Analysis
- max time kernel
114s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 05:36
Behavioral task
behavioral1
Sample
2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 862KB
- Sample260629-gaptasdz91
- SHA256 dd42020020ccffa17509729a1173edfc6958fc1dab810a159cc325ceee8e22ed
- MD5 813f5b846eee484dad3f580c24aff849
- SHA1 c3fe62eaa28035eecd9629f95c8c1b87944e3455
- SHA512 b24aef1fe478f62eda09277392b1d73091dc91123b0a534fc24a2d9cf25507853bdf5cb6e64c89489203be2b81dc27915765025b8732611b18a3cae009288295
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXF:A3k03kB56ru
- TLSH T170156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/5140-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5d1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5d4-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5140-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5012-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b302-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c79-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983c-225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-427.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a000000018a4c-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-604.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-726.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-745.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1402.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5d1-5.dat aspack_v212_v242 behavioral2/files/0x000c00000001c5d4-13.dat aspack_v212_v242 behavioral2/files/0x000200000001b302-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c79-60.dat aspack_v212_v242 behavioral2/files/0x000400000001983c-225.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-263.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-427.dat aspack_v212_v242 behavioral2/files/0x001a000000018a4c-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-525.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-604.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-726.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-745.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-858.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1009.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1084.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1134.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1153.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1222.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1325.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1344.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1377.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1385.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1401.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1402.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5012 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe - Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5140 2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe 5012 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_813f5b846eee484dad3f580c24aff849_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5140
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 dd42020020ccffa17509729a1173edfc6958fc1dab810a159cc325ceee8e22ed
- MD5 813f5b846eee484dad3f580c24aff849
- SHA1 c3fe62eaa28035eecd9629f95c8c1b87944e3455
- SHA512 b24aef1fe478f62eda09277392b1d73091dc91123b0a534fc24a2d9cf25507853bdf5cb6e64c89489203be2b81dc27915765025b8732611b18a3cae009288295
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXF:A3k03kB56ru
- TLSH T170156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.4MB
- SHA256 dfd18846e01f8637058e4fbb23407d52087542925933e238d36cd8386a63df64
- MD5 6c15683552fbb5479e163a7494a7d573
- SHA1 d14527fe2bd27b34456b5142086ce64e9547ac80
- SHA512 c3d4b29e8a612aeba8b01bc7890f1983a31ba8dd3a08fec8ec8a701c14c613d3c09acb745e602abc675d3b2090743b638d932e6478f868da570907c1161ee915
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXB0Le5ji0hmxNrM:A3k03kB56rePji0Aj
- TLSH T175655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 877KB
- SHA256 4b4172a0bf306af021c6af10ff1afcb7334138518b7349739d4e4d586dde48d3
- MD5 40d7765ac5f4d7b8f0990286b310c51a
- SHA1 6b688da5e7c39b1972136ede41510d50858f82e0
- SHA512 e72ab099c7cf3b89f069a4450ad277d3f94a1c413b94f9f194c9ed1faf84d8568bbf8d57713d6da9a33e54e9add473b884d09b17b1ca9febdbac68542419cb4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXDa:A3k03kB56r
- TLSH T152156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 910KB
- SHA256 acc75c0fe0ee765dc018e4873622ea05a6cefa414c852b74387f652ea2574551
- MD5 93e7b3591f5d3afdba7bbe3f124191bc
- SHA1 8abb9f689b2e714328bd26ef4967c884da6914b4
- SHA512 12970600415ff9312e6e8cf605b71454758f028645000c03e6110810b932891c2c72ea7d52cc080fd809d07d003401f17779f7ddd19a33ea99750d19598a6d66
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXQb:A3k03kB56rTb
- TLSH T169157B03E6840FA9D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 886KB
- SHA256 522ca3ba6b5852b4d27f1fe6f8dc52e891d54d68a72a22264e4319ca441b3216
- MD5 3db159708119b32af5dbe264b491f823
- SHA1 cbe95d865e9860502092997247ed9bcf3b9840d7
- SHA512 44cc2adc1c250049362a8cc636a1bf7df100d6f851b6c086a4602b221c317c8946106122cfa35377119197204033d9360693680f3f47063bf3cf191e730fd855
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXi6:A3k03kB56rI
- TLSH T1E6156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 886KB
- SHA256 a02511898549fcea6d29c113caaea3916874cfb27a08f25cf727c96ee74c8306
- MD5 09f9bfe27fd2ac17baab75defe1b8123
- SHA1 bdd724668d6b729e3f39ce9f60b97b332f2f5c63
- SHA512 69c708ceaf7b672a0b7e2bcf9f0905b9365ccd18072e1ba1d52c761aa83479bea9e14aa57f2596123f4e80751d7c093aad615d5c3193ab490d6ba65dfda735bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXgf:A3k03kB56rt
- TLSH T1D7157B13E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 886KB
- SHA256 99f1774bd7b9a8916feda3d75bd6e6386178685f556d14c885637e7c5f3426c9
- MD5 aa1dd2cf1403e1386354e55a13b79f9c
- SHA1 19d93260393012c895fa41ee91b22c53fb3a9d6e
- SHA512 f597b19ea33fd7d2abcab56012bf626c5584ea8eb8bdeae9e32967346f60a37d7f796eb634428085261435ca84017602d646d4e0a4548ad15a1818b9a7741955
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZX6o:A3k03kB56rY
- TLSH T139157A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 886KB
- SHA256 2c7786b6980e63bccfd1bc42b8f53264859d78adec6fcff52900f318e5378cce
- MD5 6d9c0d48b95c13459e349410b4c8f56d
- SHA1 746327e6abdba3c1a2f17b489fec91a549104b35
- SHA512 f3a76cbb8aaddb989aa6d03d1cb008504cfc52a5c20cd8b86a8ab7a3cee54883318ce08260f701d1153dc1d2c87b826ce6be117742571ff29db15524878ec933
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXOu:A3k03kB56rq
- TLSH T145157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 886KB
- SHA256 31f9cb17d988d024f29b55b620c983f88332e6e9b121cd577a9eed2162f0a0d6
- MD5 624a62dcc4ea6247c5f5566eb0182700
- SHA1 32fe484c800066f6e4bb44f6071de173687f2439
- SHA512 28c572e7a9f0ea8f348befea8ca025cf4acd1da33b12e5a7b0b91625d2ef363f9e9e7c873643996abfe11a1b6e58b591f225d60bf4a19879aa8bd5e6d9832716
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXC9:A3k03kB56rL
- TLSH T138156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 886KB
- SHA256 50f338b5f38477c3c413e53ee2a2ce13d84869fbbade6e11b795c1c3d80c2bc3
- MD5 2b3f0ff7b5c8e80f9dbc1a31069da6e9
- SHA1 7003a5e1862d8faf083da2313116f742f7b99865
- SHA512 3080846cfc3a02df6ebbc775a6b883c404abf6efcfd523fc3ce65331676da9190bb0df9a5bcde691abca3e14797b01af4ad2df0911397623e5e0be23361b4317
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXCc:A3k03kB56rC
- TLSH T131157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 0088c668697a95ef5e9e7da75b2398a8e6a2de460a4fdfe3ea42a179fb6fd516
- MD5 055795e4d51df59b8faee0448513c205
- SHA1 bd0c02d89fd100f91219297ec337b2f107455762
- SHA512 717cabda1f217ed554f7c82c38dde09de14fb930b0a10e08b0f6d6904f73a80a892d738aec598ccb06375abde406c7176f63f35894cab6d2b076b8077f7bf85c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXLp:A3k03kB56ro
- TLSH T1D3156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 bfcfa2d08df0ec4b074edee1e996e968731003a658d4b80f9829eaad1311c1a2
- MD5 752fb587ae2b70cd6836c0d82fc9f490
- SHA1 be2a3bd1d7837aab03f9bb90af070084a2d2fd17
- SHA512 f41b300d29c8a9423b9f5133ef6ce5c6cf15c396bb159850d74ec3c4f6f1c1ddd95b90449cfeb496361dac56c9348a01d705d1f7e973baff5d96f1627717a015
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXcN:A3k03kB56r3
- TLSH T116157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 9848d133ee3aae9b96281fa261e6a61c2bbae9b2822b5b220978007a60c3be8a
- MD5 557f61d96599f13fc69ed53fd4180915
- SHA1 6bcbf10fed35e2ab5ef33769d2647b5d8eecafc6
- SHA512 72e48d4423d0c1f64b255296b1ae0024be3ca2b560b203ac2ad4678d0c55ad85ad40e7f28a89e8e27b718a828db4b37405d2b794a8363eb42a9dba4dcd949bbe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXEF:A3k03kB56rx
- TLSH T1FF156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 72f620305970568c711c5191850919a1d77280561ddeb618fe184baabad4df60
- MD5 0d6ba69b8dfbceb7e5dac2e33ee2a6ca
- SHA1 2e5d1d0cd66032aecc957171711a470baea35919
- SHA512 17ad5bef91ce7a0029be100f7a39c9af458cee15cd6cd1a4f1bfcb09df2098789bd6a3b0bcb32120bf808fb2dd8428585a08c0fd8349bed024ffef51681fa85a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXhC:A3k03kB56rd
- TLSH T195156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 0511209486977b064e1fe9cb07a08502dc7f07aa7929f82f3c27c61884133cb2
- MD5 af611d9e91b2921fc897eb51e2089079
- SHA1 897bce83c70a97576c8919f21ad7d4ceb9a047b2
- SHA512 29660687373dd1e8e6a9aee19d536b533522266adb903a2efbde7d3956e3b01fef1ac61b091f7676844cbf9b25ac12724775e02a050241afefdda695e7872ff2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXiw:A3k03kB56rg
- TLSH T1F0156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 45853cd6f0b2565dc22bd77fbc4760371736dfd02779e847e7a21ff7ecad5ae3
- MD5 6e8ea269dcd99f0d018f0e592349b687
- SHA1 64e1c3ebe515420683002c50e70411c76c7c6a49
- SHA512 ad021ef061ab3273cedf9920226e6ff9f5ff175b25a1b846b297f45e940cfc4f58c38bb541c38a12faed63a8fd19400cc74b64c5d29ef6c05277d466331623a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXpT:A3k03kB56r4
- TLSH T115156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 f5dbc72cd713755100f6854ae66d22ab58b67091f2d8c2721aafc328c78fde58
- MD5 a7460f6792e2955d1634ff5029f4794f
- SHA1 cd785fbe53a01c68da6ad2491b1c10cf1922958a
- SHA512 1b8f13b53ecb7a77985539ef8faec4dda8dc2d6f0cbc5f37df7b4e518b41b83f8d55430dcfec6f255aa9eadbf66de9d07a9ff5f6fe06c9940b3d8070724ffff6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXHu:A3k03kB56rH
- TLSH T1D5156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 1455f367d6fab1cb388ae6fc89467b71dfe0ac9b9b5d2436f2c7d68ce126968d
- MD5 5210fb6ebedeba09a8c5672d2c6be012
- SHA1 ba6c91295598d1e614fe2e7deadc253ec4020eb4
- SHA512 02f2637e1d1346b8b22f4c37872e32e228f77f822518cdadb412b402e40cdc8353ac929e2631faaf98923eb1ba48c9518b49a45214b1014d59b14d67ef8ee81d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXbb:A3k03kB56r+
- TLSH T189156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 0e095fe8f1c850f105eed2d59679f3ceff549cc827d58e4715ebcabec5d359a4
- MD5 bca80cc52aac9ad87a6f584386b15df9
- SHA1 b9c23da590cd182597a234f453f93eea8281d014
- SHA512 fb033653348a32a926a3a550ee7b31b781471475aafd6d93064563f30e588c06421898f2b27e3af593ef1aa131a16b5f8a7b7a51b765a582a2208ee7df8a0c97
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXvf:A3k03kB56re
- TLSH T118156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 101388599aa91c3128f29cb1d7b63b70728bdb962e735fdc691e8d384fa746c6
- MD5 da881c2a3945ccec8cea51d838def461
- SHA1 257575ebb36bd524e2bcb16717db190e1bd947fa
- SHA512 7564f9c2b0f7e8352e41b10cf88b3b4ab347e23c87c3b119596c6e32d6dcb97c5efa9d5a25efd6ec23cb57c0ffaff4013f176b468d499dc897fe6ec4c0919db0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZX4K:A3k03kB56r+
- TLSH T14B156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 2a93087a8947cc2b9d1b93052347d4924ab71607e5e202fe1de147286664a9e2
- MD5 c431b67e508d214d74557f7d748738f5
- SHA1 982756db0e1ecd45844ed9ea3e59ce743dd08c4c
- SHA512 3efe997746eda753f7525c88184b7e8eaa01437aa7473ae74d69e5f77dfdfe0a9690cf8b5c0abb35ed140e343dcc7dd825288cc2c2f457703aae46b17e818d51
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXlk:A3k03kB56rj
- TLSH T1D1156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 006f036264888eac22c2c85bcaba2d07b77b997c15a07798416c688bffafb916
- MD5 d057b7533b0c599fd99970d6962e1bb3
- SHA1 b431a1dea0f3e813c1da74b0c989cd7bdabc09ac
- SHA512 067686ab52959a957425f87fb3de778abb933af5d5680d9022647107c0e501548cfb3e18d685a8f621533f2013f5c3d820e50adaa93f0d62b9b5ffbf526f5bcc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZX60:A3k03kB56ri
- TLSH T14C156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 5244d57017c339582f56340dd3a7a4e1004418ff59fd7806de499e2badf134d4
- MD5 ee7354cfb856cd67995ae0ed030b87d7
- SHA1 a7f1841ce8b511e98225d068c6e673670350f42f
- SHA512 f50302b54577857b5f834f365bdca031ecb441bea924fd3693baac5da82e1b8c2c0d0d851bad885f2c2bac4b9dbd2fffad3ccc81ab678c69e190d3e4c1475932
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXpg:A3k03kB56rb
- TLSH T131157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 6171fa1e738ad1f2247b1cdd469014fd7941362e77d17496e5d42e2ea903517e
- MD5 6421f3bf2d8bda05241d390cd8768bc2
- SHA1 8c1d946f07c45962b777bf8716d5c1fa966b56b5
- SHA512 7914bc11e0f04449293f1d45651516e1e91223c177080767c8894334b63a838d53efc89fb6a053d852ea947227dc233a72543bb5d0e72bcf0eee41167004a10c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXQr:A3k03kB56rN
- TLSH T1BC156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 63df949009c7cc3031505f66cdcdc4b2b123238cf970b119f091fdad05aeb1d6
- MD5 38c8c9610ab8bc830fa5bb0c9f42a28e
- SHA1 c7dbe1ad6df9084df7a90920b91aafcc26c82f99
- SHA512 df24665116e7ba63f009436a04fc43d69c45a895e862691edc8536e227fbcf1a3f2a6570ecd7cdc7a52a6d2bdfc2b44deba2a19d7303a006042865d29ba4d3f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXOn:A3k03kB56rP
- TLSH T150156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 7913f645d1906477c620aa1422f2fa99c9deba661a4c68a1896af593371ef2f5
- MD5 62f06ff6d85c1ae66ae1512ccba53602
- SHA1 a11cb1bfe5c1b8376306c1242db3f8d9c9d9c113
- SHA512 5f4a0308b227eff03c73e134964df6c7af69667d4005acbfea4f8e7dde51c0007814c4741f9e88acc705e60127f1f84ad6632aa87604e387bc4b7ae1fcade6e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXEx:A3k03kB56r1
- TLSH T1D5156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 135d82fd996c607ff9822e35ff4d7b7c3fc1936d15364b4e1fe792bca3790cf0
- MD5 f10d89397a19deb2d034b380ab99c2bd
- SHA1 4a2e2ca9ef960705761b3637429b5a110c786900
- SHA512 a27fc288cc282b4241cc677a6aa376c0dca745d1deee4e6db5cc26edf73c4d4140c6c34d25fa7eccd28014b31492c76d2e705d01ea08dd130177e31ef1146922
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXOA:A3k03kB56r6
- TLSH T139157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 5edbe9dd34c16fdf37344337914942cc6a6ecfc19188e9aef6a6c60e7a476c05
- MD5 d8769294d0dffecd00902a8cf1f17fe0
- SHA1 d567c4ede9a8fe810fdb2139395f4100ba878ba4
- SHA512 dd8ea3aa33a36e5ef53056b3a2be1478486f77a22477bb6e10ec95523eeda2c564d218139f95029987e0a8fa6e5b3d189c635c61dc893f136632ee55144c7ad2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXH9Q:A3k03kB56rH
- TLSH T107156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 07cdf78551ec8b3efdfca53b8427d129d6f3f03436cee11a997923e63a561870
- MD5 acde37c80a9e25503bd1392ba4141fad
- SHA1 0570009a6886ff7da9bc558fc506ec57b87249b8
- SHA512 19282a3d7843f7a98448535a04c202ba1bb0122034f644600978a8ed67c90273a0769e655b8c0b046ab7263d8eaa3dad2e28e55a0f912720591937b4474efc54
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXO4:A3k03kB56rY
- TLSH T1A5157A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 c4e15db396d6a5c31b44059db95bafa0171fae76f600b129109819f3a527e37e
- MD5 02b6176cc4e3bc1f9b269efa25f49e58
- SHA1 1a240256a3367a3c71553f1ffa8eef82d2b0016d
- SHA512 ba84e47446a21a8ae92246af8de31e2d42d6dc6142fc4d3a186f79322ac0bb6ad0dbee30da6d7cbb89147063782647595e9aba5690ada749e3f050effd5b3758
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXtu:A3k03kB56rp
- TLSH T1A2156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 fbfe06b482366cfd42ac5aa08d4fbb3ca1199cf179673cdcd6aeca627921e59c
- MD5 a5619551ff389920f55d969d8b65e6cd
- SHA1 778af0c7a8c78bed332d1eafb7846dc817a52634
- SHA512 b4f28467d155886da73232bdce41b0a531ccbec44af26e1f6a1e96f6aa90c1fc38800e69758b714a592305ee37de0b43e8d2727fab420556cb81fd0b11457bdb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXgj:A3k03kB56rz
- TLSH T1C8156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 f7e1d721dd34dac8a3e5f608e3f2a94f4300cb508c75015323c0eb1e6e23f3f9
- MD5 402336445f68a36ceb8fa9e6668f8674
- SHA1 b0166404f3e9912164b83356dd7cefbb09188217
- SHA512 137ef1634297735735f67fcbd55783d7d3f027e8a77f898a2a8b6380ae8511c45cb18fe7691ccdb25a328cde5f82e7839a8bda01431b1a586381ab95f444980f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXRg:A3k03kB56rb
- TLSH T15C156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 b05abd67156e5a0067afc80356003bfb9f9b0791d6b713b068bc51b29414af93
- MD5 25e521cea48d5a1988aed08f8fb34d0e
- SHA1 1cbb9dab8679b6b638792e70dce3107604df081f
- SHA512 5fc976ad98149e5e2cbed8c37eba5d9ce7c6b3afd3d1d977910de2545d28867c7e585b6e54185cd0577ebec99f8701414db96c9880cad386708de358d38cac79
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXII:A3k03kB56rS
- TLSH T18C157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 06cd8f12caf21bb5fbd4610a0f18994cc87c213ad2059e75a2150bd62af9a858
- MD5 814f8be585aa9c7d00d4200bb35562c4
- SHA1 a7aa24d8aed3d43bb00bb39eb188d6cb9e936efc
- SHA512 698b7c90e366b8fb237407699f1ed01624962aa1bb742332ab745a2e9a36e6ffca7f1facaf8ebe780a91c9a15dd92446afcea6825670c15cb65ece2de69c618d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXqo:A3k03kB56rw
- TLSH T189156B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 4e5fc89c99a52ae4ec2ab62cafeefd27cfe0c63fcfb41d40860754a419ff711e
- MD5 64f75ad2150fe9f47dcc41b40faa54a6
- SHA1 2b70d66ea7690e543a5351184f204c2a9a722e8b
- SHA512 5cfcb28550e53aa4dd7cec3f66a37220d62ae10857855e9c374c634cfc0a1caa8786f5cacef259997febdff3678a0622e04341021fcf67a5a3f48f738c27c8dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXB+:A3k03kB56r9
- TLSH T1AF156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 16085c37a298fd6400f57ecfa61dcf37fbe8771c912288a3e10bd9052576fdee
- MD5 59acaac34e7cd14be47dac13b9df638c
- SHA1 fc74367118a4ed573ad8d88da5c25121f21a316c
- SHA512 bd88f47abeb632f4e3cde85f5ff4da119ef58ae636d2fa22c22b6dd742d5ebd1c653784f35a8041b30692eb3e4f6ee788832325acd624c14ab841b77cdf6b3e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXPQ:A3k03kB56r1
- TLSH T150157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 3ec72efb487812efce2ce44342138f974dfbdfbd0634a222e32e26dc55f599c5
- MD5 3533febb465bcad9306ebd164396819b
- SHA1 175285b497fcb8570f01ffc2a9c0a38b0157a9b6
- SHA512 d1dcd9630b1eb8e36a3819f75009037d8ffb5a94ad50acbec0559a180057812a850488b629275abb67031432df5cb76b733cf916597dcf0c8f96b9803e64d161
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXUX:A3k03kB56rh
- TLSH T119156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 6dbb6f395133c4855aee3213c059ba5182ce8bf1d428707b2022acaf07208f20
- MD5 4d120a1a1ec539770ee0d4313868d6dd
- SHA1 10386ab7cd35ddfc1bd943d618b2c3292b0e5fe5
- SHA512 8c90de221b387459c3ddf8e4b1dd86fe7290cd21c43389f8f07991044c834b014035c049e8d89a28614ea38f3e240dd3313513e3852a801ef5b130e0d50dff5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXyL:A3k03kB56rr
- TLSH T1BE156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 f039d698900ce1f55bf7a11046e8c71001ceb65c0c638628cc76ec7db531cab3
- MD5 a03e3ada0b6817f9553d1b87053846f7
- SHA1 4f88096630b9d24c92deaf1bf6e2cd5e13633d4d
- SHA512 f884244914b81d30d1bb0b7bf6addaf207c773ee25f4bc1899ea877f40e2a3aefd15623565c0b050fe9e44d5dd36e6afeda7fb386b820d407898e4298eac6b28
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXWM:A3k03kB56rm
- TLSH T1A8156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 fb7d2aaa91635bafa4d794f76a9cdf631b96a950e0916488975baaf12a86155f
- MD5 ccd07ffe1ab9b5b5c6818e2e2631e016
- SHA1 1c8fb5b61e875a21ff76ad0cb235c47756d570bb
- SHA512 ce2aa7454d4ae853d9b620c8e906c2a2b1f300b4a6df825cb85f83865bf7fc00d62fd7c2a48ecc7c37d5ffb636f22e5c6c9bc11ac5985b849c47bd6a491505c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrZXfh:A3k03kB56r4
- TLSH T1CA156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH