SHA512 f03d573508f2448775ff21a49bb3c80f84e1434b42686e7f450c8972db4a8d3576edfa9c8be1f0fc0409222f32db2c5150e285315a2362f92c898ab544ec8e33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj5+:A3k03kHRJj
- TLSH T17125AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 942KB
- SHA256 4f814d37d057a8ba7b9eb14d52a0e63252955c8a682d2f3ab6f664f01b2ce7af
- MD5 5f4bdacb364956bd36d8495c6a7ab3ae
- SHA1 85aa5058858a62a3737093a4dd44fb365b2090df
- SHA512 546218beba90969b30445c74fba1364ab8196384d44f13aae2534f2402a2f4ecd1d99556118875568084094f94fe4155c20852fdca38ceebbf3b13932aa303ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjnQ:A3k03kHRJ3
- TLSH T12C25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 942KB
- SHA256 d689d9ab882252cf233cfb0bc14f7f2223c67f1a88a1cef8c76a078208354341
- MD5 ac8a5b5f19055f6db4c42090200ed5d0
- SHA1 608750e362cda7d1e78c73cfd44308932371e55a
- SHA512 bd7056a4ba015640dab82a1c79371f3001e3c545a6deef932f25d32eb0219d22f5d9d531296ab64b1c8e148f8728d66d6237d08e37e5ef0c8b8f490628d96e56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj8X:A3k03kHRJr
- TLSH T15225AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 942KB
- SHA256 58ede52da3e25891333108b2922278aba6a020f0fec136da854f6e5061f6744e
- MD5 a4bfde2264914b989be1e3c2326de734
- SHA1 9ae7a9e21984188e4c7134db0100974d6e8fc989
- SHA512 0fc8b3dd4a22d449c3924b3c45cc02b7398166633f2fd5642f60a5d8c330aaa2246b63ec895d4465df02c4fb994fd44e565b423f10b1bf157ebe906a7e9f9409
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwj6L:A3k03kHRJl
- TLSH T15525AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 942KB
- SHA256 afa990f8770d771f530f000e5ddea50f9af411956760bd3f2fa0ae903965dcd5
- MD5 aa57cb2392e1dcf1afc1bd30ab880797
- SHA1 360d0ada429c209df47959bb788940da56aee4d6
- SHA512 248b78fb4640184e53cd71419b587864f50739c7077516835b90ae3c78c354db5ba30beeb008241139474304acba4520b55b5eb743fbb69cbbe0f12bc9d9f5ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjeM:A3k03kHRJc
- TLSH T1DE25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 942KB
- SHA256 64a1e3f1d56d80f4781ae07b25f11d0aeaa1a2875a133c3245423c6f7a63c6cb
- MD5 185da0a758bb619deda880a2f45bf6e1
- SHA1 e49f5ebcc475d8f4017fbc24356ab10ff1f329af
- SHA512 c7786414005148194d15519bf477dc63e636476f35a0c5562649300ebb41f7501467596f5029e9c1c0339455ed27e73baae06714e96ee5f45e7fe551beae551d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyasEwjHh:A3k03kHRJW
- TLSH T15225AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH