Analysis
- max time kernel
80s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 11:21
Behavioral task
behavioral1
Sample
2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 848KB
- Sample260523-ngc7eabs8x
- SHA256 0abff0a84a3200992ed527ab6e3b78c8ff51674b4a2ecb2fc58558b462cd2496
- MD5 21c76aa1755017a81fba6d711f021702
- SHA1 8bcf24104b1f43ec09c6d8f6bff24e10da2a256d
- SHA512 56f2440c372e00e593d2b6edd5cb428888bdd82bcc9902674022696292b53d58aac145a97fd841f8bb083b0c24492935438fc0ac7d576d616883845755dcc6c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGF:A3k03kHRJQ
- TLSH T16205AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 50 IoCs
resource yara_rule behavioral1/memory/4924-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024483-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2952-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4924-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2952-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215c6-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021219-256.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021221-353.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021224-468.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021223-493.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021226-530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021225-600.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021228-630.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021227-679.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021229-734.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122b-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122d-790.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002122c-797.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122e-828.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122f-859.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021230-878.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021222-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021232-906.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021234-925.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021233-938.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021235-957.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021237-988.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021238-1025.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021239-1056.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002600000001ff6c-1087.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123c-1106.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123b-1137.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123e-1156.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123d-1182.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123f-1190.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021240-1221.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021246-1312.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021243-1331.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021247-1350.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c0000000242d5-1404.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000202ed-1423.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000002038d-1462.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000020262-1505.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000020268-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002026f-1537.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020277-1556.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002027f-1575.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023130-1680.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000244c2-1698.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024483-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x00020000000215c6-60.dat aspack_v212_v242 behavioral1/files/0x0002000000021219-256.dat aspack_v212_v242 behavioral1/files/0x0002000000021221-353.dat aspack_v212_v242 behavioral1/files/0x0002000000021224-468.dat aspack_v212_v242 behavioral1/files/0x0003000000021223-493.dat aspack_v212_v242 behavioral1/files/0x0002000000021226-530.dat aspack_v212_v242 behavioral1/files/0x0003000000021225-600.dat aspack_v212_v242 behavioral1/files/0x0002000000021228-630.dat aspack_v212_v242 behavioral1/files/0x0003000000021227-679.dat aspack_v212_v242 behavioral1/files/0x0002000000021229-734.dat aspack_v212_v242 behavioral1/files/0x000200000002122b-747.dat aspack_v212_v242 behavioral1/files/0x000200000002122d-790.dat aspack_v212_v242 behavioral1/files/0x000300000002122c-797.dat aspack_v212_v242 behavioral1/files/0x000200000002122e-828.dat aspack_v212_v242 behavioral1/files/0x000200000002122f-859.dat aspack_v212_v242 behavioral1/files/0x0002000000021230-878.dat aspack_v212_v242 behavioral1/files/0x0003000000021222-898.dat aspack_v212_v242 behavioral1/files/0x0002000000021232-906.dat aspack_v212_v242 behavioral1/files/0x0002000000021234-925.dat aspack_v212_v242 behavioral1/files/0x0003000000021233-938.dat aspack_v212_v242 behavioral1/files/0x0002000000021235-957.dat aspack_v212_v242 behavioral1/files/0x0002000000021237-988.dat aspack_v212_v242 behavioral1/files/0x0002000000021238-1025.dat aspack_v212_v242 behavioral1/files/0x0002000000021239-1056.dat aspack_v212_v242 behavioral1/files/0x002600000001ff6c-1087.dat aspack_v212_v242 behavioral1/files/0x000200000002123c-1106.dat aspack_v212_v242 behavioral1/files/0x000300000002123b-1137.dat aspack_v212_v242 behavioral1/files/0x000200000002123e-1156.dat aspack_v212_v242 behavioral1/files/0x000300000002123d-1182.dat aspack_v212_v242 behavioral1/files/0x000200000002123f-1190.dat aspack_v212_v242 behavioral1/files/0x0002000000021240-1221.dat aspack_v212_v242 behavioral1/files/0x0002000000021246-1312.dat aspack_v212_v242 behavioral1/files/0x0003000000021243-1331.dat aspack_v212_v242 behavioral1/files/0x0002000000021247-1350.dat aspack_v212_v242 behavioral1/files/0x000c0000000242d5-1404.dat aspack_v212_v242 behavioral1/files/0x00020000000202ed-1423.dat aspack_v212_v242 behavioral1/files/0x000500000002038d-1462.dat aspack_v212_v242 behavioral1/files/0x0008000000020262-1505.dat aspack_v212_v242 behavioral1/files/0x0008000000020268-1530.dat aspack_v212_v242 behavioral1/files/0x000200000002026f-1537.dat aspack_v212_v242 behavioral1/files/0x0007000000020277-1556.dat aspack_v212_v242 behavioral1/files/0x000700000002027f-1575.dat aspack_v212_v242 behavioral1/files/0x0004000000023130-1680.dat aspack_v212_v242 behavioral1/files/0x00080000000244c2-1698.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2952 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4924 2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe 2952 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_21c76aa1755017a81fba6d711f021702_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4924
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 848KB
- SHA256 0abff0a84a3200992ed527ab6e3b78c8ff51674b4a2ecb2fc58558b462cd2496
- MD5 21c76aa1755017a81fba6d711f021702
- SHA1 8bcf24104b1f43ec09c6d8f6bff24e10da2a256d
- SHA512 56f2440c372e00e593d2b6edd5cb428888bdd82bcc9902674022696292b53d58aac145a97fd841f8bb083b0c24492935438fc0ac7d576d616883845755dcc6c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGF:A3k03kHRJQ
- TLSH T16205AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.1MB
- SHA256 b916c30bc32ed3331cd2c0e56d96197e030b7bdda07a07015e11b7a83dbe7287
- MD5 54ecbcdbfdd03ff7a80aab436f945782
- SHA1 2047bbf865a0abc41af5eb23043729303640327c
- SHA512 f82dc2c0a996a562f60761d9e5f1ec376b68cf43b40a339366ef8167e2d58f699acb798f788a2a09f4a8dbb1b1a44a253a3f2c533643a7cd76a48016275c1a9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGr3UNUpEisI:A3k03kHRJIUN+Eir
- TLSH T1A9458D17EB9808E5D11A817849D68716F772B8610B61D7CF2364832E2F37BD46E3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe
- Size 860KB
- SHA256 7142051a0e1ef2da30dbadeeab73d743169ad5dac7415bb8660a8c902fba25d7
- MD5 ca7680289fc2d3127e3208b29a80f9c1
- SHA1 ae3ca2e8866e8d16ab4bd9f84fa1117d476d4e96
- SHA512 f77f910b8127fb01e082d352d0c08bd4a7df4040336e0b933eb963681824c32dd66a5f3ff01e1a5ed6d67e67ed53c6585e7fffc5f75ca7fed5b538f3c6c9d743
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYG:A3k03kHRJ
- TLSH T11F159D13EB9500E9D10AC1749AD68A22FB75BC56176093DF2358E2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 876KB
- SHA256 54f4c39c31d65e40f730c8eacc469fe91d2ac574381f32bbea9fc505002f5853
- MD5 b9e547716575a7a730aad7a19ea059d3
- SHA1 40b833c2fbaa7f403a6078492876625828547d8e
- SHA512 9d05c6dea689f3e29117d610ef2c54d0c7d73ca46e9d45c857b94a687817b18af78cdbaceb69265741c30a44acdc95704629067941a4e0b00fde992acddd2a43
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGTP:A3k03kHRJk
- TLSH T106159D13EB9500E9D10AC1749AD69A32FB75BC56277093DF2358C2152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 894KB
- SHA256 21f838a5f981c58fd3f1857599eab29a45bd5a89005b6b8ad9f03773398aee26
- MD5 f4ab02cd7e18a1708673c89a83b2526c
- SHA1 2e55cd8bf893ce19583ad81ad2f9d2492a926307
- SHA512 1fdf57ca82e1d91ba89bf9ee7575d4bf973301e4bb76cb510a06b25ea639a5585293b5c99d23333680e5d1aa89c940deefb7f125805d828d894f638b21037364
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGI0:A3k03kHRJN0
- TLSH T19615AD13EB9500E9D10AC1749ADA9A22FB75BC56177093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 939KB
- SHA256 e7e728bfdf3a25aecb6eb5222c8e57c08f13daf17e103f110423e9d5f32e7946
- MD5 f980e9c2ad7d0b395cc665ed97ce5b37
- SHA1 361197faa097f5085b097436ab890e0f1d17b01e
- SHA512 1fb88a795172c2b224ca9bd2c10b918d4568b6007539444562dc73933a2409b8f1a8aebf89c9372612216e157012cd2eaeb9d11cf2df94ad3cc6cbe0122f32f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGh:A3k03kHRJO
- TLSH T14015AE13FB9500E9D10AC1749AA59A33EB75BC561B7093DF2358C2052F62BD06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 932KB
- SHA256 268fc96edec8a28f8e24de5dfbf9262802ad96bf346c5fede10d3f68de13f6f7
- MD5 32102186e7c804d2bf360fe22a4bbe76
- SHA1 0522779655f15405d29aac07e0844afe416b8b3a
- SHA512 0f604833540adcb5f10708de691497781237f50bda9bac934e0f51708da2efe305df927b970b29b25b068a1d8f2ba35ed7f889207c7a8bdc02f1a84691352b44
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYG072:A3k03kHRJt72
- TLSH T12115AE13E79500F9D10AC1749A9A8A32FB75BC56177093DF6358C2152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 900KB
- SHA256 79cc94e46eabc6013d3f589f92acf1d75efda49a1001e9904483671544b6534d
- MD5 35eb9d5137f0a8b8a27f772324965373
- SHA1 f293f7f9633ab0bc43c93b279cccc5633090a342
- SHA512 d5130a519613d4f4b345dc9311e6f187c461241054c6687fdcf3457e695d334056108927d6d2fe893f22d7ad85d39eef8ad7dbe55c99d7ebbdd44c2fad3d52d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGEfj:A3k03kHRJTj
- TLSH T17615AE13EB9500E9D10AC1749AD69A32FB75BC561B6093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 955KB
- SHA256 29a84324f901f8cf130c08390c5166c6914cea738921a12065fbb716d3e492c2
- MD5 8ffb61c9faa158a5a04290a57dfd3d65
- SHA1 8174b02a510e2e4131165ddc80b0e51d1fa81846
- SHA512 5d8fe97796c7cdd0ad74f8749c2629e58b57e6bed2ae44c40b39c9cd08855203319eade49cb13a1d6d2ebc5ed1fa9c99ab167aba4cd541bf23e3ad6060b1be3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYG5hk:A3k03kHRJsW
- TLSH T1F425AD13E79500E9D10AC1749AD68A22FB75BC66177093DF2368C2152F63BD06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.3MB
- SHA256 b2b64ad5c1cb554408b18703be7296e0a973cbf8a431e0bdfb6ae80a2cf776cc
- MD5 a5c13b3062a46bfc9761884f6db161ef
- SHA1 250e6ad6045cbe38c13a918b57933c29ea28867a
- SHA512 1d51f15b610fbcfb1fbf47b60d471e257c9d8574b4d28345fc80164e6b2a85d69183e1813ffdcfef44cd65496a18756f57fab92ce93bb006ef30207bc2261344
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYG9Ur2d29dBrtpDiI:A3k03kHRJ8UidGl
- TLSH T19C559E03F79404E9D05AC1748A968622EB76B8561B70E7DF13A8C2252F73BD06F3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe
- Size 969KB
- SHA256 7921121d351d8743604da7c1124b893319a443e12759e9a9186c3c5ec1d21f87
- MD5 7d45be264e477430342968ed1c516c3e
- SHA1 2211fef83e76de88f443bdaa9d017fa595bff42f
- SHA512 799a7f851ffc7f0b2586951930dfb355adcc660591f8c7a717d9d27a269258a92a71852d4b410f40135b883b34e34ce55033699e73696cbddcfaca394408a1d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGgGen:A3k03kHRJaI
- TLSH T13B25AE13E79500E9D10AC1749AD68A22FB75BC661770A3DF2368C2152F63BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 23d8a68e66938e570d37c4d26aa34d6c9eafc982de6106bc089a51bcecafa7b7
- MD5 e1995d5684f0af353aa95348dc318e70
- SHA1 9a506801c1c6e51e05908c539671e4aaa09d4809
- SHA512 5f30a90a4e22e6ffdf2ec32f25e494faf08dfbac5d6cdf484c887c83651aeeffb8f07446cc97877d40df075e20520c798751cbd231fca28b0a5acc3a3e85e148
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGB0Le5ji0hmxNrM:A3k03kHRJoPji0Aj
- TLSH T1E5657C17F6A402B5D027C0B9C6D6966AFA713882173086CF1359C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 895KB
- SHA256 daf9e1081af0d84fe6343d0d2a3c32091af3b8804e941dbe180060251f665c75
- MD5 de22028600b53aa0f155812a1480460c
- SHA1 02511b0ce78e31624bdaca2a0a2535fd5eb6c99e
- SHA512 b08c2444ac38d813ea4be1b58109ba50f53f0a8a9a4a9d647f041e39ce609c2c2351b43bebf82a199792bb4ce8f1211635cdd1d53b0930f02143a37f225165dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGQb:A3k03kHRJxb
- TLSH T13A15AE13E79500E9D10AC1749AE68A22FB75BC56277093DF2358C2152F63BD06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 871KB
- SHA256 444ca60acf9f396a03b4367616a2fa16f96bd82f6ab24d9dd6c5c654092ba8cd
- MD5 1a9cfdf3f7ff310f9660770fcc822894
- SHA1 2d5043e7e6115b870fb68ef696bee592098dcdaa
- SHA512 6636130b57302f3bc386b24e23d42918c3c9566ae7d37522345538932e837cada92de45cde3480e3365d94ea4851bbf87ff92ff1840124b8b0196f1251596e2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGi6:A3k03kHRJW
- TLSH T18F15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 871KB
- SHA256 1f29367968bb47d353b4b8c2f99325429d6e34b66a705ab80a94c8c2e5a00ad4
- MD5 cf0880aa511fe8cb603ac77f80458719
- SHA1 94f2013612717edacb54c4a6e458de07917f9910
- SHA512 302395007cd17f0104ec7c98eea9999f5593ddfa408fb98a8f78c1fd3cdcdfafddb2f3ad6ddf500fc2ee265299ef5da13f62bb980f2e371355f5219a7d81980b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGC9:A3k03kHRJB
- TLSH T11B15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 871KB
- SHA256 ebc031a64663562437521ed7e2b676bfe2a76b7dfc580c8e6d7afb4defa44137
- MD5 fdd66a2157f447c058f2f1923a66b7ea
- SHA1 ac07e965bd69f443f82bbeb6aab4462da23833bd
- SHA512 31a7695e22703004ca9ac4a46065535d7cbfc1672d435f6410eaa256ae9d8f7e8c38dafe3c81759baf162e7edf80dc38a9a608780f708bcdc33fc8180415cd04
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGCc:A3k03kHRJU
- TLSH T108159D13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 871KB
- SHA256 1df5b1f766e613d4581e355b256f5dd3834ff96197e69eac9cdaa7dd7bc62224
- MD5 856827dbfea63a94a53e9b78ffcc8944
- SHA1 4c7d299f57991264aed9a0588742104e303f8daa
- SHA512 a23cfb212798ebdf7e47e4088ba4589cb2a7b922a76a283c7f369695698bb71c8d4ba81e35cc137c5af4f3126d6306a5b9758a170f906bf2ef7c63ec46dd7edc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGLp:A3k03kHRJC
- TLSH T17615AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 871KB
- SHA256 5d67aa9092072ea1145b7764ac7f621f255b7bc4f1fae7e970e3012b99719570
- MD5 5b82685f1387765f660120edda0a47f7
- SHA1 513365ba909e7cbbf9f28d161d4f9cad69ef6264
- SHA512 9fccc6d145bb349d96e73f390237306d3214e33e7c09c144c4db92824f2d2c24c01bbc0be74a2429e4bbca496a15475d885ae1c8ae883c4c4f25769fe69078e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGcN:A3k03kHRJl
- TLSH T11D15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 871KB
- SHA256 c90ab45096482e04b9419c3ae57be11689bd7dfdd5f2349b2f0c185b2c3c2bd7
- MD5 6a927ceb2e1029aecbc9a3a35ddcb913
- SHA1 11267ecbbc0829aec02cac9045da6260e07b61a4
- SHA512 1ade67658d9af702cf4f888e00453384d7723b76b1011005694b4f61f15982305d42701db181de267428a4a5afc0aec13ed6fbda674bfa46f3e9a2377078e3e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGEF:A3k03kHRJv
- TLSH T1BC15AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 871KB
- SHA256 869c94dacac9654974814a540a545350516b98ffa8b78a5731f032170ddd8b56
- MD5 ebe68b712925420bba807c04e5c71817
- SHA1 067c80c91941ac2406fde81493cc2976c0c1abaa
- SHA512 3b3fb35b0c4a5d678234794c58adbd96dae28c44187c4d022e7fdf8a0d6a58a3ada29a9577d666366d4453b1e0d37029eeab87d993669c1679d9f9eccd62aa00
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGhC:A3k03kHRJj
- TLSH T1A915AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 871KB
- SHA256 b65168e407ff90f35491874d921ae6c43437c630c94fe28dc5e5e5cb6e87332b
- MD5 5a1df5da5e8952ac98e47c6842824941
- SHA1 7beb8f163ee4793f4cfb5497ca94c911930badbb
- SHA512 3bed312ebfd283e1d1ad4ad8d2bc997feee0567d53c64e33dc4d9422be69fdedafc979f4398969dd47286d31e6a3bf7402050bd2c3b231f9e4619bfde97dd20f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGiw:A3k03kHRJm
- TLSH T1AD15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 871KB
- SHA256 d553bff2ba4f85619773497314fd2877695f249a8a22c06b7e27468cc8d2419a
- MD5 a60f864df65e4cbca45e1a5b00806be3
- SHA1 8a3b6c29da9172844ab026c06fcde367e82e61c7
- SHA512 4675c3fe66e0f33c27c5b37825476d9cd0c093855ec5a2fd9d4f3d0abf3a9bde8a66bd464a0e49b0b092ebd0782a7a1381bfeb4cc6978ca1c723f1f469c2ebc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGpT:A3k03kHRJm
- TLSH T12015AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 871KB
- SHA256 d099d061175f7e5d19b0f7f11eed56b9cf541987b2a9704bd7af29bffbac0405
- MD5 913c50ea7f9f1f7fde08716fc6ca99f9
- SHA1 4fa372d8a6bf5de6bcade87bcad2c16785ac6f51
- SHA512 101d6723409ddca20fb90503f3eaa29f63c77a9151458f5e11d8caf74e7ccb75eacb200eb7bdf0b46b4c425e7b173d72b78e31cd0e6f4e44eac8e6ac6300d0d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGHu:A3k03kHRJB
- TLSH T13E15AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 871KB
- SHA256 bf15ba31affbea7d546c8756fed89cac546d35af6716fbed4980d824bd015c06
- MD5 1584c69949249ca614f44c4c3542399b
- SHA1 d191c2cb1d4168310bb4d284adc0da9afb2c1fc1
- SHA512 11fb66c1fbe15b39ebe59177b45329463e33f24e7694a79df5532a263c1ffbf3cfff1fcd5bb97701fd583cd7198a0f756a4fc95c636b966cee6f9d0401d18085
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGbb:A3k03kHRJg
- TLSH T11F15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 871KB
- SHA256 74f68f6c46bffb96e085970af1b545f1e8fb7e3bb70c99bd9934d17e3a7c47c2
- MD5 b50d72320c8b9f7abdcbc63cfe08d309
- SHA1 62516cb9cfb2518501328f26bdcf2bd62df7a7a2
- SHA512 1e1b55f07ce1fc2bcc34099ad0ae1dcfe1fec8ec62cb545e9d82f2aa97b789912861c017997dd75b741644f10115440f345678e48dd56437e15ff6f32ee4b4fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGvf:A3k03kHRJQ
- TLSH T1BB15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 871KB
- SHA256 81f3b20c9407531d28338e11ec16ad9ce8b637718fbcab0c99a720845671732c
- MD5 5240bda0f26879b7c1835938c16dfdf7
- SHA1 7b79a5e54d5b11dc98d366c41c0baa73ed2d7582
- SHA512 f3372e5578fad88b60278787ac541ce52793d0c5d1c310689066e64c6b073ccc504c791af9c7de2f345cbcd67928c7e1263c27eaeb01824d381cfd01e85ce47e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYG4K:A3k03kHRJw
- TLSH T1F815AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 871KB
- SHA256 5c08a0e7c3a1c60e0546d9a4690d12ec538858608978f90b4876b3eaff04f2f8
- MD5 65e71c26a3683f992303b6404642f58f
- SHA1 c164f21e7f35cf696c14ca5ab68e531f6bef1db3
- SHA512 cfca255c79f272a15ca396207aa12685ded3bec8c39ad81528476ab4adec51ef8b0ebf7998320b1bc3b19e2aa880995a542ce2fd65589718e6914368ca040f77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGlk:A3k03kHRJZ
- TLSH T1F215AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 871KB
- SHA256 214c8bed0a5bb7bfea64c736364e304e205d0cd437086e05c88a192b8302c15c
- MD5 de1487f5e28a7dcc2044bb1003764262
- SHA1 b97e91fdbb38a777f7928eab255ea9db8946925f
- SHA512 ced8aebc6dc8b29d1c73ab72d00edf43253b66ff7c209fc7f3fa35c53f2fceaf6852c6c8dfacbcbf6de32badbb8967fa193e232bed3c55989ce8c1096fbba6c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYG60:A3k03kHRJs
- TLSH T10715AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 871KB
- SHA256 43ca47395e7e38d99f8c81969517a716cc327021588f75d3582e9cae5cfd9317
- MD5 0579b7e68f2c75c7fd26ce77885c81df
- SHA1 feca03b9ffeeafc12af73036d2e476373cef76d0
- SHA512 990a01e75defd7662adb7202067fe88510724b9c7da8bc31aa01b50ddd2af35537c65ea847e7a9f3b3faaf682d2f8d6b76f07ac7acf7425de2bb3138ae92499b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGpg:A3k03kHRJR
- TLSH T12315AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 871KB
- SHA256 fb00b26b41d1353597a13649725c26304fcbab93e7b5b6e1467e43f054c86efd
- MD5 8a362f7022f873e9662928c3a2411781
- SHA1 1e755ee49b07917dbfc95cf4269655b29527bfae
- SHA512 da6f8d793b2b3384e48d6897d3c7ea1a338a865738bbca76d13538329fe86d9c7e3f37cbe1e449f1b228fa317e9017873be243784fbc9b79f82e2c33a85b5c5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGQr:A3k03kHRJ7
- TLSH T1AA15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 871KB
- SHA256 e7ae91991b2d95d780747b8657a153acc161ad0a674d86c7e89c22bfe1955ad8
- MD5 e74ed2b78e8b6a32de6d9d66ac6a7bec
- SHA1 a0fce7702b6d611a280b791c69bb5204a4234852
- SHA512 c44002136c3dc028578cf83fa8920939d745d9d8264f3467c630559ed7b832c7c85fb3c7ce74b1489d084c46b6d8f2a8b37ac5e7fb1ee5e8498c2679027ca8ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGOn:A3k03kHRJN
- TLSH T19D15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 871KB
- SHA256 cabec1857c7f8d220f5c8b160a6f2499a17303ca10f4cc019447005cd1d75ab4
- MD5 e351efeb148258b21ac3080fcf30376a
- SHA1 4d225b9daa0bfc121dcbb5842615ad474b279115
- SHA512 0b0ed8aa2f3080b1e7fffc52d2529a7e683e356506c4eb528560845ee17992ca20faba7b7eee1fa08d7655e8ccb7f569635ca94aea158ecc74186ad218ba350f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGEx:A3k03kHRJz
- TLSH T12015AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 871KB
- SHA256 00aa3fd14886c56bb91ce23c8d0629cef86512db96c9b752b17be261c1a7247b
- MD5 f8104ee2c9ae5309ba08dac276fb13b9
- SHA1 be4519e27213de9980e2b3b8356a2c65bc65b308
- SHA512 ebab074a84befa3128dde9b3cd1b95f392fa218fa0b005a1f7eb565e7a9b4dca3b8cc354d2769851b5e0b564fd7dc1e2321c080f9ba6f26d4d8b96021bd118d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGOA:A3k03kHRJM
- TLSH T1A915AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 871KB
- SHA256 d70b9e1757c44dbc9ab343ad97a3db583a82f8ee339974a65c12beaf05682294
- MD5 41bd06ab27c5a2386cb923e8633d5947
- SHA1 71fce4fc5e4381c361955a15e343a4b396916871
- SHA512 70be869cce9af855f413eaa52ec46865d61f23a13cf32c91751c2ebfd6a393396ed52ff7d099117e854460e224a2079412648d392b4bf17e19d6a716ee3c08fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGH9Q:A3k03kHRJt
- TLSH T1E5159D13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 871KB
- SHA256 02cd2cf8599a9af71e269e0e368d8ea24310da5a5456777f221358fc3f394ff4
- MD5 9ab8df854fb277ed217e51b395498918
- SHA1 3d50be4367fa7c2b44bba29f4e05a84044ed6f2a
- SHA512 c1583b57f4b68720c39954c16640982130a2e6666ce029d1f9899cf57c819492e5c93c21b4c49a161041dcc82a5c0ab64d44edb19337fde9fdb7aa689c136c6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGO4:A3k03kHRJy
- TLSH T1DD15AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 871KB
- SHA256 2bb42f2a70cd57ed888596806aad8f86775cab086def0c39b4354f3530a7f96d
- MD5 ec697ba8d5748432c111ecf76ef0128d
- SHA1 5721f1ea4d2d0f123a48bea51c34a7d5264c1abf
- SHA512 b037e30e09deacd1f21267c3ac11242ae9f17ec33c7d998083e9568a8c6436c8f6772b7648e8353863cff8ba8274a786012006e817810d92d836c46039cc3ab4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGtu:A3k03kHRJj
- TLSH T12615AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 871KB
- SHA256 5ebc4b4b96cafbf89117489f5c05748e6d2e5d619aabbf59649047f4ae133d80
- MD5 18006036ded88bc6b54be5a2e8f97662
- SHA1 8295e3aa7e2cae893c06d739d9f9e26d95ea5060
- SHA512 400bb746793bc162ac56efdd921a02df8551d08b94da83d0fa9e77f045214f25ec82ba8505075af5156abf49487fb21606a581d739b31a60f3bcf7a5bf93a8af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGgj:A3k03kHRJN
- TLSH T1B915AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 871KB
- SHA256 e8cfc0fc08cae84a1ac898e395e77f685dcddfe5cf0c11226de626237b49c81d
- MD5 35019383a46d5ecd89988b2c0a45a0ea
- SHA1 e2992e9a7761469b2daaaf2c1785a62ecacb6c91
- SHA512 dae50fc8e239e3b87e8fb93e3a52fca0754f2e25b53299e98cb9497f0dd2321691b0c2e428d1d24311d57b174f7dfcee6a96ee10b118bd26d3142719bbc5a8ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGRg:A3k03kHRJR
- TLSH T13C15AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 871KB
- SHA256 c5a7bcb661e5fe630efc2a7fd9c4af483a61e17180fc94c85b9f7bf2bd313219
- MD5 09f375e544841dcc6a48793d418539c5
- SHA1 5bdb952e3bebcdf16b5aa7bde028a756a7a112e6
- SHA512 71ba63cfa29f7fc947565d5e81e170e09ea2ac755615de8d7d4f6c870d202fa1c0e1ea94bb33fbd63de10d97fc500c94f870f5cb354d8fc9f7e1fb7967aa37ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGII:A3k03kHRJA
- TLSH T10F159D13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 871KB
- SHA256 a3f66aefcc3645f505a6bddb9e114728f8b7e5b57e6d2ecf49d2f807641f6a44
- MD5 66b2bb781ab389667f6f2cc4365a60eb
- SHA1 85274f29c32ea46ad82de29787acd7df05ba69c7
- SHA512 1d68cc67c423a1ae3a23fb8f4e03605da8d6419250daa4261075977db664b6452e5e61f88ab3495dc5d69f6cd1413591329c1cbcfca10500443ad5e41f601839
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGqo:A3k03kHRJi
- TLSH T18215AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 871KB
- SHA256 58f60b1c05fbd6419a3c0494cc73d26ff2712767b1801ef8d2eace8c65f23f81
- MD5 bc51c46abc81d74234cb34acb48aa664
- SHA1 13d176f6c4f5cd7c85cfb0f84a25aadb2d8ef649
- SHA512 ae0d514ee24a13616881f720d7762205afe7036411d7342727a7ef0d7c3ce9b0c3d7f76c6ed7706210f087858064be998002986d7783e6759a01afd2f94335b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGB+:A3k03kHRJH
- TLSH T12015AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 871KB
- SHA256 ed16c7f757ce087a27cb83978b1d14e4f7663773578549f356b573bfb39e02e7
- MD5 ef3e283bf318b0e0dda23d1b498a8773
- SHA1 058d1a7e560be53ac90540b6646b624d070d36e5
- SHA512 63a273dd5e3427ed2d13683096d86436c559fcde45a351c23eeeaa9d2198453aee0d06c242defdbb9a52dd881e9337a0dccb5bdaf045ee4fd397e2d74f82b866
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGPQ:A3k03kHRJz
- TLSH T12615AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 871KB
- SHA256 c42759d4849a2e6fa3bded6c31b9eef75f7e87d5938bf34a068bbae2ec23d1db
- MD5 43c0888be596b23ec670b7b9438af081
- SHA1 9e1f60a495ebb28705f2af6a9174257cb87be851
- SHA512 40ccc478dcd26a018cec65fc1d7b1d0376aa8361a6beba893366f559c9c28adff55869e482f8fa8ef41e1dda13427f2c6a2fbfc34180294bca936df7e5516b4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGUX:A3k03kHRJn
- TLSH T14615AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 871KB
- SHA256 9d19748ff9c3541be394b0030d8bf2ac748f1848bf9974e2922208f9bec43d33
- MD5 f7ac49c6e531372955cebf72e934b28a
- SHA1 3ed3c5a008567ef07f2c675c1ea6718a47caf074
- SHA512 ba134a28ae3271f67379b62c6986751b76d99a078e2c51ff3241ae5e6bd121c0be026c2534e38884236c9b055901388ac353549a9d5e44e2e08646d03c43bc43
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGyL:A3k03kHRJJ
- TLSH T12115AD13EB9500E9D10AC1749ADA9A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 871KB
- SHA256 2cc809973112829e539d0d333dc680537b015efb18600cec5695d603f4b49d31
- MD5 2aa351a1c8fc68b2a8948e813f5a6f28
- SHA1 782955f333d4f5127fd8c96bae45358fe7b00b29
- SHA512 986c123f8959caf66979d322f0df0204904b5ea447a2a3519b3dd958ad17374e14659f8e1c745d4ee42ad9c48b61b72846c449f0eae14e80c2bb35cac51d6f18
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGWM:A3k03kHRJw
- TLSH T1CF15AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 871KB
- SHA256 b8cfe463b4943ecfd5d76f30400c4bc2e37a99352b57bc61a5b0ca48bd0819d4
- MD5 dbc4cc3723f930f60bda614e13901eaa
- SHA1 ea9ea7a583f455398d0ee2b22945c8fde1a4ab4b
- SHA512 a5a73b9e9549fd1251f83bbcb0f27cc3a2b8421465be8c09c66db9af8d538f289a08c97f0f4c46e30c6af9492d29bd0ec47d29524093b78f614a8ba94e4c597f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzyYGfh:A3k03kHRJi
- TLSH T10015AD13EB9500E9D10AC1749ADA8A32FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH