Analysis
- max time kernel
81s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/05/2026, 13:20
Behavioral task
behavioral1
Sample
2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 928KB
- Sample260531-qlacesg191
- SHA256 7ec9e817b3f4b78c54893c403748e9c07f729ca7af411e1c4eaa937d8c36a1a7
- MD5 56e76e089d9cb65b3ccb8dc9c0fdca74
- SHA1 3746633437f6d40fd49bef81d476c0b3830117bf
- SHA512 5aba1189a660d93632c9ce535a29705deee5b686b3b445142d5333aac00f93e9a2ac105cc68c6c088f4fbeb1a465cbac2c52cb9cbce39ba8eb2807f7de460555
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7w:A3k03kHRJD56rz
- TLSH T1C5155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 45 IoCs
resource yara_rule behavioral1/memory/2288-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00100000000243b1-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4156-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd5-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2288-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4156-42-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021657-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002353d-152.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b2-281.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002354c-450.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b1-499.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b3-518.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b4-603.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-634.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b5-714.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b7-740.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b8-771.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ba-802.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bb-833.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bc-864.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bd-883.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212be-896.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bf-903.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c0-922.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c2-942.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c1-962.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c3-993.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c4-1054.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c7-1061.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c6-1098.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c8-1141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c9-1160.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ca-1185.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cb-1193.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cd-1225.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ce-1316.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212cc-1341.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d2-1354.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212d0-1385.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d5-1386.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202e7-1477.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202ed-1514.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024423-1807.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001ed3f-1942.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00100000000243b1-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd5-40.dat aspack_v212_v242 behavioral1/files/0x0002000000021657-61.dat aspack_v212_v242 behavioral1/files/0x000300000002353d-152.dat aspack_v212_v242 behavioral1/files/0x00020000000212b2-281.dat aspack_v212_v242 behavioral1/files/0x000300000002354c-450.dat aspack_v212_v242 behavioral1/files/0x00030000000212b1-499.dat aspack_v212_v242 behavioral1/files/0x00030000000212b3-518.dat aspack_v212_v242 behavioral1/files/0x00020000000212b4-603.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-634.dat aspack_v212_v242 behavioral1/files/0x00030000000212b5-714.dat aspack_v212_v242 behavioral1/files/0x00020000000212b7-740.dat aspack_v212_v242 behavioral1/files/0x00020000000212b8-771.dat aspack_v212_v242 behavioral1/files/0x00020000000212ba-802.dat aspack_v212_v242 behavioral1/files/0x00020000000212bb-833.dat aspack_v212_v242 behavioral1/files/0x00020000000212bc-864.dat aspack_v212_v242 behavioral1/files/0x00020000000212bd-883.dat aspack_v212_v242 behavioral1/files/0x00020000000212be-896.dat aspack_v212_v242 behavioral1/files/0x00020000000212bf-903.dat aspack_v212_v242 behavioral1/files/0x00020000000212c0-922.dat aspack_v212_v242 behavioral1/files/0x00020000000212c2-942.dat aspack_v212_v242 behavioral1/files/0x00030000000212c1-962.dat aspack_v212_v242 behavioral1/files/0x00020000000212c3-993.dat aspack_v212_v242 behavioral1/files/0x00020000000212c4-1054.dat aspack_v212_v242 behavioral1/files/0x00020000000212c7-1061.dat aspack_v212_v242 behavioral1/files/0x00030000000212c6-1098.dat aspack_v212_v242 behavioral1/files/0x00020000000212c8-1141.dat aspack_v212_v242 behavioral1/files/0x00020000000212c9-1160.dat aspack_v212_v242 behavioral1/files/0x00020000000212ca-1185.dat aspack_v212_v242 behavioral1/files/0x00020000000212cb-1193.dat aspack_v212_v242 behavioral1/files/0x00020000000212cd-1225.dat aspack_v212_v242 behavioral1/files/0x00020000000212ce-1316.dat aspack_v212_v242 behavioral1/files/0x00030000000212cc-1341.dat aspack_v212_v242 behavioral1/files/0x00020000000212d2-1354.dat aspack_v212_v242 behavioral1/files/0x00030000000212d0-1385.dat aspack_v212_v242 behavioral1/files/0x00020000000212d5-1386.dat aspack_v212_v242 behavioral1/files/0x00070000000202e7-1477.dat aspack_v212_v242 behavioral1/files/0x00070000000202ed-1514.dat aspack_v212_v242 behavioral1/files/0x0007000000024423-1807.dat aspack_v212_v242 behavioral1/files/0x000400000001ed3f-1942.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4156 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2288 2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe 4156 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_56e76e089d9cb65b3ccb8dc9c0fdca74_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2288
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4156
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 928KB
- SHA256 7ec9e817b3f4b78c54893c403748e9c07f729ca7af411e1c4eaa937d8c36a1a7
- MD5 56e76e089d9cb65b3ccb8dc9c0fdca74
- SHA1 3746633437f6d40fd49bef81d476c0b3830117bf
- SHA512 5aba1189a660d93632c9ce535a29705deee5b686b3b445142d5333aac00f93e9a2ac105cc68c6c088f4fbeb1a465cbac2c52cb9cbce39ba8eb2807f7de460555
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7w:A3k03kHRJD56rz
- TLSH T1C5155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 957KB
- SHA256 e28fd2200e3252c9d5649aa2c7d0b4b18987d55ef7a545675a70bd372563467a
- MD5 6393d5ec9803c87d5de796404f057394
- SHA1 36feb04055a55d7422299eece071d43579cd4175
- SHA512 9f819c1e0fcf444866d287178c07a5669ca340c1188c09300a14fa5165b48992c8505203902be098d97b2f60ab4e5dff032314e696f1405078139081f5a1a461
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7CP:A3k03kHRJD56rd
- TLSH T14C256A07A6890FA8D11FC1748A968662E7737C121F2093DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 974KB
- SHA256 3a4e20f2d1f9de1be60ff69ce247153c1bd1adea836580bb3f2e829148aac0f4
- MD5 6bfc76a1cb995a10d8b8f4ac239f3435
- SHA1 10b3f6bed63a1bc985af225a18d37622617e86ff
- SHA512 7b3ec250f1341055f93319ac15541b43ea32dd21439f5dab53738b32859df38b8bd086dbc998e15ae06a3addbc08d48a1c76d2116009b5f0cc6a00e4e2c3d2aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7t0:A3k03kHRJD56r60
- TLSH T1D7256A03A6990FA8C11FC1748A968A62E7777C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
- Size 1.0MB
- SHA256 e14842f1e07ce2b1a012f86d11d6c1598da1e403723dc75a275ed9b8dbd7869f
- MD5 7cdf79e52fa8c4e2128a88a9f532b15d
- SHA1 0018870d2ed47f759a0cfa18719a94ef8efa84be
- SHA512 e44241a71f9776deff1a4fe964ff22201424529584c6b491adbaa4507db8ca51f04a7675131876322895d4a7756f247318fed23df78b4422832abd19b8cc51e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7oTjE:A3k03kHRJD56rRw
- TLSH T16F356A07A6990FE8D11F81788A968622E7737C121F2097DF1354AE153F32BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 da195e2a0c37d752a01d82ce919fc7f8d8bc2289d7aa1a15e9bd99c90014d9c5
- MD5 5600caba13142fe4b256d4c4d3e65113
- SHA1 cec9df0423db3c4d2f00ed61d8b6b380ece2d8b6
- SHA512 72587ee7779ee9d053709934584bfb060a3a2fbe005141e89396930ad775a42f7f6e42816fd21a2909d920cb28407b4a8be058964ad0fa60e62a88c87beb17ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7I0Le5ji0hmxNrM:A3k03kHRJD56rvPji0Aj
- TLSH T1B4655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 942KB
- SHA256 84bdc68be7ae310cba3d20584a435776e49196c4603f22579662861fd4c3b959
- MD5 2154eeab43bd092adb4370c1697240cc
- SHA1 6b0ac50fc6666080393feae04113e8ced7eccb61
- SHA512 cbae386077f8e8f334cf0e29b4dd5b9e3f661f2832ba54ca52e6ba9b3abe10b793a01b290addaaaf9c71d2c04e3f4fce299ac376f23b7b537a82f3982bfae7a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7ya:A3k03kHRJD56r
- TLSH T1F0255A07A6890FA8D11FC1748A968662E7737C125F2093DF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 976KB
- SHA256 5839aa85cfb292a739d87a31e8eef2461dad4bc36a61fd309a5bed1c8d1af885
- MD5 79996301caf383dd0b2a1d99778749ec
- SHA1 617f71dd7da05b285354d9db30d59722a7c8731f
- SHA512 23fbc709566fb12fab5f657ce9ce2e4c70d644ab34060190a26f6fbeb569a3b4a73d93ccbc46afaae55d6a593412e2f8309e6d7dd88f8d4aba05be7580ae47c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Rb:A3k03kHRJD56rSb
- TLSH T1A5256A03A6980FA8D11FC1749A968622EB777C521F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.0MB
- SHA256 f622b40658a2659c4e6d0dc7605e6cfdde5aecc19550102495478da3fbf7806e
- MD5 6d61d887349c304ebfb2fe9b50bbb9dc
- SHA1 26700074d470dff01659f3dfc3e445232dbfbac9
- SHA512 01e22078512132811346dd0a08004be757d1fd9acc186c7bdb048e7b924d8363bbcf81a3b36d768d4e944ad6a14fe41010821f79898869207abeb110f5e2767e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm71D:A3k03kHRJD56r4
- TLSH T1F7350506E2980AA8C01F8174C7964662F6737C155FE093CB13D4EE3D3F72A906AFA657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 952KB
- SHA256 c3e1d993bb28cc0607111d836bf7f4e97fe1c58929b9de4ee55a08a334a899d2
- MD5 19d74dc5cb97cde380e136d9ca2588a2
- SHA1 531c88d7d6ab89ed870736e0ca288f7cfe9693a1
- SHA512 238e86e93f099857a57ee649951cfba793969164da2fa1d2d47abecf49a097a0cd38c23b948c2b5177a701bb06fb906657798cef66db55fa72031102cd77afe7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7j9:A3k03kHRJD56rE
- TLSH T1E5255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 952KB
- SHA256 8fcb2a98be6894e5f2dea135a98e2d5ab2dcb3e14d229233ba943715f76c04f3
- MD5 7df40a73c10bca5d63ddee2e28e8f00b
- SHA1 50d4205abc8365a95a7c62e0133ea14e6513bd31
- SHA512 4a6bf948f5b853258388fa3b1daff936a337c9eb1ae533253569858cad1e00df583a29e3993e7b64f458d938b8d76a14c5b2945bbb2f09bb44734e707a535505
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Pc:A3k03kHRJD56rt
- TLSH T146255A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 952KB
- SHA256 d3c155a41621e96349ba0e72e3f6fe05a077597c4a5565438e434af075263115
- MD5 3118ae7e437a78e165d5fc1c5dd63db8
- SHA1 a0eefe5894027e13f8991b1f591869fbd09f42d2
- SHA512 7ec8d60ad8aca0a02641fa1378d6bbe676de4424008647b2c3a51bb7a38b75613c1c1756e9bf4d75a814188c3070238ec46f8028656f8197ccbcb03ab9a26c94
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Ip:A3k03kHRJD56rz
- TLSH T190256A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 952KB
- SHA256 ccbafea53211339fc0e71407231b029ecd4a3dedd61a82509522006f0ff02075
- MD5 ef184e09b97caa72645cb6ecb4f20415
- SHA1 b25437185fae1a197e6b8a8032c1278088dff9ca
- SHA512 7fcdc82bbdfcfab584f6c1c0b8871807402d78af09fe5ecf6cfff9c3ffe10c00570f3054de35a95bb2464d1211323d47fbee9e52d81511b99a666a737221a851
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7fN:A3k03kHRJD56rI
- TLSH T1D1255A07A6890FA8D11FC1748A968A62E6737C161F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 952KB
- SHA256 75d7d862ca7692a6c0bb7d2ded6b924624e912e565d91cc24248510ff39c7d0c
- MD5 6a5a568fd776a0c7e707221bde809e16
- SHA1 e22f58feb6cb4d4c3aa06bc6c8ffd27bc0141d01
- SHA512 2dfd95cf8f6e74233ba29d0a33f8a31de5a36ed529b8a66a0ebc6df6fffa849e97d1903774e1564d0eb6b4a89904ad382328968726599989fe2d4a731a7928d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7dF:A3k03kHRJD56re
- TLSH T157255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 952KB
- SHA256 569fbb154806f861589f2824d79f75ef5397236ed7409b333b0defceaaad1459
- MD5 367910526360dd17ae3ffe94ec3c4b06
- SHA1 7adc2d7f199959e67b6462cc5e7dd84d181cc187
- SHA512 2d468d8c27ddbf4faa0705165b6a4738dd369771ea79839f096efede75a1fef732988de6db70e245abb504ec51f1cde3bc788d9f2a144ba80afa467351bf2fa3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7uC:A3k03kHRJD56r6
- TLSH T17F255A07A6890FA8D11FC1748A968A62E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 952KB
- SHA256 f02e91e16d0651f5b872c8fe625e6d5db3a391198b50ef0c899e5955b525a157
- MD5 a9ac2478b0c7bea62ed904ca34b7e0c9
- SHA1 614e1fa46dce31624792524daf5eb31595618ef9
- SHA512 76086bf153e4e8f080a97febbf05c0e0363655382c35a46f2b08237f6b58c2bacca5757727e4443793ead1b8abd86d4e725cc3d014c117b72524d918878cb5d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7xw:A3k03kHRJD56rP
- TLSH T164255A07A6890FA8D11FC1748A968A62E6737C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 952KB
- SHA256 4d24fbfe8651610a2b7aa7e96c9c3dd376223e3fdf52365f89f70f2c2b8c181d
- MD5 0c6697fd96e9ea48314d3f68411f41ca
- SHA1 990737a9a3d9021cc9080165f72a86553e1c1a20
- SHA512 31d20f3138767c9917dd98d814a01009bcaf8e9b61a2a77335dd2cd962e911e238c364bb549e801d0121ad3681635c2581ff5937e76cb8186c7c6abedcc25b06
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7YT:A3k03kHRJD56rr
- TLSH T1EE256A07A6890FA8D11FC1748A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 952KB
- SHA256 e8760394ebe589a7d29cd7299342f8bb143c3dc021fab8924a049a300f0ad0b4
- MD5 bcc60f346c19d290d252c1d6bb047e5d
- SHA1 ad6b9f6bfbfcb18cfae024626a8fea7f4d2b7862
- SHA512 78558d5472b4ac4d5e830aea6e0934a1258a92d7007f4dab00c8def82055afbb323bbaaf8b433b70b5fa4e6d83e33333af0467108585847f5a86af96fca6b1be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm70u:A3k03kHRJD56rs
- TLSH T1B8255A07A6890FA8D11FC1748A968A62E6737C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 952KB
- SHA256 bb1da861fbe38687c653c0f285920f8156cb80bdec886e8e59001ee7687905ed
- MD5 0b71db4844bfe87db1c9bf65f3ac6a54
- SHA1 f69a5dc002be8b48a69d69ed898db6ff741ce79a
- SHA512 943c52d4c56d9fb3ce46543704938a90a6afa039a4d18dfd11a81028723b84bef254e948920d4b76c4c492c745bb42319afee0bf0ea0d0fdf156df3716b30714
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7ib:A3k03kHRJD56rF
- TLSH T140256A07A6890FA8D11FC1748A968A62E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 952KB
- SHA256 c6183f824a5b86a9bd5128300f9170830354f02993e50ddc169dfd48f294f163
- MD5 81a3c636e308518591ccdfd7887d3043
- SHA1 af96193f8a264a30e5e8ad9ccbd18230768a0d14
- SHA512 8af9ba660a89228cf23711a45a4a38235b94b895d294228474ae3c27ad86a1c8f1865ee9bc0ce6598ba6b6814ba610a3603d3c8a5992fca6889045bf8045162e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7kf:A3k03kHRJD56rF
- TLSH T1F4256A07A6890FA8D11FC1748A968A62E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 952KB
- SHA256 e95fbc8742d2824e9c8622d69f4d2505caf12ccaa4a9b4cd8212e30d7f558043
- MD5 49c8a4fd27fcd0b7406ad36216e307fb
- SHA1 d90945526d91efae741a3ef04c9a3e29ae8c8951
- SHA512 215cbbe9d01c4c0bfed965e104812468cf74949f50d692d14c54c0821aade240a280f4fc32f70715f02fdc67926fb8f776c7ff745253d63b1de59ea160a6ce2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7BK:A3k03kHRJD56r9
- TLSH T1E5255A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 952KB
- SHA256 3bf7f1eabace71c328cbf3e36a8c74cef8350b9b1cccbf3c1c9d809cf0bf4689
- MD5 8432927ae1a0f9bf98418947f85af1e8
- SHA1 49d49dbccfe775ef63b42ab39b519279e5140fd5
- SHA512 71591887f724044eff85d16a1c00d1e3c3042d871d8b383f8c90c708139ab992b5524f97a1847a13ed8b0f6f7ac269c7a9a4b8f16e5a6d15d616ea865e8a0f4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm76k:A3k03kHRJD56rU
- TLSH T1FE255A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 952KB
- SHA256 e24c538f3880617295dff767e4b0c641f8d21e081e59662d370b2d9a332b84ca
- MD5 1af4428b961805eb53cfd329cb3fb438
- SHA1 0a2b6dcd606786ed2789e30484d90d15fe886295
- SHA512 997a355521fe6274b3c16a77f4e7976e1e8eba6d900bf8ea6de145383ba22d447d19279c6e4095e51cfb17707a18561122a597c71af6bbbe5e97dfafa3c30e8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7f0:A3k03kHRJD56rd
- TLSH T116255A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 952KB
- SHA256 bd408471ea895b2427532adb7549d8050c071a48ecb077a602517b2b1ea830e5
- MD5 61f34b30ec11717c87c54772cf065012
- SHA1 b8603eb37a853ca441bed46cbb521658534b0b4a
- SHA512 1fdd3bf3c3e7455abc7af9874e25fd77841fb10d2d7793261073fa83d65f48a1b64337014c116741f3b4cdd0dce12985c489e66f1e3235d3797173f7b606a243
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7ug:A3k03kHRJD56rs
- TLSH T171255A07A6890FA8D11FC1748A968A62E6737C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 952KB
- SHA256 4eae3625efd160310d154d3c29c285b275a19f17e7cfd64b595ff7ea3d66eee4
- MD5 eb292b40bc34a4fba259f54e422916f8
- SHA1 6ec843596f2cf6cc72f16b94d0b2331f37203b6c
- SHA512 20c173c51ba03d14bb58bd142bfebacc0be03b342e7e153b2cb91d683bd008e78ca6ef108d559d85bf3a1321bd488ca48e013f1e84497adb183b5948be881c17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm73r:A3k03kHRJD56r+
- TLSH T1B2255A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 952KB
- SHA256 7b97b96718a5680c1eec007bbfe94236507dc5d69e68ad0f0aa904ebdc65c120
- MD5 aaca9e60d7f0a4ba0bebf04afb5b667e
- SHA1 f07f6a8e8a9749ec5de688696ffd673bb4c0ab31
- SHA512 6d957dd5d5374f30db487b8fadf315cbc2e7ae3910271763dac02d2eaf240fbb40cbc4da69f053c3394dc6845dc745ec38051445041d6b8b0e70885581719421
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Bn:A3k03kHRJD56rI
- TLSH T1E7255A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 952KB
- SHA256 f37ac3ff4c56ffd8da852cdb51ba2cdf56d61068261baed5469c74ac2d5dec08
- MD5 f885f96e9d5551dcd490429ea3b267b6
- SHA1 3dd0ef9e84787122439c43633c20d2131e5c5bd5
- SHA512 70ed3468efc6ad6a3fecd5d47300c6509a4f9305365bb000fa542a34f26d4e8ab894b968cf0d071f44bc11e7c913c5cdf0e6fb48d4f5a55fe98d35ef94dfe9f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7tx:A3k03kHRJD56re
- TLSH T199255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 952KB
- SHA256 90976969ddf80070026575e2f7d301fea9875a9599ec62409de1726321053711
- MD5 add933c53240f1e0186f58919dc5c481
- SHA1 cded26dd0d2d0fd05f16a7a7e4d1733f00a44b61
- SHA512 109d6668c5755ea0b8e5a14eedcae3884497ba21b14cb3a8495a37c653103f4738e632a9e4025226d5d1561a07d364b0ac8bd38d4c7ad1dee85de18a70830a93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7zA:A3k03kHRJD56rV
- TLSH T1B9255A07A6890FA8D11FC1748A968A62E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 952KB
- SHA256 213f359d9e928f4d38f9be9d36e566e5834efaae274eb8dea0f73901c3484671
- MD5 97429a52337f4090f7a2c3088fd7700a
- SHA1 263575c15a4b2d0baad234473276d577a438b7ad
- SHA512 b28b7e051a0f17f70626990d178cdec44ce54e07500f499818f71b96569ff82cb39d4b32673dfc9310ca0691e5eb521c39b37dbd34d473eff5bb7431f3575a44
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7E9Q:A3k03kHRJD56rU
- TLSH T172255A07A6890FA8D11FC1748A968A62E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 952KB
- SHA256 84e64cbaf6235183fc0e865b4eaec2a3cb300fe8c245802c35a4395d0294595b
- MD5 f26a6df2da987163bf07d9cc1ebb3d70
- SHA1 b5a08b05b40f4f88a9a97b73e10b4d4bc2336b41
- SHA512 409047d095b6fa8821a27a80041a0174ce2b3d753ed00f8d1246248c177d4185448d7b87e6b527c91693ac35ff84d30390de5d71ce10bd0757e946414b360135
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7d4:A3k03kHRJD56rf
- TLSH T158256A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 952KB
- SHA256 ef8a9d2e59c2a2a4323ace0457c50414a9ee96c4985fa95650335bcbfe8d857a
- MD5 ca5b960855c9e17439a7166abc7419a8
- SHA1 15316738a6e9045e522380a0677f344919b36fa7
- SHA512 9c560d83dc16f8540bac59136c1e0269cde37e7814ca1f48f99a850ec1aaca352a3eaba83aa82810af9f8802960051d31807dd0abc7887ef4d855a73b235a4ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm74u:A3k03kHRJD56rS
- TLSH T1AA255A07A6890FA8D11FC1748A968A62E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 952KB
- SHA256 dcc14269892a6e2b842afa7bb482447ba7d266c618a4cbbf017e9be68ab3a099
- MD5 ac4e7941650e8b5a211c1e573e80dc48
- SHA1 bd5cfe7a8335a32f5c4af2c04da89bab82ecd122
- SHA512 424d6616e63ae0dae4bc067353ffe0d3abb6fc780923ccebe2f3d439568e077e5943f4ba7b98cdcde911ee68ae27837623f7e978fa9ed7d44fd9a8439ab15004
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Zj:A3k03kHRJD56rM
- TLSH T15F255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 952KB
- SHA256 7f0f3dbbfb2a25ef9b51b67887567cff65a9e09babe929c0c28915a29ec589c4
- MD5 65adcf43b0cfabe972e09dd679ba60e6
- SHA1 3a0d5825622824ee724dd2f9ce44d40355040fd1
- SHA512 e223a14beadde0a4223f9c42a9fc81bd4797c0143619907113f821a450ab85156ed68569c196125bdae21e3b674c776a242efd237d1732e480837ba6f2352ea5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Ag:A3k03kHRJD56rE
- TLSH T11E256A07A6890FA8D11FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 952KB
- SHA256 98006a5a9c948c3008b5125b805a2f1aff91437d68b677c37b019316396bb5dd
- MD5 3935c6e41d811390ee4e95bdeb960354
- SHA1 8d8a1bb91629074a9b8b59464bbab08c762c8614
- SHA512 f332807b40674275873c223fcb822d1f95ad766cbd2b560cc036dd9d67c275f930d517e5bab17d647fbf6c392a8343f10ee9f7951c37c44bff5faac6710db63b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7vI:A3k03kHRJD56rt
- TLSH T1BC256A07A6890FA8D11FC1748A968A62E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 952KB
- SHA256 7c38af924e03a0d3cae04dcaa3a124b36d3fb22e2166ca32436281105d644f31
- MD5 822f448a4e91c52763bcd4e7052713fb
- SHA1 262dc6240dcc420060fd8ea86cb76a90d8268b8e
- SHA512 874163ca94977340f5c87814526c3e9b5c598ba8996d0170a43433438f4b6d8f5302679aa9f37e43f17820b93753160e302d289c92713f77e237e6334bcd9b66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Vo:A3k03kHRJD56rL
- TLSH T1E1255A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 952KB
- SHA256 d6abe89b5b8989266480f593ca4ef26bf15e1c08409d7f168450c4ea75303794
- MD5 16f11e457df7e1c457dfc77fae3b867a
- SHA1 af2bc501f00f2029418799cbf1dbfaa1017eba65
- SHA512 abc3f1e02a841412d914f0d2c3cbfd6fa20c0254305922307f2b1968e65fcb3c258b1ea495815aac3a5a9b2beb895ffbd57591ee7e45153122db4880350f5287
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7G+:A3k03kHRJD56rO
- TLSH T1B1255A17A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 952KB
- SHA256 453096a5bd87651239b2282082454e7f42537f79d0bc3e00259be2992b77206d
- MD5 10c8e4ac6d0bbd5e869ee47734e5b91d
- SHA1 90741cec9dfa27a4f074f9a95713637d0acb8674
- SHA512 7255e560186fa91d37645d749970321d9dea215c9d7766a1d60ee6845b0d066512c6a114a98ff85907a2dfb1d6e696321db6de6145fa1949a397a1d0d77d1a1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7GQ:A3k03kHRJD56r6
- TLSH T196256A07A6890FA8D11FC1748A968A62E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 952KB
- SHA256 03efcc7a3a5c003628319fd0b2c11499ef7483722b10dbf3a96efaa9738017a3
- MD5 358c537649970a38dcf5aa1794a9e6c8
- SHA1 4f8235377cb2d6fde6bb2c81c9f19f99664f8a42
- SHA512 9801566652e0635c94a0a099bba4983b0816144455349ecfd546c26e91b325faed56614831b7945d9958ce64f14b0956331e223fbe9829bbeb1bf223d760912a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7XX:A3k03kHRJD56rq
- TLSH T136255A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 952KB
- SHA256 226729ac3713171232d02c3e69d1d31c1d801824dea531097b4b8c4bee79543b
- MD5 4d546cd174f3262daf0bd1611529ffb3
- SHA1 5761bcda08b3f5602c0b84cef84b8ba179e9b145
- SHA512 fb89e59e67793d02af633243a3cf500fb548524269e0037e42ad6fea8d467b36c71ceaf13b2958423f6f5cba1b45c8c1466627a4d4c792dbd1275e09bc21ad03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7NL:A3k03kHRJD56rE
- TLSH T188255A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 952KB
- SHA256 acf16ee59a62d35b61e5b9df3a06c964fbc0b7d7e4221b18091fb8e6c0484270
- MD5 0bb889715800131c175a0af37f743a1e
- SHA1 7862a1aeaa0ee953f59df5df049dadf0d9c86fde
- SHA512 bd0731473f0d281ced99e15e516c3b6c26be12f0273781d54d648ea71ff7728f36e269d437772b0ad77d8c67cab890c4777db4322e718f99275063a3b37e9b08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7LM:A3k03kHRJD56rF
- TLSH T11E255A07A6890FA8D11FC1748A968A62E7737C125F2093DF1354AE253F72BD06E3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 952KB
- SHA256 ef3f1d99110d155b1bbab55f1a143696abb1ead34e83b8b7cf08a8fc19a62158
- MD5 7b0ec330a1bd93cda2ed30771953b0ce
- SHA1 1ca1168f85026e65ddf40db327c9ef4fd064c94e
- SHA512 b9277aa499e23002f2ab955e0724ba31893a786ed59bfbc4620debe87885d4908e0c68eabf09e74a8b7d48f820673100fb981a035eddc4f3000359473c2b8ed4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7Mh:A3k03kHRJD56rf
- TLSH T162255A07A6890FA8D11FC1748A968A62E6737C161F2093DF1354AE253F72BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
- Size 1.2MB
- SHA256 75a997dd4548d9ac91e471e7cb58922986df57437691d9186fd9c80bde43fca6
- MD5 68effef80d890ebc6db92f7925ac678a
- SHA1 384592f16251b6e81f7c0596d2764b34a2274336
- SHA512 c4a6a9ebfe7caf76e8fd6a01b70f2af703604f63ffdbd61efe754e2aaa27a6181fec47539553efc97c78a3c58ae9046b419a3d73bf4f9e0060d4b9dec1702858
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJeD5Tvinrm7SV+PAk2hMH3:A3k03kHRJD56rri2WH3
- TLSH T108457B23A6980EB9C11F81348A959676E7777C124F2193CF1354AE1A3F72BD06E3A353
- MD5 SHA1 SHA512 SSDEEP TLSH