Analysis
- max time kernel
126s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 13:31
Behavioral task
behavioral1
Sample
2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 816KB
- Sample260727-qst1eabb88
- SHA256 c897a0d7c38c47bff076310867cc731a4825cbe8eac14e14a81533c2e9d67f08
- MD5 0bb3e9cbdc2fda61ac23f0fd2662eec0
- SHA1 30b19baf9592a5095dab19c89be4ebd77b6910de
- SHA512 2a01e15deb47aefd0f6c44e13ae73cf5ea6623bf9891b4ca7873f928ca0e5c7b37b6c3f4df41299cfcb13339a409a51bd00d7ff0b29e3a3181876c8aa93d3297
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23w:t/sCv7rTiw2RYwZCUs23w
- TLSH T17105191767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/4564-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001b196-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4564-15-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5152-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c86-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188c6-198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188c8-212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188ca-213.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a59-232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019842-233.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a56-452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-520.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-645.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-780.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-812.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-967.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1066.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1148.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1168.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30b-1411.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066f5-1862.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000064cb-2013.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001b196-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c86-59.dat aspack_v212_v242 behavioral2/files/0x00040000000188c6-198.dat aspack_v212_v242 behavioral2/files/0x00040000000188c8-212.dat aspack_v212_v242 behavioral2/files/0x00040000000188ca-213.dat aspack_v212_v242 behavioral2/files/0x0005000000018a59-232.dat aspack_v212_v242 behavioral2/files/0x0004000000019842-233.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-270.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-343.dat aspack_v212_v242 behavioral2/files/0x0004000000018a56-452.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-520.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-599.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-631.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-645.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-749.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-780.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-812.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-868.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-948.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-967.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1022.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1053.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1066.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1097.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1110.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1148.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1168.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1194.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1201.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1238.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1341.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1354.dat aspack_v212_v242 behavioral2/files/0x000200000001b30b-1411.dat aspack_v212_v242 behavioral2/files/0x00020000000066f5-1862.dat aspack_v212_v242 behavioral2/files/0x00030000000064cb-2013.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5152 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4564 2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe 5152 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_0bb3e9cbdc2fda61ac23f0fd2662eec0_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4564
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5152
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 816KB
- SHA256 c897a0d7c38c47bff076310867cc731a4825cbe8eac14e14a81533c2e9d67f08
- MD5 0bb3e9cbdc2fda61ac23f0fd2662eec0
- SHA1 30b19baf9592a5095dab19c89be4ebd77b6910de
- SHA512 2a01e15deb47aefd0f6c44e13ae73cf5ea6623bf9891b4ca7873f928ca0e5c7b37b6c3f4df41299cfcb13339a409a51bd00d7ff0b29e3a3181876c8aa93d3297
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23w:t/sCv7rTiw2RYwZCUs23w
- TLSH T17105191767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe
- Size 915KB
- SHA256 e7048ab4c437d5dfff22b9b1acb54df80d7fcefa72022b52935d1d8e22053407
- MD5 c0e437bed6007860020c8b1c5d728a35
- SHA1 09560d6d845514a7bafcc0b790fb39b3f7b0abba
- SHA512 626fd11495369ca49196e454d93387d731a1d345081640218c6461e4840bc011702dfe3d4a714e048976eba0fe0a2d9f2504714db94c22a658a0773bec4064d2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23z2LoqDB+Uc:t/sCv7rTiw2RYwZCUs23z2MqDBxc
- TLSH T1BD15391776EC4890E4A2653449B58616EA76F8551B30C3CF12A88B3D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 917KB
- SHA256 0b44f1f14da6ec87fff7556d1431542d71297f2fab38edb8ec71c41942f0ba0c
- MD5 9c83970568735a10d033425892fa26ea
- SHA1 f4678d13859cb461f6e69d7a5413d86259c5c11e
- SHA512 eb2596be88c1a6892f97bd3c7983f0bf654eb414f672a3c27af1681b1d0a74802165775bb12780ccf4845cd95bc91133deb02721745dfca108fa0437e26c37a6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj233TDUjD5FX9r:t/sCv7rTiw2RYwZCUs233T6Nr
- TLSH T17415291767EC4894E4A2613449B58616EB72FC551B30C3CF12A89B2D1E73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 1655f1dc3e799f0008c576f1d918fa56201ca3405df1eb1f092232392aae9392
- MD5 e1442e653db8a7dc89415ce7ef922cf3
- SHA1 5bf5a1c7a6b855a64960f7d59670ee23a46052b3
- SHA512 8fd9a72eec766a55cb2ac82c12b8e927ca206c9db225da94b50859d98b9588008e9510b3a210b39af767dedb626c9075d72e4cc0d08aa4f1bbc5c37fc9552e71
- SSDEEP 24576:t/sCv7rTiw2RYwZCUs23I0Le5ji0hmxNrM:x7iw2KPji0Aj
- TLSH T1AD553917B6A84661E073D174C5E6864AEA72B4461B3087CF12A9C73C2F23BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 864KB
- SHA256 d1f8ca625d7e35b36f1c2053593ee2f8fd25cf50060afea1b4415969a10c884b
- MD5 9fd09f47ebe71542ad54f9551b1eef2a
- SHA1 57e2d82f65b34dc3aece8021cbcd737565503bf9
- SHA512 9a92e90f37a6fbe41e4fa98d0900875f6f91e2f625bc0f2fc2eca1a57c5c91715b21f57cae26c1817aac31321aeb78a8fe00944968caa1f697822575541c0d81
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Rb:t/sCv7rTiw2RYwZCUs23Rb
- TLSH T15C152A1767EC4895E4A7613489B54606EB72F8551B31C3CF12B88B2D1E63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 860KB
- SHA256 ddf1c089f75b4cc9bb87ae271a322ba1490c79fe8d9486bca55116d74c787ca9
- MD5 e3fb829b680c93e24d1211b6f032f888
- SHA1 b732356df8df5227dbb82413f5dedfa4fc97e496
- SHA512 f619200b2a022aea29ee720610d7ead896ff37fe3a056edb6bcf1b3e49ee8d2ade8f6f41d141d532dde36d871b6c8e34a6c02b7dd26cb479e4c25d90c4a236b7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23KVc:t/sCv7rTiw2RYwZCUs23z
- TLSH T14415291767EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 840KB
- SHA256 6127721bd5ef964abcacdeb51c2592d5826831dfb9e6dac130f1fe8d3bbaa6c0
- MD5 ecef9ef54b1adb7bed9b6494a23b7dd2
- SHA1 5748b688c0ff95f58463a2eccc5a3a68a9e47539
- SHA512 3da8d03fb009628e5f733e2fd16f9e736df1b816d30d33d88729e814c6e686ada5af655730f6cb133404e6fcf1f0bae503f1279e7ed02f448505fb0da2ac50b1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23sZ:t/sCv7rTiw2RYwZCUs23sZ
- TLSH T18905291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 840KB
- SHA256 601d19c1d7b0e051283a059fa4b1424d06f6c7384f1d91b3034787066f7aea10
- MD5 3c355c6726bce524ba9eaf522cb4ab21
- SHA1 0da019880538fb46577c06d25d84024444ffe967
- SHA512 08db8bb7802d61b9997f91cbb2226bdae9c1227872fcb8d625c480faa39693a5e234d703923166c27c1ff06153867919d77c3c7097be381c045d8063d6c32889
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23j1:t/sCv7rTiw2RYwZCUs23j1
- TLSH T13805291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 840KB
- SHA256 68e69bb9bf49634434b8a20dfc1141053ca457d3bb9dee1822cd5d04ab36694c
- MD5 38873da5d93e2e4104699bc8bb50ff89
- SHA1 83548d2204fa12e5f719b730b2e7dd198368746c
- SHA512 75bd58c1fe37a7334d9cccde6b9730fcc3af12ff0898b8a832f2852a7046e078ec815aa16962e78bf27d80f8f980db6c5d4693675ddb36db06c08a35822a5582
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23D6:t/sCv7rTiw2RYwZCUs23D6
- TLSH T1D905291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 840KB
- SHA256 bb5068e5279055744d3003008fe39cc6d71fc5340ccabb8859120c40015a781c
- MD5 ea24df31c66dcc7a4d25e19e88e31fdb
- SHA1 187128fe9d5c6620bd24ef8b8426b4692a22b40a
- SHA512 28b6c0911bc105c9af4034515a83e605426a015b74a76190bb6b98bf2316926dc08815fb7535e6ab87a63741db4eeea018a51238e663092459e3184d095a9120
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23tN:t/sCv7rTiw2RYwZCUs23tN
- TLSH T1AD05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 840KB
- SHA256 c6f6c73a5b2092054bfa053fcc0b9ba3dc69bb5028e64ee285bed69ad617baa2
- MD5 caac527c2b946315408f42134152261a
- SHA1 8db10edbaa2edbc610f731dc7585888b05f7e7ac
- SHA512 7dfb45588067583e6f2d5793c0f89413468d3a2a03c373d9110fe6a3455780d3e42512e986348f8c9b7d3b02027a91116b0aca03c771852242c85e51fd893909
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23bf:t/sCv7rTiw2RYwZCUs23bf
- TLSH T14505291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 840KB
- SHA256 89ed1a25230441fc079b40a33474e53c18d1515747104253c548949cba1360a1
- MD5 5ecff768568dac603f653f5209e17821
- SHA1 123b1d2511a324b4dc468f10c09a742c35b89deb
- SHA512 d846bef20259a1ed5a99c3f1c9d5d43bd4cc48d2ea158b93a49aa071201ae0c51cfc67f5113136a21b76670973df26e6994bd7c0268a47cf645d823852eba7d9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23No:t/sCv7rTiw2RYwZCUs23No
- TLSH T1BA05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 840KB
- SHA256 bf5c29b2ea3623e2073a6899b8deb9f95cb2c0290f3a6aa1ead41c6eb4933b92
- MD5 926bccf692a03e54a3f05222c6ff5f3b
- SHA1 2880b8ddc3f505035c84c8bb93d0543800ac7b59
- SHA512 5a6e27039462f49dc290cd7209270d92b033dec10f8f6f2f40951d915171691d7687dbd322dcf0dca1f235005a6b86ac050a69c921faae2381fdd2272080176e
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Nu:t/sCv7rTiw2RYwZCUs23Nu
- TLSH T18405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 840KB
- SHA256 e2e7629be6387071eeda829bc8150a16939200d4489dcea8936efeb9c23466fd
- MD5 53d4370d711358cf3bf0f6de5e18d159
- SHA1 40436dbb8ac328a98cc477603491a4247e86fe61
- SHA512 30df93292ce0fa36a6c7a13d83c22952228d896d35bfaa685b7fac29f19d5dda963bd7b7b1f0a6ece53881067db63d85951b383332c766ee78a55c94d975904e
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23j9:t/sCv7rTiw2RYwZCUs23j9
- TLSH T18905291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 840KB
- SHA256 02b969783c512df3ce49a21371b3cb9943ef07af95fd9699eaad3e8a1d0f6f4b
- MD5 9f7be88feea0e137d9b14049ff259c0c
- SHA1 ac3f69c9bef14ddb324a4965c58023ca9d5c13be
- SHA512 9ec2a2d9b3a80f13a5fba9bc353df4f01ae15030522a1c43726f6340828b726477d1d6b2e3c90e757063e7d2c69f2455d6db2e5bdf653a814f9fb041358af62d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Pc:t/sCv7rTiw2RYwZCUs23Pc
- TLSH T1EC052A1767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 840KB
- SHA256 4ba7c64ebd884180453fb3d2ce748b1bff0e2119c9aaac6b0317adae6285a0c4
- MD5 e0a14c3ce5a123032deac8e6c0a42237
- SHA1 e948901afdcd6f122919473b98cb0c3e30867f92
- SHA512 5ae9c486121658f2bc103c60b0f483f0303f8305c21070467c6e25f9829ad86eaebee7b1e47b93a81539015ebc8ebea35f8786c1bbdaac1d00fa8281dba300b2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Ip:t/sCv7rTiw2RYwZCUs23Ip
- TLSH T12F05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 840KB
- SHA256 f913734247cfd576b305e5b25fdceb3395e1b539a685de08afac491a97cb74bd
- MD5 f94541fa1c93797d9a3d2c9dfc622d49
- SHA1 71d1f899946478ad9372d97e393a0b8c28f239eb
- SHA512 19af26acd3db114a056a09d980f398387a911d252313c9c4c0b8c84957fd0d1c03206a0882a38412c585c59b2a35227094a624a7d5c0c7d7ed1040371c9ab0c7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23f0a:t/sCv7rTiw2RYwZCUs23fN
- TLSH T1A505291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 840KB
- SHA256 366a38cfe437af0f8185e9b9f54626970c233bdca82ed4ce4cac4af6a875b1ea
- MD5 7fd1601e74f8cde5b52098a9a7c4090d
- SHA1 3b8ec5124956f41e80f71e813c6e0265b71d77da
- SHA512 5ff43077e71a2fbba8070e1e2e2185574cc29bdd45135b4e6a394755f7f44ed31aca7c653e4c7d90730ae8a10b976ce9dd6072a565a8951d487be84d5af6448d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23dF:t/sCv7rTiw2RYwZCUs23dF
- TLSH T1FA052A1766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 840KB
- SHA256 c073eb08967b9be9f4247890781c8952cf27671780834e4f42158136da89b7f2
- MD5 3acdf4795bc3b949ed12e2349b80cd9d
- SHA1 c62c0d89a9a4fe00efbdda16019583146a37aabf
- SHA512 85a1b86d42aadaaa100d855301a202f9cd67d1cbcf414433a98920d2e48f1579bc2020cf65371bb3b54d2eacdf15a307095e6686aee2a82835970510eea0137d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23uC:t/sCv7rTiw2RYwZCUs23uC
- TLSH T13C05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 840KB
- SHA256 c132c29d5519cf265bbf667876cb7500d936c8a9d74238b6d54b742cb2232aeb
- MD5 b1ff769757db219b91f8ba8080400e0b
- SHA1 b5c6a43dc59a527ea8ebeef9c8d834018d172e06
- SHA512 9ac85cfbb6e96789e45ba829371a21ce2937208daf4436c004107301e42d2094b3aec83bba4744b4b04cefd48d317a7f7bf0984c0a3cf9f976a464704757d3e8
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23xw:t/sCv7rTiw2RYwZCUs23xw
- TLSH T19F052A1766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 840KB
- SHA256 a31a39867064f62d912249f7d417dc0473f1e755af74a3ab5262ee093c57ab94
- MD5 3bc557a74674879adfc51db65448d07c
- SHA1 8ab904804108ded9b30334cf86bed5d43cd3f2bd
- SHA512 e5334d36bc533a52629ec2b7956ccc89ae5f65b601dd029bee1f1304e1ed9d964598aaba290b7a2b94922eee75dfeebb36351e499cb072cb47b15de02b2f07b7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23YT:t/sCv7rTiw2RYwZCUs23YT
- TLSH T1E105291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 840KB
- SHA256 6148cb606030efea2c5026cb66e489ac80bdf4bd9ebc47e65d250207938b5118
- MD5 b5be64dc419ccc9dceace9a2b5215b2e
- SHA1 0d6943dbed8d69663bded375f4fe74291d9144ec
- SHA512 4b3784ec2c47c649a3c2d3d01bf8332c834f6434a40813da47a734e9f79d021506f281e081c15b779e04bc6058af98fa2c9b2ceca4038a9b0a78d55c92d8a110
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj230u:t/sCv7rTiw2RYwZCUs230u
- TLSH T1AE05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 840KB
- SHA256 f2c7a04382d638ce95bfb1521f81192a73de8f92d53525c36aa4e97c7f3fc3f4
- MD5 9737f0a710548e689a7081444ac73c0b
- SHA1 329e024a8c89bad9c4a30ef6140ed94b5fc51730
- SHA512 2d7262fffffff756e0b12380a028a02bf8c502f5bf4300b21ffecc388856aa539e129cdd689358a7fa4eead96a5f5b19bd5de7022aac43cd931ea6385d9f7de9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23ib:t/sCv7rTiw2RYwZCUs23ib
- TLSH T16005291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 840KB
- SHA256 f7dcf6c3c5f0bf2c4c4242a34a6919e7097fe90b93c5b140ccb0dc0550cc1679
- MD5 43325abad7856c3a41c42c7d25311084
- SHA1 9c265bbbd0b7b3b9ee8b864dbda16a8fb07a97a9
- SHA512 d44e789a920f69367113d3fed74bf4e7459e7137561ecc9e3489d6eecd0b098db63417456f6435897f7ad7badfb049ce6b20e04431c083ceaed970d6e9b788a3
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23kf:t/sCv7rTiw2RYwZCUs23kf
- TLSH T18405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 840KB
- SHA256 e3840ef4c5613efb8741892f8aeaecf4b010d24a292b2ec7a55339e731122436
- MD5 ebb0d41aaf78ed3688bba8f4d1b77ab5
- SHA1 8ec4c8794e6f4bf4879c8395af99024cfa6b573c
- SHA512 442d9df6b1a6b6fff0258494d002257b7dbbc681ba6c9b74270023368779c692249efb755a832784b8f7fc42f61604c382c09e0b2ba0cc5e66a92b17f9898770
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23BK:t/sCv7rTiw2RYwZCUs23BK
- TLSH T18505291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 840KB
- SHA256 bfdc5a6d843ee8d51298f1dd251fd3d1b37b8f27fab2e29f30d3e333b98bc48f
- MD5 0817c9cad5838cc922cf4a138d07649d
- SHA1 87ddd05839326b3febf282ae98b2649af0deb119
- SHA512 d8c59d293b187210cb777005639b7f02c77c3b5ffb6b0bc6d0f2dd398396b9c4f0584860ee04fc01d811a07f1c4946b7a823c93eda80aee8e3ae28945d4bffa2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj236k:t/sCv7rTiw2RYwZCUs236k
- TLSH T16205291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 840KB
- SHA256 79e920888499a278966466caa8c031c9ccbef5e36cf2e416962a39cf1619b59d
- MD5 075a639294d7cb70882f826d25a3447a
- SHA1 634a0900557c276ac7e801c3fc0d0c687bd31c02
- SHA512 04c04cd8cc62f3a82868cb2fd8d07a32bf8ffdcd1189bc55385d807f249655e38413bf45347c89a476de48741cff7c9cdfabecbe38aea57d82dee90d5a465447
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23f0:t/sCv7rTiw2RYwZCUs23f0
- TLSH T17B05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 840KB
- SHA256 63c458499b50ef6baadfd6b529ee785022019ff4c1f244235e29e6eb40e0bbbb
- MD5 b102bcaf7871428f56041648b76b7630
- SHA1 837fb43255d555dda5a89ca1c55ca40cdf19aba5
- SHA512 a34cee6d841b051b554921259b638a476a7c18092d97b02664faccb41e9dbc930ae21807b201aabbec0936a1a9da51d6d373157f041e074148dae151de4ac575
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23u70:t/sCv7rTiw2RYwZCUs23ug
- TLSH T14405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 840KB
- SHA256 3602dfd79dafbd7116072a9b10950e9b224429e805eb07b4738d572156bb6035
- MD5 9d77f5ba734c53d934b26387c37d4ceb
- SHA1 4059d567010b3f06100cd1709b9d0b4f8468cca4
- SHA512 8e79641727478b90a6136d31afad3f2f394483ba92760d6028dad2d16c4535150963a48656045841ed2269c5549b393a72c59ed79ce85669e298451296e1e74c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj233r:t/sCv7rTiw2RYwZCUs233r
- TLSH T11D05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 840KB
- SHA256 2f1c9d4b6b9733a33813866d9fe4f039d53681406be88a2ca16baaf13d09ffd8
- MD5 019913c2b0ac4a12ccd6ba77fcce1711
- SHA1 c752ed21f81a71f2274426a2f7c7640376228663
- SHA512 d300ffd3af5b237a422e183c982abcf2544f52285f185cd676f4d669999e36d7a8fd6c6c2fce6dc552af52963d828967a01afef700f54a8432522e9b6b40601c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Bn:t/sCv7rTiw2RYwZCUs23Bn
- TLSH T14905291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 840KB
- SHA256 7d28bc4c704a379b2cbfa28a5ce15db8f55d7365d25472334b4a5a9e02319452
- MD5 91e5b0c109aa9064f9cf2cc68b214369
- SHA1 5501d05a7a19131393871feb8e79ed3ca100c2c1
- SHA512 f5eeca4442721c02255c33d0439604030c6d8e53ff7aec911b91f2879b6b048ea45abc39332bbe2601719e14dab6322ab5a774a0968a38c68c89e5d8ad5eef4b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23tx:t/sCv7rTiw2RYwZCUs23tx
- TLSH T1EE052A1766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 840KB
- SHA256 598f39dc879f6e78f8822bb460a93fe22fa28be8cfe94a41b128ffb4277397cd
- MD5 8a2f6676a6f29f4381a9b76fe6b87655
- SHA1 349620a05e7f446c566dbc7e21110b75cbce7b64
- SHA512 867783465f04b3f080449aa3eac885e05ea5a78037dad6d2f04efc0b1af706fdf220b5b5d888da7840d5649e8d62bce8c64423987ae20a1b2e8044afd0ccad1c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23zA:t/sCv7rTiw2RYwZCUs23zA
- TLSH T1F705291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 840KB
- SHA256 a8b22aeafcf76b94aa1cab68dfe3957b9eab4eea53e7043367bb85fe6e916dfe
- MD5 20dc8b65815ffce83c954a2e05bdf808
- SHA1 22a428039f04f56f0a40962665496154dd3d4108
- SHA512 1ecb3e6f6bae231494d21231495b365440700ac2c1fcb43210361c3232c2e52d1e84bb0ec6fa754c5268b1b0d8153ceb3b357b49ee374a5e64748a1bcf4ab9a8
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23E9Q:t/sCv7rTiw2RYwZCUs23E9Q
- TLSH T17405291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 840KB
- SHA256 3ab6515a6250a61d968e571bd369b0f94c977b8d3eef338f0cbbdb9a40053f94
- MD5 eeca448e754e101bb582864bd9661fd4
- SHA1 ed2143f24e03e942a05ee749ef04e9405ec1181e
- SHA512 90de9a4a21e1f562d6077c53b53fed402f10bbfaa0cbff17c07fb7104376310c966350b4977f413559c48f7386092cb83f026b76e927d7227eee934cd8f9e7c0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23d4:t/sCv7rTiw2RYwZCUs23d4
- TLSH T1E105291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 840KB
- SHA256 49a175a03089bf2db711c861885175c06ffe728af135e06d95ee5a493f74d555
- MD5 fd89c089b3a482bd75222813eeb6087d
- SHA1 e3c7b70230ce9c3e1a4bf65ce9a9ecda1bf78b85
- SHA512 ce7d7f07cd9a43da0996d73151f3298142a899d16bdbb7694cd18474e82d50e6e91e58159350c24ee98dbc72f4fbdcc9da22b01509a42b24e8f9e5ebcf302a8b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj234u:t/sCv7rTiw2RYwZCUs234u
- TLSH T17605291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 840KB
- SHA256 40df460ec53e98f1cb5f94108e1878a49f387486265a3bfe747508a0aadfb7ac
- MD5 0929a3d585bb9ec12b8c224228a9437c
- SHA1 7c7b4bb836b5b7db1daba0168565177dc744a5f7
- SHA512 acce71646a9e6efc770b3df780af65deaa7d74e4e4295613e2f47f32e4741813894edf7fdde7ff448e94e8be08da0b7b2a741c5617ecb498b65beef9347905a3
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Zj:t/sCv7rTiw2RYwZCUs23Zj
- TLSH T12305291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 840KB
- SHA256 430ed31adce131b9ed9ba8f6a4b1cb918ede9d8f29dc77e63167b5421746bbf9
- MD5 a5aac99617530f17522ce0245070891a
- SHA1 c269697861ced34541a13cb339475a1d1366ff59
- SHA512 100160fbc9528704217edbdae74742e0b47d305a9647137f59ae5cf430aa9971752a5921d32e1f35717ce7db30af3850c1ff46eda5cf751ae6fae54be7149a61
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Ag:t/sCv7rTiw2RYwZCUs23Ag
- TLSH T1C505291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 840KB
- SHA256 1344556739f3c52ef79a623d4262cfe796ab3977131e9fb7f8bf417477f9774e
- MD5 a5f6fcb0390f07a91aeb757164693448
- SHA1 7c0250b1281be64144b2cae9722d627e387a6529
- SHA512 96a71f92fa81a9783536c369bd8ee4ba2771a84efd11a561dd5ee32eab3295c87adb5ce105630d650df79cf79d627ea9c037b555a5dabaf43768a33a97df910f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23vI:t/sCv7rTiw2RYwZCUs23vI
- TLSH T14605291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 840KB
- SHA256 6c9f8fefc75f8d92ac3ea8b01dae9f6cd2c4ef3c50f6fbe907129fcfd3981e27
- MD5 0528cb6c09d34b24777b091a2e678246
- SHA1 72e7b8ed84337a7c95746f3b360a9dd5c90817b8
- SHA512 40f6493980391caab8d97baf41d906a85ee5d99b4809e7d3332b09a24c87f5ae2774f0122bb0caf8e9e4a3cbf33dfdbd6fef953aab7c5f646e6ff343a39bd3ce
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Vo:t/sCv7rTiw2RYwZCUs23Vo
- TLSH T15C05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 840KB
- SHA256 6e1592d808b83e6598b7837b25627aef6b056f7767fef80d43a57d58c9058c1e
- MD5 47491c871c44cc6dc29622cd577bb632
- SHA1 14605af34c34d4d4bb80167cf8d55b5a3b0b0ba8
- SHA512 1bc9973357656810c3d8b3bea133c714065b4c67732e3fc24eb14d690cdafcd2ff6fc8743a58d80e3b23e23dadd9c642a484445966cb264cca04dc126c6d2d6a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23G+:t/sCv7rTiw2RYwZCUs23G+
- TLSH T1C005291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 840KB
- SHA256 fe966653207145f2dac94f31fbab7b233043b591ab5146a7c600348f2dec95ba
- MD5 69fe7115764fbb19ae4f14cad84f0dbf
- SHA1 39b2d832d8e46635566ceb4f3448fe25fe5203bd
- SHA512 c9332dfb1b56da088f6dd0a7088c1a42313b6047ece7a9ed9b1be0e9dc0a9f282e6b20fa3689d430656a68d81f445884d6d1aa5779da8aa2ea3ae2565c1451a9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23GQ:t/sCv7rTiw2RYwZCUs23GQ
- TLSH T15E05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 840KB
- SHA256 b50092f9814f5cef8814476a67477f59e9c27de1ee484fc45d2d18080736a7a3
- MD5 3de4f377c010ce8db440e614b5369cf5
- SHA1 44e4cbdb1368db86a70ba4ab6d8cadb7c7a51a6c
- SHA512 bfbd3c136fb881d184979c413c094e93d5e5fc580b3e43b7b8fa12422cdb8edfe6251b9a0a9cc6d8d199815351ea7aa9a07cc99e693d8ca5a86fd007a9ebe44a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23XX:t/sCv7rTiw2RYwZCUs23XX
- TLSH T19905291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 840KB
- SHA256 27a91c9d7d4f0904bbca8144453491b990c6c28776948bafa622d07f04ed3910
- MD5 6b6e58074b11806b1b2bb8fde6666748
- SHA1 9494f717e4385c08251990dba3c2a78a472541fe
- SHA512 50f73861d3c988393bdcb47ae7941aa4a8c44ae1e3afb0bf6f2454a287d0ab144160f2d0332c5c7a6841dbf12ce0f9a54f8379f7dc11fc7ca5b4935148b1fd56
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23NL:t/sCv7rTiw2RYwZCUs23NL
- TLSH T16C052A1766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 840KB
- SHA256 bcf1f3fae7e137b4a6320d0f2fba532c08144bda31c855375bad5e650bc7a76a
- MD5 18ece1ca72fc520a26ec5532bfeec29d
- SHA1 287f44a319d16cdc66cc48a59e1473f388efc02a
- SHA512 d7fd6660fc2a6f5eec676f23f17815fd682be88c7be137d52665f2082dacf057a579883a068637660aac53fd09911ace1c06446efbf250bad219111938e68a46
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23LFC:t/sCv7rTiw2RYwZCUs23LM
- TLSH T15405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 840KB
- SHA256 b56cac39f214c36aa38119a90842b7eafaf16d02d5d1677bfeaae454e9bf804b
- MD5 27e0aeb9cc1871919c1cc80380909bae
- SHA1 5c546e4a53a122c1ef11793a236cb750e34a2688
- SHA512 de7b21fa56f901cf8a52fa25e3084eebf925e0724e981a8d57a34fea1bd55f7236bfe34800f62041be53e53b025748ff41c27945ce39de19e988469e149d8cb0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23Mh:t/sCv7rTiw2RYwZCUs23Mh
- TLSH T16405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
- Size 957KB
- SHA256 2b70a8ba632b6649b97982d5c3a7a8ec518f1f6ca7bc7db3ca556bc75a4f71b3
- MD5 08ebcb1b458379d693dfab14234bb656
- SHA1 f8a0eaf66405a23b46e5f328c8fb5888b6ca1c5f
- SHA512 9245e7ed959dc2d733346870fb5308603b0b391d0912db4756fc388d49fabddb7f8b51539170c860cff9e3d864b6aa6cd0d8dde91d39285d11b418d06400646c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj23fKRu9:t/sCv7rTiw2RYwZCUs23uu9
- TLSH T13F253A1766EC4894E4A6A13489B54616EB72F8551B30C3CF12B88B3D1F63BF07D39B29
- MD5 SHA1 SHA512 SSDEEP TLSH