Analysis
- max time kernel
80s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 15:24
Behavioral task
behavioral1
Sample
2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 933KB
- Sample260703-sth1msgx9p
- SHA256 67da762db44bba3d737ddead186d8a0ced06f0d2931a8e9f93c7939610570d5a
- MD5 f3550cdbb021a0267ea4b28db07aa4ed
- SHA1 6a087071f3d488982bd495b2e34ba6f8a6a90573
- SHA512 35fcf4e6741fe3f5aec30ca1b2e6faec9ba26bd9fe389d9e629825d867f75c93c87bdf01936c97169d5dadb0849dc5b11c2dc0b7038e34f9f0dd4ae99f84c3ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3u:A3k03kB56r9
- TLSH T1B5157B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral1/memory/4800-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002447f-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2784-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4800-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2784-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002353d-147.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212aa-240.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ad-260.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212af-441.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001000000002034a-490.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b2-533.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b3-600.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b5-625.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b4-716.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-735.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b7-784.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000212b1-792.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bb-824.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212ba-855.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bd-874.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212bc-893.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212be-894.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bf-919.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c1-932.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c0-951.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c3-1006.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c2-1044.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c6-1064.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c4-1095.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c7-1132.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c9-1151.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c8-1176.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ca-1183.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cb-1220.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cc-1324.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cd-1337.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ce-1357.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cf-1376.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d2-1377.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d5-1384.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d6-1397.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001900000001e08e-1707.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000719-2005.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0011000000000719-2102.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002447f-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x000300000002353d-147.dat aspack_v212_v242 behavioral1/files/0x00030000000212aa-240.dat aspack_v212_v242 behavioral1/files/0x00020000000212ad-260.dat aspack_v212_v242 behavioral1/files/0x00020000000212af-441.dat aspack_v212_v242 behavioral1/files/0x001000000002034a-490.dat aspack_v212_v242 behavioral1/files/0x00020000000212b2-533.dat aspack_v212_v242 behavioral1/files/0x00020000000212b3-600.dat aspack_v212_v242 behavioral1/files/0x00020000000212b5-625.dat aspack_v212_v242 behavioral1/files/0x00030000000212b4-716.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-735.dat aspack_v212_v242 behavioral1/files/0x00020000000212b7-784.dat aspack_v212_v242 behavioral1/files/0x00080000000212b1-792.dat aspack_v212_v242 behavioral1/files/0x00020000000212bb-824.dat aspack_v212_v242 behavioral1/files/0x00030000000212ba-855.dat aspack_v212_v242 behavioral1/files/0x00020000000212bd-874.dat aspack_v212_v242 behavioral1/files/0x00030000000212bc-893.dat aspack_v212_v242 behavioral1/files/0x00020000000212be-894.dat aspack_v212_v242 behavioral1/files/0x00020000000212bf-919.dat aspack_v212_v242 behavioral1/files/0x00020000000212c1-932.dat aspack_v212_v242 behavioral1/files/0x00030000000212c0-951.dat aspack_v212_v242 behavioral1/files/0x00020000000212c3-1006.dat aspack_v212_v242 behavioral1/files/0x00030000000212c2-1044.dat aspack_v212_v242 behavioral1/files/0x00020000000212c6-1064.dat aspack_v212_v242 behavioral1/files/0x00030000000212c4-1095.dat aspack_v212_v242 behavioral1/files/0x00020000000212c7-1132.dat aspack_v212_v242 behavioral1/files/0x00020000000212c9-1151.dat aspack_v212_v242 behavioral1/files/0x00030000000212c8-1176.dat aspack_v212_v242 behavioral1/files/0x00020000000212ca-1183.dat aspack_v212_v242 behavioral1/files/0x00020000000212cb-1220.dat aspack_v212_v242 behavioral1/files/0x00020000000212cc-1324.dat aspack_v212_v242 behavioral1/files/0x00020000000212cd-1337.dat aspack_v212_v242 behavioral1/files/0x00020000000212ce-1357.dat aspack_v212_v242 behavioral1/files/0x00020000000212cf-1376.dat aspack_v212_v242 behavioral1/files/0x00020000000212d2-1377.dat aspack_v212_v242 behavioral1/files/0x00020000000212d5-1384.dat aspack_v212_v242 behavioral1/files/0x00020000000212d6-1397.dat aspack_v212_v242 behavioral1/files/0x001900000001e08e-1707.dat aspack_v212_v242 behavioral1/files/0x0004000000000719-2005.dat aspack_v212_v242 behavioral1/files/0x0011000000000719-2102.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2784 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4800 2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe 2784 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_f3550cdbb021a0267ea4b28db07aa4ed_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4800
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 67da762db44bba3d737ddead186d8a0ced06f0d2931a8e9f93c7939610570d5a
- MD5 f3550cdbb021a0267ea4b28db07aa4ed
- SHA1 6a087071f3d488982bd495b2e34ba6f8a6a90573
- SHA512 35fcf4e6741fe3f5aec30ca1b2e6faec9ba26bd9fe389d9e629825d867f75c93c87bdf01936c97169d5dadb0849dc5b11c2dc0b7038e34f9f0dd4ae99f84c3ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3u:A3k03kB56r9
- TLSH T1B5157B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
- Size 1.0MB
- SHA256 bcd16b2c64fc36beaa6ec2112163ff0012517d70e2004ef2c7d3e99c39f4faa2
- MD5 5e679c7637ca97bae6d140321cde3118
- SHA1 d7af8141ace9898ae40603f82fa6bc77b14536c1
- SHA512 8514c3f7e204a4d80c4fe605ac74826f03b46f3923dff5659334b808731f0a514641f0933031d4117e9376682f9c3a420a5b657286d75279be58837105d4d9d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3VGen:A3k03kB56rnI
- TLSH T130356A07A6940FE9D10F81749A958662EB737C121F2093DF1358AE153F72BC06F3A6A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 5c3e602c305be2b63040cc4381656890d1b3b2c0acd729957ed23271f2d22b63
- MD5 60553c98a3798e7a4fd9a1353b45e80f
- SHA1 4d86a9a84e5fbac1ee390f97af7b1c76417e8b6a
- SHA512 b6740df5c14055658f38eb90ce061a5a40cad28ae7f28edbd907d43ad6bf568ba3ebc488bd2e10954519d6afb86656775e8b6386be00a21756602f8bd0ec1992
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3e0Le5ji0hmxNrM:A3k03kB56rJPji0Aj
- TLSH T100655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.1MB
- SHA256 bbe97ec4335fce7acf67bd23ad38973cc73eb971bae090f6b1ddc23b737f25e8
- MD5 c1438565152f9bd1b7f72329197150a5
- SHA1 7be3808484a910c6231c8f74a6ede93856c1f69a
- SHA512 f37a5649f907c86c1ce6330a2be89254399284a8b1dd75023b1d89ebf68545a4a10d3084ea2daa4bb4904e4f3fb7bf99141b63591091533645851c3816968f29
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3HD:A3k03kB56ri
- TLSH T11D352706E6940EA4D00F8174D7954662F6737C125FE093CB23D4EE3D3F72A806AEA697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 15580bba98ef765df72b1ff1a848551c9bad610aff08840dedaefbfdc9dc55db
- MD5 a32ce7c64cffa0f90448864b240ee707
- SHA1 eda2d7649d4bfa6194bb8525a6af11dbbc099ac7
- SHA512 23b99dc47af712a2615bf0600a365188dba205dde2bf0abdf9b0d4e7b842ba3e5b271c2baaf522358e2d236ec95d27ea98d196ed4eb5a90dedf55773b0b01714
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3x6:A3k03kB56rV
- TLSH T146257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 6443a78d74f0000775a3a7a1d492cc61bd5288ca989486e23a92900893afded0
- MD5 621b3f509a4abc95807233d82c3c0837
- SHA1 a8a5254fbae7866d4c2d4e23d018172013da068f
- SHA512 2a9f90fea07a7bacb06f1c142441d9eda6b59d8438bdcee83b912696c3b1228d8520836c68e5bea370a1a8dbd002bcff47dd38af08fb54ad8ae2c61d5680b091
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3Xo:A3k03kB56r5
- TLSH T163257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 bf09cedb430fe18c85f9200699c5745e7cab79d71562a5a06ddd9f72e0f27918
- MD5 a39c336d54c31b47dbd3a98c191bd1ee
- SHA1 773765db65014a672aaa2eead6da5082c145ed96
- SHA512 7d5be2c26a8ffa954421567f943f9e3822b232cf92d60e540d4ac27cf0841cf43f54369c19cae6f1f1d34dd2804fa15d7e9f274e39f17db36284118faf071357
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3bu:A3k03kB56r7
- TLSH T1F8257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 be399d1e9ef021635f6fecd01f0d580a39efcdaf188a038245291fd824f9c8aa
- MD5 8f011c55daa55a71b4571e9840b79b19
- SHA1 63d4c59a2f7c3a8565a71c0d6379cec12e13f4a4
- SHA512 895fb556e813e835925be2fc42d0779c230166d86372d1498e971c729a85f875aa0d73ca4735ad1c8acaa79b12443bfd87095df8115ed94c07b1e4f69181bb6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3J9:A3k03kB56r6
- TLSH T1F9257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 b7f1a0b74e231ca45ae80e8290a6e6e3c069fa864c69700c056eab0165a6207a
- MD5 d071cd7cd8d0779cf52ddf4d95576e26
- SHA1 831232a1f1fe19032e556adb3cc38160e71006a9
- SHA512 47515793bd2197d114f6ce1f76d7dc7b752f5d780ef0515560df2c67788f043723534fcf79f92129e6a10e7bee35810f9ec845efe43b7d9edd96850afe96b22e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3lc:A3k03kB56rX
- TLSH T14C257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 b5345abd69a5e735479e1b57ac634b6ee7c9d70fece71af1c2d8dfe63ce09768
- MD5 425859c3f30038c1d3be0a6783f91c9f
- SHA1 4e4455d74b30d59d1fdcbfcf042471dc7aa88889
- SHA512 5eb951972dc80aab2f560ca4137d03bf87593a2cf31c2055913be2d6c50634bb09821cfad211eb510ad18a1578c6462cae41c3fcb7d9c760f7e24217801bdc92
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3ep:A3k03kB56rN
- TLSH T177257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 6ef35bcbb0bfbab5e0140cac21242500dd7de22947ca3b6538eb42a705d89cf3
- MD5 20724ed59cc9b22b3cb49dbe6e64f192
- SHA1 11b5a562d26158d30c11a91250570580e478b617
- SHA512 748fc5065c1efb0df56955c26f96216b137a9ae47ee2dab55132bd4ef30471d12bc43d5740217a6628b00618be00c4692b8f46d2dcc5259b6c9f924cc16d6dc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3RN:A3k03kB56r2
- TLSH T1A3257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 7160805ca359de7d407e877f9fda04b581bcbf00ca7dfaef9f63a565f50ce5d0
- MD5 763ee45fde6098050f125f3ca8051e42
- SHA1 532cc59978f6d9c16c0d2d55dbfb370f7425067a
- SHA512 196aa59a8e3d4775cff8c4593bb9369dbe7fed0d93550f9b1c012edce13350dd356a99bffe26353fdc36a5908b85865065644e66eb9733f0a1dc2b9c88943953
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3zF:A3k03kB56rU
- TLSH T1AF257B13E6850FA5D00F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 16c005143082cf479d2b41b33ea099de331e3f17c94b30748c16074de0cf961a
- MD5 c6510ea5bb48ed99fc3ae68903c6bed3
- SHA1 a1e197e9e3bfcfd1193c4deaf99f08ec3b8eca51
- SHA512 f844353960899a855a0ff309d2ff12636bc2ec32bd7e56fc0828fd68122d9f0b57ebc53d8ec57d7b11bcdbf40d4c9e18485a3b11e078d13eca657de15c33880f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3cC:A3k03kB56rA
- TLSH T107257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 fe90cf8f6865cb46d8f44b790b04470182b12e2f82a6da0d86f797c29194dbba
- MD5 4de648eb64d593291f47c45494225453
- SHA1 24f6d63c8811ee69d9fc771760e00972a2cba2c9
- SHA512 16477d987fb32498eef23a3ac0ae9869bec82ed2fc38f4e786e958dbd7333e7eb5a01576016db000389db9cc1766c150bfd26205cf0ae24a11400ddfa3c533ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj33w:A3k03kB56rd
- TLSH T160257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 8c3bb19b49818ac494b0666d0e3f659ac90452b4ad8be02ad1c62482c6dd1142
- MD5 574487bc271e5bb0bbbaa80ed443e235
- SHA1 1bcd4343b5cbbcbcb505ed294bb40f08e2460091
- SHA512 5a4636e8b45f25b601f25dff4394ca5d2ec6ef737121816fd7f5fd4ef119edfc43d02b263ff778419fa7393d513b0806a90b142216cd093ae3ee75d5057be567
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3mT:A3k03kB56rR
- TLSH T10A257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 99f7d6f5385b31c694e6e24725a8327d29a7300b45e99d19e675a0ada4463213
- MD5 530499b43326b86bebe3f11f7c42498b
- SHA1 cb99a0febd8712a7ce55c71ff4a22d13fb92fe18
- SHA512 f79bc4a6731c9107992da7a767188dd3496aa7592e2e022ded57b4d55d13338f0f0077c58ebf6a90af2b29f5d70fcbf90ad15b33e615ed9a2ec0701a4bbc1f23
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3eu:A3k03kB56rG
- TLSH T1C9257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 92df38dcc591bccbd7bc65beccd53f12235d4a8bc58879c43ef7644a074f5964
- MD5 7fd768ae13cef4162e004d7bd26f4ac4
- SHA1 42e6fcb492d4e144457a23c0fb779857c7a0fbc5
- SHA512 62f3b97c0d90249f6f6e40f4048408824257107981917fa49f060ff35b08c47c852299839a0942c2e9796ca1492c9c4c0b0de79df640b4b8629a64b1719f4785
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3Yb:A3k03kB56rX
- TLSH T16B257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 00b456ca15d17a7c9a073afdca37b67a04a5e8a270a086646b34c3b21c21fec9
- MD5 b80b01e42530d8c9a74c34e94c9eafa2
- SHA1 c572714d72083cae01930eafd0e12f967ec89685
- SHA512 28be7ecd7dfa748b8707555068596c635efae711d8756db7610114a3540e44ee0c9ad32b972e0e6b1811e07b1903be3ed97f81fc5dd66b972ee99d0d5824a819
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3Gf:A3k03kB56r/
- TLSH T1B2257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 35162a1da63c05611b942049d71d0bba9c1e5c6c22a015c20b733ac434ac663c
- MD5 89426185e3608aff0059456900cc981a
- SHA1 ac201cf5370ebfa05a37e61ff10cdc7835a24f76
- SHA512 d68f8869848de9ab8ef536a94e78ca01616a6f1d32e4046dc24350eb2f7493d656c75936fc12ea067655fdc176327c22e06401dcb6f59193c6c0b1af20847680
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3DK:A3k03kB56rf
- TLSH T1A5257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 e6b22ea87c59ad2bbe008983b68370700cc7bca568e38ed11fc692a419b04152
- MD5 67bdaccb7538f51a1d9c9481630a931c
- SHA1 a880e5037ae1ded93ba9bd097ab835e7de74d992
- SHA512 4e973fe42f5b5587ee24e4352b035c007ad0347157021d982595d692876ebbb065ba0ebb2a3429240aabd3dc91effa2c35044d9dce235dc61f3be3365f409645
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3kk:A3k03kB56rq
- TLSH T17B257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 be765a5828e9ba119c942c6487be33c2c39702900f581a640533f89dc7c80f82
- MD5 35a8aeb9549f89654715882f9aca93fb
- SHA1 11ae0201fa7a99bb74023c49a127ba09debd6158
- SHA512 4fd01f6290cfa6bf7e3f23463f5262348fd8451d6458d96a71827b054d65044942fc07ec8cd3a7d1c32a96518bd3227e79e7a5202699b24070847c6e3532cbec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3t0:A3k03kB56rf
- TLSH T13E257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 cc0ab78f62bbb42b4ae579a6ff651e4104049bc54e9c5768021f17e612a748d5
- MD5 c30c986b56cee96ede69b29164bf294b
- SHA1 c07eaf2415d389c2b1e91f71909eb6b2eff8ef1d
- SHA512 ac6b48f995e42195c60ec00b7013772050873f63734c8f53ca99dbe882317abe1fa1be023be39b08ab752ef111c6562ab8352a34f8a5b8d1cdd683583f8a78a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3wg:A3k03kB56rC
- TLSH T1D2257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 751df2d5699c65a3a78c5d41e0be8446d0cbcff81b32a8a27f2764fa6f839201
- MD5 421cc4f08d364e680b3e08d986efe248
- SHA1 dc6c2818b1b60a46705b0b2a482335b2c37ee3d0
- SHA512 08cd424d5e570a18cddf4ff6f3ec771c3b5c411c75e1b3fcf17995ae5ef699b2c63cf7692dd5a6928d3aba37a3f887a3ce2542d30153dd7b7e72d0d681830b21
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3Fr:A3k03kB56rM
- TLSH T1BE257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 500d238cb1df20c6821381e5fec2bd68cc19bc980573f493e8e4dc0cda811447
- MD5 70347739164d7605b2319c17ea1f2dce
- SHA1 f882f844f5a9b41f8a536edf5f26b43a700b805b
- SHA512 9eb0a455a984ff9c000da1b5bfc0d394b63f08f9dde4038f191406bcb6406e3589318f1a8f464195a5fbb4f5cffbad1a40c84568150470f268354f9e3b60fce1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3Pn:A3k03kB56r2
- TLSH T1F0257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 75b1d4a5a0bbf2ad14172fc3ee20cc5698726b07476726a332a686318a6c09a2
- MD5 81936c91e2db81a70ce63f6fbf4e0395
- SHA1 72bfe2631d6e7c86613c90454aecc3a588219066
- SHA512 92a4c1ec7a27b43861bb597e85fdf6dc4ad14695ec0228fb6b37842387ad7f70d07fdd5d1a4a75e19ec994a1d3f75fdb719b5fe2c3b763696b2be6db605ca61c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj37x:A3k03kB56rs
- TLSH T153257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 dfb1ef8ad70c06d7591cdda2ec8782e55b6f449218c2960485af21c59243b2d7
- MD5 1255bb7676c4c6cfe6665d3b7b2a1287
- SHA1 7f490149bdf1748cf3e45b6efc63b10c1c8c9c31
- SHA512 52ff2c8cff5c8157c4f56d26bd98d4b3f4cd7870fe52036ebd8c89fd4a47758b7603c46b361c8a5129c8c8c2223a12dedc1e31aec76338bd7338e87299bb065b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3pA:A3k03kB56r3
- TLSH T133257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 a500ba70efe7b61013b262a3b920624a24ae3527a18c7526f99648e9ec63795e
- MD5 bfb1713d35855fd98e840127a2335ce0
- SHA1 b93030d88a881242a622310c4cc42e6a66149539
- SHA512 7f9e69b9ec0128bd3e0e80649ec44d8c29ea93f0c8779f58004862c428b67af5804423c280c46030c26d328d3e3948cd73f7a76227f3894c380d986fb86e13cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3i9Q:A3k03kB56r6
- TLSH T119257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 d9b6b8280547ddb2565d7d9a8532a02f93d8196703b9aeb0896543c23081c3e9
- MD5 cfd5bfea9e8509288f02eee5ed741a93
- SHA1 7184ec6723ef43bc3d3eb388d93a3e42edbe42b6
- SHA512 5a32b76e2651396580c9f469d190eb3f5d1b2e3ea45601ca194ab7b6668dd2c82858cc770e10f20596a1e250fb4664d9bae2728e46039b04a0f992f3c52db15e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3H4:A3k03kB56rZ
- TLSH T186257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 cd7895a2be367d160368e38ada199d491efece97d4ee24349f1707c4e4be1897
- MD5 6c45b87919ebffbdfa646819996a323d
- SHA1 ea16d0b99a947e8f0be9749277f748586b18ddcb
- SHA512 3b0ce9387db6a8acd42746a2356866e82f083ed20fe774c9abd6e4247c101883cca544442188258ebace19e2cd462280ba1cd101f79ef4e50353fbd3d80b0f6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3mu:A3k03kB56rk
- TLSH T1A0257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 a552d303d15cbcaaf6bd627868a13dbc3dd0bf3e387c3b181fe7073436e27857
- MD5 e6f447c61c7dc76780eefd3dcfe1d6ab
- SHA1 03ca2ab146783eca49304acc1b21c7e0d02b92df
- SHA512 5b00774aa9111d1066f3c8656403728580220fd65572ab3dcaa9495ba490b719a5fd0883a2949402e71b68136960e892b9132a34f6b49119753987a85be0ae5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3Xj:A3k03kB56rm
- TLSH T136257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 e2f7df982c3de7f25c27fac0bf8c32913b80f0ffc896c12da95bc0dd13c19c45
- MD5 444fee926ac17ca2754395b730289a56
- SHA1 f91e3075c0953e6e1d23623436a00ead0cc4f90d
- SHA512 b41230238aaf772f314f6c9867ddbda87a34ec9e592c478448e0bd7d6701a7a35976fa17d9c5a9395352852bb92a9b6b70f39ecebf97d7d032d613caa8d6d197
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3Cg:A3k03kB56rK
- TLSH T110257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 c3945853205b78c8592ce04bba0d815f42fc3a447ffa16b2d6c0b05b22de2631
- MD5 2ae3b8369214675c736a7ca947092276
- SHA1 128ac81305802d7cce4accb7fdee69d89db086fc
- SHA512 208267cf59dab6ba8f1c8b3be78dab02370e698131205eb0204e2418121cb4b1d45225fe3f5fd72774035e338cec772763ba46e3410ba29cb0d6387a185ae65f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj39I:A3k03kB56rr
- TLSH T192257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 ee3f75c8b0078d29f3b0d5e289f8bf8ad10c832a05445009072b23c39494dc74
- MD5 4bd2817433b3d8780e932053c5631960
- SHA1 389f460735ad3dc2ccf8eee596a218e1be6edb2e
- SHA512 c5ac9363d34785c45b358fa393a5b9aea45945ab077790973d7d82d2a24ac9393ef4139d4b629028fb47efc05dabfd64f8da728c05e8d459fc9890eec21ebef4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3vo:A3k03kB56r1
- TLSH T188257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 cf0b1abb399bdf2a6b67737f2948940d4205bda53b544bacce8fec984cc4902e
- MD5 511f7676ef298cb1d4f21d9312cb4144
- SHA1 5e4e3f13107dbf8949b395419c067c4fe4dd7484
- SHA512 81a94bbfbdf575833cd354fa64f714b85e10146fd0bc867434e6b28dfe6342db7105c2866ef60380f3dbe7986d201cb3b263724fcdcf54dfde1884c2f03bdacb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj30+:A3k03kB56rQ
- TLSH T1BB257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 f7e2a0a873b90bd541987e57e18140fd6c845c987cdc2b089d998cfb3c7fa2a3
- MD5 ae9b613af554a3085fe28fd23814bb4e
- SHA1 92be862d96aab30caa400036d0db65ae3a9b52a9
- SHA512 2ca59d80876ce94240c8a7229fb9a4f6723eebeee5184255fc0d6c9efeec410a36c1ab4e08c47a2406d6f3b5d0141bef3a5137bbaf1ef7c5aacf63ea8877cdf9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj38Q:A3k03kB56rg
- TLSH T13B257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 2c15ceae3211514ca81eaaeaedd4448afc65cd93d53692fc2b6ae5e83f692222
- MD5 088c916e293b6f78d0ddf39e9dd5323f
- SHA1 babf3ffe5f634b4f43bec73c807db1e96a199bc0
- SHA512 2a7d9f72df14c72e3fecc9a5f6a352fcf99e8c9c6c462814b2e88dd5133f2fe40b171ec751cf3e7e0515a3550683df877eaea4fe8325598b1a8d3918768a755f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3lX:A3k03kB56rQ
- TLSH T1A0257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 624cd5d495cbd1805669f4823cfd123097dca0038b2aa8c1bf419cb06295f9b4
- MD5 082c28f87fcf787cd8db9ad90670b51f
- SHA1 1a7d42205c86f8003144539c589dd10fb1dda1f2
- SHA512 50572ae95224e978f438e681bfdff264a9cd00ccb9e27bbcbc0d8708055afd627ce16915887efb77af70a02337cb258952e85376e67cb1ad3f1d78a4308493e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3HL:A3k03kB56ry
- TLSH T16F257B13E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 8749d5fbe7ea95dc1df001291ab6ef730e25f442eac4954f8ac650fd3ab379c4
- MD5 da5079b37005f7ccad02deb948d8174a
- SHA1 a7d576d3a360ad8f8d5b2f6bfd49cdac79852672
- SHA512 b557c4ed676bc836033c17b1ee9144c384eb0c6eabb9d110a1bf561d4a3776971450fc45e10ec3d33450d1142885f2ec4e965567d78072cb1f4a5e593e28a939
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj39M:A3k03kB56rf
- TLSH T1D0257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 1542fcf7dd19cc30384cad27658d34c0cf14fd8bf895516fe96e3723278f9554
- MD5 2afa75094ecc9fe2e0b3a0247ff8d84d
- SHA1 817031c436a56d172931d002318f450f07aa35d5
- SHA512 e13e0c0eef3f658d8a703079c1544b6640c9f346934fe0d8087d5e48d6cd845c999a5675c5ae0050a2383310174843e93c35e3e4e0a3ba3c8941c6f2b843f0a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj3uh:A3k03kB56rR
- TLSH T114257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.4MB
- SHA256 e5b814546790f01338d537b15d43922a6a1d188c1dc40962e3240c46c40bb465
- MD5 7c18b42e82345cae96b4891f0a737256
- SHA1 454a92d2ea0868e00484fe8c0a2872345ce3052b
- SHA512 8a34446d6e212ff1389f72795fdc1db6e2ac5ad328f6013bd6eb9fef46eaff6a945ca957fc7e91590cb4c5ac48a7963165655da66eb96f414ae555c03146fd2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj313npi63iC:A3k03kB56rIXpiMh
- TLSH T1F7656C03A7D84A74E17F86309AB54261EA777C525F3093CF23946E193F71AC0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.2MB
- SHA256 baac3c8a33de95035c2506332fd0957efad47893f0b97bf36b6fc425bdb7cfea
- MD5 56f39bc066faf1fe1be56f4bd77b80ff
- SHA1 d78eb9e5e6cd88ecaa3da6a964f8563bc4c0d814
- SHA512 0262e2979a02b9bbc24197cc0679a9fb954e7749571e2205a599d530b6db069251d7f1ac1a45ebb8e851f982fe7d80f024847ab8f7b495a1e1d2d0618ac26869
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXikj38V+PAk2hMH3:A3k03kB56rZi2WH3
- TLSH T13D458D23A6940FB5D01F81309A958676EA777C025F2193CF2354AE193F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH