Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 06:40
Behavioral task
behavioral1
Sample
2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 862KB
- Sample260629-hfbpasft3x
- SHA256 8b733ce64d399f87ea538b9445827f7b80092f7ada66600e555ecb0b3ca20395
- MD5 63fb6e9af1a5e7731b2ab27cfc345f74
- SHA1 e67573bbbb0687bd10637800ef5cef609d78aab4
- SHA512 7c1aeb3752d077d1758429073faabac792e91ee18adda5fade553c614a57cf39ae2020f56f1d15801a82890471dccd1816b9e0bc81f5bc85d202df18c9bb106b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj29:A3k03kB56r3
- TLSH T1D7156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral2/memory/5696-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001c00000001c4e8-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5696-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2724-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2fb-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c77-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018972-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a19-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4f-231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983c-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a4c-386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-483.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-557.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-612.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-692.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-756.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-806.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-966.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-991.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1078.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1109.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1237.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1366.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066f9-1865.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000064cf-2012.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001c00000001c4e8-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e4-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2fb-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c77-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018972-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a19-211.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4f-231.dat aspack_v212_v242 behavioral2/files/0x000400000001983c-250.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-252.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-271.dat aspack_v212_v242 behavioral2/files/0x0004000000018a4c-386.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-483.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-557.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-612.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-637.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-692.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-736.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-756.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-806.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-868.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-940.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-966.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-991.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1022.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1078.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1109.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1153.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1193.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1200.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1237.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1340.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1347.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1366.dat aspack_v212_v242 behavioral2/files/0x00020000000066f9-1865.dat aspack_v212_v242 behavioral2/files/0x00030000000064cf-2012.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2724 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{6F04C9A7-25F4-43D1-ABBF-44E4490C137A}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5696 2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe 2724 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_63fb6e9af1a5e7731b2ab27cfc345f74_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5696
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 8b733ce64d399f87ea538b9445827f7b80092f7ada66600e555ecb0b3ca20395
- MD5 63fb6e9af1a5e7731b2ab27cfc345f74
- SHA1 e67573bbbb0687bd10637800ef5cef609d78aab4
- SHA512 7c1aeb3752d077d1758429073faabac792e91ee18adda5fade553c614a57cf39ae2020f56f1d15801a82890471dccd1816b9e0bc81f5bc85d202df18c9bb106b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj29:A3k03kB56r3
- TLSH T1D7156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe
- Size 961KB
- SHA256 52bcdd159274e0dce4eed19a23f49bbea139d63665d9254ed7d0b7c4ce07b3a8
- MD5 9cf72150c0cc100f744199b5d85d7b96
- SHA1 5da86f9eafd74c57cd7f590d0beb58a5988f4dd3
- SHA512 e744772d2e39c428d05c6bbf856d2e63d785ab75b923b5c8f5a185dc2a13973dd03bbf21bfd2ab73eef3feb368732f5814c969ac9b7305e29491800fe3452df1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj262MqDBxc:A3k03kB56rHMqlxc
- TLSH T12D257B13E6850FA4D01F81349A958672EA777C121F2097DF2358AE253F32BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 963KB
- SHA256 0253493699cd3fef96228f545ee1685657fc5bbdd4e57daa59b69192feefb5f0
- MD5 449de622cadf0b92e06fb6f63838758d
- SHA1 8f3ea66c5edfb219c19ae6cc3e46da98cd23a776
- SHA512 4bc0a0b2e9a9e195ff4877448b4ec657e776f121c1367e248bcd9f0b074ffd4fc821530d6092ccfb7757908761865b4e36228782dd782096d654e7f6a7054a86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2QT6Nr:A3k03kB56rOTAr
- TLSH T114256A03E6940FA5D01F81749AA68672EA737C125F2093DF2354BE153F72BD06A3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 1e53fce38546c86acf5b44c19df2dccc95c17263fdd15550a89777a842f89f38
- MD5 b0eb992fdac75a741c17d1ea880e0ac0
- SHA1 f2c347d6b87abf707595e57c169b568bdbafd911
- SHA512 9a21b6fbf49fecde14b5767bd5c274c5d7eae8c953c37d7231ac724ae5c4c89c3c50e9e96aab1d7c4a0d226719993f3991bf90df340a03a5552779ec355105a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2J0Le5ji0hmxNrM:A3k03kB56rzPji0Aj
- TLSH T103655A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 877KB
- SHA256 e5112d139d779caeed4b8aaca48f8ddfd0ce4ba309c431f9c0a47c4f66c67ee2
- MD5 fc6c74fee2507b514d89f320ed9b7f43
- SHA1 40a388248bb463fd79bfb00b4297aa3f4a07e83a
- SHA512 80233f548cd8b3214a55f80e99ee52f4c9c1b75f12d2d72d54686ecad835c478d5f74f36adf18977ef3edff59149f322a08952dbd5ec14cb078d77ad2b634c43
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2ba:A3k03kB56r
- TLSH T15D156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 910KB
- SHA256 8838752b1509c2b0a4951ca2dbdd0ea3cd4887b9d4108431beefaea2cc78f926
- MD5 15e2f001d09daa586c28e87e71e8e49b
- SHA1 1fec752513d106efd20216c228ec6669895c6b47
- SHA512 c884d7d9be507bf7cad0ed9ab444838590e6ca42e365588926dcd3258a471dc881dad8564a20afea637a311adf4de5d07280c79378d79d198f28dd2671f369a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj24b:A3k03kB56r2b
- TLSH T10E157B03E6840FA9D00FC1749A958662EA777C461F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 886KB
- SHA256 389db6c9bd5ebdad1abf0b087918b2cd4350afb3ca088e27aa6b1924127dcaab
- MD5 6b515361a35bc73c45f23cbc97450be3
- SHA1 79094a12df675671ca5b559cc22ab35fe0a7c239
- SHA512 ebeb058339111aac16588b4474e9cbd8789fbec574dccf5c51186980d585bd65b7290e530548e5d051cee6de9e9a8c3b3e296018e3c1040a8e53615a9a18f04e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2jZ:A3k03kB56rn
- TLSH T1D8156B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 886KB
- SHA256 581d1e765598ee08f902b212634e1fb3daaf2f63d2976328ebcf52c021c51393
- MD5 80503ca210ebfe659690f3280740d1b3
- SHA1 a83482d2d634d13859700415414c0983960c53c4
- SHA512 803f65145bf6de6a5c5f3d00b7a9a1a3cdd2a03ba85615e81070d30e39d49931c646c61e89286bd611d168d0ac771c164e468439dc3e43f3f847f45dcb77895b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Y1:A3k03kB56rg
- TLSH T1ED157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 886KB
- SHA256 0ce28933b54dbda87a1c053907cf453a9a6d11517ed5b2ffcd0e3e4f8910a272
- MD5 a0b4da64c54a25a2c4e441e31b07c992
- SHA1 9974a7aebb0f3feedac803ceed57164ce21228c1
- SHA512 50b57609f9d902fe100d6f3f95897aebde8b21ebd986a871ab0362567adbeaf0694a9e9af846d96ffccd7bb2c5c16ec1a0af5d74f7e403c6c468807fddf2ce49
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj266:A3k03kB56rb
- TLSH T118156A13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 886KB
- SHA256 23de83996152c0b192dfd2f97c728f69854fe3f1b5c77f094622d3c37bc1437a
- MD5 f2edf49e1559ed5398bd4927b0d59206
- SHA1 0206d32a3efcdb824f07c1d34dba31e558bea6e6
- SHA512 6d74418bfac62251e3bb0e7e3ac3625c741cda0b2ea6622f836fe12c0ab3854344ed815f1869ae1f27289de3dff971ce3462c5121b4923fac1dd48be9c367339
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2yN:A3k03kB56rG
- TLSH T162157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 886KB
- SHA256 589e49c434d2c5bcddec7fd53b6ea01b65b6358dde7f468485f6f9034f002f03
- MD5 c631b28584c8518e71f83568b5cd975d
- SHA1 f32a1ca04b3fe91f2f20c86502ce19d6b3dc5960
- SHA512 736b02167b732abab5511a1c220152a59be9ee256e1dc7b522b381eee85c40874cd234ef9722414ace836b5f0d9cc7c39950cc6a00cc2a8511ffad3e877e6b38
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2of:A3k03kB56r6
- TLSH T12D157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 886KB
- SHA256 729a8d80c766c78f50f9527b6778147d6452a5c0d8449ad63b118107f94ebb3a
- MD5 63858447d67e8347c35b2548a7bb29dc
- SHA1 4cd8d69dd339e72846b711410b86ffb00304a46a
- SHA512 c4789da3adaa1bb80a370dc11839336464cb5e93cee97ee8550e24550f42899069123c5c5c163081f883246ec57de6000f238a1ebc41fd3628623ef4fcb4d40c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Co:A3k03kB56rD
- TLSH T1E5157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 886KB
- SHA256 110932226be87e5e713c9ca1015ddd312d2026af0c33e70bff80424d486deb23
- MD5 ed6057b0c2e8bc57da2e83314586b480
- SHA1 417c522c70cacdd55c73862419b255b4a0a3c47f
- SHA512 c9aca931879e0fb3b906af9c5d23e44a6f0e86c29158a0c3e9262a3591fe82f146650e7b0e7784551aead4df5f87fb0f8621e12005a62e679ecfc1188b5f9a3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj22u:A3k03kB56rV
- TLSH T134157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 886KB
- SHA256 85db28fda7da69e9a3023697dd21df64f7d89568ccb7c3d3d965f88bfc1dbbe9
- MD5 67732240f47ce169ff61847bc33e8c2d
- SHA1 61fc500b82e3690fbf247d728eb7e1201ced8447
- SHA512 48bd9c5f881ecd7217a1d7e1cf465143b31338d5999de08766908eb4a012e7328a96b2c72c8d76be31760b0314f539af71f3a6199613817eea91c1b851a6e6d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2q9:A3k03kB56rg
- TLSH T1CF156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 886KB
- SHA256 d9ccbe8814e81826a6f72a8ad8c6b7fd83f819498609106b607b98b65cfde824
- MD5 4e9934d4823394d3a07706e418753548
- SHA1 8069903dc954a14e28089df5cbc7243c45e553e8
- SHA512 2e29dd2ec97dca61cb4857fb085b75adf72f1a52b440a16f502a0aa6a1009b68cd759412c5327c4d5410783b482789806ad5891758fe19ddb38c83dba461f530
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2qc:A3k03kB56rR
- TLSH T1E9157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 886KB
- SHA256 f12390b9fd4ed887f6e0e579800d3f302d826a29f23b8668caa60c757c523d1b
- MD5 a0ba42843ef278b201464db747b86ab2
- SHA1 9dbdbab9e307474f88f9d63af02cb75be658b64f
- SHA512 1b423cd68eaad5188907091ab1f37519504db3cbbf23d41fcc37dcfdbbd533dc15555327d1b29b05311c184468d34bb3a5f61ee77584c06f7468e26a570a3dc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2jp:A3k03kB56rv
- TLSH T147156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 886KB
- SHA256 ad713ebfa038a1a0cb78eb575aa1457747d4d7eb7355059fe9938317cc414628
- MD5 45ced7af23a8c409fafa4308d9816ccf
- SHA1 4a297cbcb3a28b188e070b14fd41096b0a79cce6
- SHA512 bc62f4f41d9e9d2665efe15294c761c2800979b9fb565fe72b1f0a4dcc2ca60cd0035dcfb4afc3a2821c77b4236f919ecce5240e8a954f424085f822b53ddcce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2EN:A3k03kB56rk
- TLSH T1E5157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 ebf10f46f38f360388d2f3104324b89d8d4b2e2e37cb6d1ffca1f1c4def67894
- MD5 e3e3fc89b67242d613db3e59abf2291a
- SHA1 780a23d383feb2a4786b719caf2a7aa9049e7c7f
- SHA512 29dc078e4384cd992940d08937818259c8b6eb6b366d31d809435ef5e2ff0f3d472173e497282c6c2134be3f0c91f91b71471a4ace72de9065a853fe0284f294
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2sF:A3k03kB56rS
- TLSH T1E1156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 f0f2dcfaa704f029c26ae3fd414065d02c28622f73eaee8e5b449dd4897c6dc3
- MD5 9d04e43c868d9e174da92f252d0b45a8
- SHA1 8899bc313f7449bc4394aebe4245c18c4001d458
- SHA512 866b7a9697f587a92e0e34c389a3900f0263f3ae8ec2a1b115593e6b62b0a80ce693b4d0440d3117a4eb88befd73c69142f0f36fa0d8e52115cdfb1bfb6bd841
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2ZC:A3k03kB56rm
- TLSH T13F156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 9159be066e04c15ae9fb07bf1190acb276012ef6f98f9962468f5a792a916d3d
- MD5 aee30d669d3edf8f4f71056ba2571067
- SHA1 6daaa8cd4a34b3a3e7bfc20d153d3bcb69cf6b83
- SHA512 969a6e9318557938c79400e16e90b6ca8996cd6784a04888052126cebbdc8ae9d0d35341b741a31d482789caf23bf05d22eed424c3fd727b7f76f121314e9227
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2aw:A3k03kB56rT
- TLSH T1E9156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 f6b5e0f3af9e6afca4b73a123aa7c7c81377944a2db8194ea133ebe9a683ab75
- MD5 7ed7a1251077cfe1e2757b438014a498
- SHA1 e073c06b35d845a1c4e15bdb918f48257a917fcc
- SHA512 19cccd828f0da0ecc4001660ff5d8849f0ee6e2210eb1d06afb5bdaf5ad35edb0a2b4167094793e6b0e473bcf74ee8e325dc2487486b1fb4f9f450ead44aa00d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2hT:A3k03kB56rf
- TLSH T1A8156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 b5c7b679e29b1d3aefd19de363f842c6f0de790f71154c53e8a3a90dfd171ee4
- MD5 d298bf94a89461962c344ded5c6ff743
- SHA1 d87ceeba993b39d30c2383fbed0532a8a5820d2f
- SHA512 b5a53bfb9fc589e2aa33207ef73171a813545c36d14bac8822fa8856ddf06913133b5651a56c7bdbf4554f8d78b8c729bee1967aee520903bd1de877947ed0d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Pu:A3k03kB56rw
- TLSH T10A157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 e827fd0c3859dc2e74a43397b8e841c3dcad39a4bfc33e06cb10e7928692d9c6
- MD5 07c76afb82b4d9c3b56fa7bc0e87b807
- SHA1 8e6bff291f01fb74f4d1b0f2a8595c26a551981d
- SHA512 15cf6905362d6dad8ff913a5d56452da567165dea8529c1c42cf9bb97e2411454c3b91397b298884d08b60eff57ea67c7a9f6646b8e43b97653297fc751b1a95
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2zb:A3k03kB56rp
- TLSH T175157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 45903e0c2cb30ca086737a28970baa493b25667d1305e60bccf80ef8b8283d05
- MD5 6d5d8a3c66544da04274ca8d76dd7a8e
- SHA1 8a279f4dc94f426f8e94302f028f22dd8ee7048e
- SHA512 996132af072cc4cc75417b36c198931d69cb006434f7720de80543fd0f2a4d4798a25919caea0d6375524c4bcb1e9032ed8187a2b1fe6f628dc4e7e3838412fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Hf:A3k03kB56r5
- TLSH T159157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 80c915d0928de248ce9c44d978c22509021257379b2bcd728bc516cb76120545
- MD5 b9935ed91d4e17299d4cc572f3a46e2d
- SHA1 53864519c26f506d0a6fdc6f4c905fce835819d2
- SHA512 9f783fe2195b4ca8e209e17537e3cdc196cc155145112b8f66d9b00a609049a77178aa9e265d84aea52b480cf090a4f4b96d5b19a38cbb7c524116c5cd5d9e99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2wK:A3k03kB56rR
- TLSH T1E2157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 a81050da529575027ac177ec5d25f78df733ac303b45682b5aa6569f2712d89f
- MD5 aa8c21976f97d68ad914b86da4a3926c
- SHA1 b4699390e5a5f0f2672e004b6898003d55b1fe1e
- SHA512 266284da242538dce277886e4fcd9c126a63147dd0fd38095d4e05ed29cbab146f3d4d8e4a75f1d2d98395d7182da703aed00feb40dea9a047305d8c1369ab73
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2tk:A3k03kB56r4
- TLSH T1D7156B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 a825b212d705820f1d1b871188dfe1c9a4cecb24968054f7dc1d42182d9f0ca5
- MD5 d556b4ddbc8bd4af138b368947feaccb
- SHA1 c050a0cefaf7683e4015c62fdffabbaf15940348
- SHA512 a06994219f0cb44d1172bf6d1f103aeca5099369f74116880ef675389444f6dfa3d83a17c84b01cc0f8fa109a6e9a1421c3ebc8c07721fa8112637bfbe2dd942
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2y0:A3k03kB56rx
- TLSH T1F0156B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 e0d87ad2a90babfd6ea3b74987b69c0e695ed9d79828d095631df2e60deba6a1
- MD5 bc385560e58456c0940c505d7ecc1da5
- SHA1 eb41b86d499a15261f3c17e7a596677a9efcb2bd
- SHA512 f66440e74d0d154ba4a7b693b6e0544347d85d1ecc54c03671e3c73da14b41dba5cf4a857d50ec4c47de0c95e6100cbd536e7deff6c2535900ebd7596386b9c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Bg:A3k03kB56rQ
- TLSH T1F3156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 1d67b13ebb2d859baf751b872e6e2a35acca6c30f445039e8fcdfe8e47eace34
- MD5 4929bb447525e34a81ece95a5a912ab3
- SHA1 88f0b7e36b5cdd9d8426796c3d8a6b6cd70df9a8
- SHA512 8466e2b0eaec5a640361a47f33fbac614ddc36e95284ddd2d22ce175ef3b5cc23c1428832724135032ec4621f405ef3c11b831af843666dbcb046c7af5ecea5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2or:A3k03kB56ra
- TLSH T15A156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 a1a6093ee8dc4114266cd8c6a2a4c0e3ba22c7f4ccc67c964cab906810b6426c
- MD5 3edb898a5e5ca28dae2befac8b96faee
- SHA1 2b95de9a13767afc991516d6cf3847225e97bb6e
- SHA512 cdfb2d95d659802cbe6a04d723e90c875deda6661f739f8956b9c1b2984a63811d7de4fba4275f4cd8258dccf4ba8b05b9bc57431fdd1fc22b76744734f54157
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Gn:A3k03kB56r8
- TLSH T14F156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 475fb692a0237d5879995d860cb896cc9d5f6ab1975cf11ac6969c05b4b770d5
- MD5 92ff4e1b54809d98bf166ecf749b5d03
- SHA1 7d68d92f96b39e0614c5cc97d5de9525e5454610
- SHA512 8ceccbe56694cb3d13a5792edfe18e14d8215336a3b5f622dd2d2b2b6811758ccdb4ba75fca9e20a9577cf81ab497ca05132a477bba43865815b295301ce3e6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Mx:A3k03kB56rq
- TLSH T1AE156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 70cfc4e5a227ae07a09539d98d967f40408a5517c391daa4df08c56350e3677c
- MD5 905e4aba291020ebaa7cab8ae88f557e
- SHA1 7ef23dc7bfe0c7c1650dfe737c6a76574a061047
- SHA512 5fa191fca586e33c1946076fd694f93ffc0d56af931e775ce4c22f744f1b6cdc505c123f688e4f5e630a438631d0a01510a025ccc9312e10633bb79d970f3af9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2GA:A3k03kB56rp
- TLSH T14B157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 e3289ecb8607f9867a617a0f15a0ed532f72dca9d95e8ee93213adf434bf1ae1
- MD5 8d7761e8f06fdfa002ff42963cf666cc
- SHA1 599b10050deed6bcb6ce8d48ef460aa75451b161
- SHA512 3ed6e4f331ae59b06b2b0c106145bc74951d8bc804727e838ac7d420c42f95eb7f0bd88d24d9bf0f4f764a48040fbaa688c791536027459616d09947588b430b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2f9Q:A3k03kB56rw
- TLSH T1CA156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 0814c0940a3c010dc7f778935672007368e3510ad7e7bba668b51f8e870e4ccc
- MD5 e400909969f13576c915a9a99ba648d1
- SHA1 d32100e74264a9b50a04f7ee6446c2f8c6c19439
- SHA512 22a6cea996719d3eedce6b6b2a52b76106c96e54ec73f3acffe6487b1e70b83862774e211d9fe8047a7cb562f440cd495e5b5ca8ecdb4756bbf71c86079e80e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2W4:A3k03kB56rr
- TLSH T15B157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 67d1734a3d8275866247f28d2d867a7e6cc49b213ef53924c09e08c8ae94509e
- MD5 57924663c1a390ee142b51d1d3da2603
- SHA1 ea7267933544d356b0368f35336fd3687295ebf7
- SHA512 2425206dd93cffc4f6e5dd15c40fe4dadfbaaf8fe3065ae1c0c590fa353ddf050cc068ce3b54a6df52c4539a38b43f5681d0c0c087e16021d379bbedb28d2d86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Fu:A3k03kB56re
- TLSH T1B6156B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 6d7a14e8aa302f5ca87164ad2a30329d2f953854691b9efd265fb627656b1d44
- MD5 39db27923ee0d24ac656339fb4ef3bef
- SHA1 d84533f9a54d1b4222cee387a3566d644ea3149e
- SHA512 a466ac3393bd3acccb1c80b0ea914796aed76e8eba06b4b49811fa233f37268291bceb53591b47a0fe4d6a6c95c1509f785993bd24a59e991080738d7e942a99
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2Yj:A3k03kB56rQ
- TLSH T1E5157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 260ac6736f393c7db1449504698de99f6cbb670c3c10087ffc8d145ed8a7c778
- MD5 ab6693e718711cdf758e029d0eab813c
- SHA1 a5af000efaa386ca65f35644fb3fcd394a836fd8
- SHA512 1ba6015f96241c4a3d02a1a9b4c46bfa530afe827fdd46e50b4c6defc5dfcce33252bc0bd518d5291e53b845a04739cf344723d862073d2e53de83da49c0dc06
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2pg:A3k03kB56ro
- TLSH T1C2156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 5340fddbf3b796f576abc0ed472eb9ccb65c280a0d8274829d7d2dac1f3f864c
- MD5 96945de7cb09b7c4d35d21f10ea9dba9
- SHA1 399b9ae0e4232b681a797880895592ebe7f982e7
- SHA512 8c83497c61df4015d0f1a59b193feb93fdb296f83bd40da9c68885be0dcb2ce998c55e7450fbafe2c9a2ae3b0ba5bc79ecda0bf0ab3d6f6e555da728b32aaba8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2wI:A3k03kB56rZ
- TLSH T193157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 b41c7930241030a513cf07575727fbd60ee82b0089c3655e737ed3ff64e19d90
- MD5 10da8fe052058222557e903ba2abd226
- SHA1 903c2fa918132201e3ac3ce3972bd86bd2239f0a
- SHA512 1a345f1cb23d28d6cb0b834b9046e471ff027a55dacfe01f845cb0a71a6b464c43215122f0b4d7d184a467a822ff9dc0c1cc7c80da59b3c8902653d4b929a0e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2yo:A3k03kB56rH
- TLSH T111156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 151ac331efaed605026191725252c93cd9869f30f3cc560b7ee705e978b1fe48
- MD5 f7820d2636744252b9490b2eefb93da6
- SHA1 3ecd59aa2c25b43c56c1ceba9303f556ac47f1cb
- SHA512 18aaca3580788a41eebe836b4e2ea0584c326c3ba5f42644e94b24a38c31da6714216a227921d71e4082d3238c68c1420fb27ca9025c33dbe5fbd1dab03f2f9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2p+:A3k03kB56ry
- TLSH T1DE157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 d3d7029ceef2ca62cc17f1ac3a0ccf0ef8200274f0db717a5874554c111a001e
- MD5 0a6a67f7fb0e4cd38f3be0743c3faced
- SHA1 35d20ad78d0cc0b585b5ba2297f7fc59a63cdcee
- SHA512 c4aa6586721ae3160471f023bfa2294b2006e84541332253d9734e2cde8d638fe77ff0f63a5bf1333b1d21400d1e20b434310028905e8f07ed2c66abad06bedd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2XQ:A3k03kB56rm
- TLSH T1E9157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 2942b45406076ee148ee9ef759900fca9e41a6a099a7412f55e6f47dfa9f908d
- MD5 17e83d3614bb8931716a7fad0bfd7ca5
- SHA1 120d634db2af3f1dd04afc7f27ef925b9f47deb0
- SHA512 7e82b855beed9ce39c29fbc0d810ae7168346ac85229a7e69044e6dbbbc3bd3a342d791ce9c33292a59517dd33c7552ea524aba3c5afcef79c00110020da0edf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2sX:A3k03kB56rG
- TLSH T167157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 1f3a59a07b2e7a72a13da5b98839ba3f3bef7daa9bc80952505a32d25e3f6308
- MD5 f1c91959640d754a00cb20f4e368ad72
- SHA1 cc375e0124869637c9ae4e0cf2f4ad7c6202d862
- SHA512 52c7b2c01f87f681d90c81568043e876f2a37709fcdc7ec8bd67cb6a96601ce0acaf9bdcb9cb56af5d836c1fb27c62ce479d8c58daa8e3ae706eddf02409f24e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2KL:A3k03kB56rI
- TLSH T1C8157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 904acccc1cd9520627e784569cae2ac3246a6dcb8c006be3a2f262d7ab988708
- MD5 3f7a9d96c7219de3324473788a81e910
- SHA1 4a26d0f8582b6a0912f40e1b3850554e8de3ff4b
- SHA512 c83da3d7e771a0ef481d03a6b25baa8a2d6156a56a396bbaf0357deaa14660ff9f5037616b2cc7d1b79492c464c3bf7987efb95d30d9e329836ff1b17b35fbdf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj2uM:A3k03kB56rJ
- TLSH T1C2156B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 b7367c128251984ef3b5a8272471116c815e41b4b5f2f277da3d615bed03b70f
- MD5 d78abb5c69d79ca2b00180685a162191
- SHA1 717d64c5f70e447224835c60823776be43aadbbf
- SHA512 9e2bad612aa817b1d745db417560b8090a6e7ef45055eadf5651cee601b7fa90e806de62faa1dba68861b7581bfaf09b3af05811396686d735cfa5c0c48523ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrj23h:A3k03kB56r7
- TLSH T192157B13E6850FA4D00FC1749A968662EA737C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH