Analysis
- max time kernel
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 15:32
Behavioral task
behavioral1
Sample
2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 886KB
- Sample260703-sy5efabz2x
- SHA256 458f9bb53b603118ff4a2007129ebd362303e133d4138fb82a83c336c84fabb5
- MD5 d60f283f0d4a2e0f8ad106a6db9cc44e
- SHA1 6f77eb28958dafb998d528a1625ed572d37a120f
- SHA512 af161fc1335a62d617c3fbc65fd5238d4c6b919efe9dccc237392d654831af6a57568e730b5f4fd4c384188815673b996564e3606785ad4deacd4db1c0324d80
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1N:A3k03kB56rM
- TLSH T1C5156A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 35 IoCs
resource yara_rule behavioral2/memory/672-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c656-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2ee-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2fc-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/672-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7b-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2624-60-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995d-519.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019967-544.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019968-581.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019969-600.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996a-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019974-614.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019975-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997b-636.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019980-637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019981-644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019986-645.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998e-658.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b52-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ac4d-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac5b-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac59-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ac5d-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c66e-1712.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c656-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2ee-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2fc-39.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7b-59.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-201.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-208.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-227.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-266.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-267.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-480.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-481.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-500.dat aspack_v212_v242 behavioral2/files/0x000300000001995d-519.dat aspack_v212_v242 behavioral2/files/0x0003000000019967-544.dat aspack_v212_v242 behavioral2/files/0x0003000000019968-581.dat aspack_v212_v242 behavioral2/files/0x0003000000019969-600.dat aspack_v212_v242 behavioral2/files/0x000300000001996a-601.dat aspack_v212_v242 behavioral2/files/0x0003000000019974-614.dat aspack_v212_v242 behavioral2/files/0x0003000000019975-622.dat aspack_v212_v242 behavioral2/files/0x000300000001997b-636.dat aspack_v212_v242 behavioral2/files/0x0003000000019980-637.dat aspack_v212_v242 behavioral2/files/0x0003000000019981-644.dat aspack_v212_v242 behavioral2/files/0x0003000000019986-645.dat aspack_v212_v242 behavioral2/files/0x000300000001998e-658.dat aspack_v212_v242 behavioral2/files/0x0003000000019b52-737.dat aspack_v212_v242 behavioral2/files/0x000400000001ac4d-1048.dat aspack_v212_v242 behavioral2/files/0x000300000001ac5b-1224.dat aspack_v212_v242 behavioral2/files/0x000300000001ac59-1347.dat aspack_v212_v242 behavioral2/files/0x000400000001ac5d-1379.dat aspack_v212_v242 behavioral2/files/0x000c00000001c66e-1712.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2624 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 672 2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe 2624 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_d60f283f0d4a2e0f8ad106a6db9cc44e_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:672
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2624
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 886KB
- SHA256 458f9bb53b603118ff4a2007129ebd362303e133d4138fb82a83c336c84fabb5
- MD5 d60f283f0d4a2e0f8ad106a6db9cc44e
- SHA1 6f77eb28958dafb998d528a1625ed572d37a120f
- SHA512 af161fc1335a62d617c3fbc65fd5238d4c6b919efe9dccc237392d654831af6a57568e730b5f4fd4c384188815673b996564e3606785ad4deacd4db1c0324d80
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1N:A3k03kB56rM
- TLSH T1C5156A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe
- Size 1003KB
- SHA256 2d0e1c50ed75f56d29f980eefb4e996e313c72bbc694be45f2be561aab9aded4
- MD5 78cb69b715c394ed66db51b12770004c
- SHA1 f2f91f23c2a25c30e94f99217b18838c374ccf19
- SHA512 0448dfddcadc7bd3dbf2094e1b5c374360a200a737b19171228a65bed9f34a9fdc77a417a67a2f0e865f7a6a2b5bf893a681b8194b8ed4710625f514313ea28f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1rv7MFi:A3k03kB56r47gi
- TLSH T1D0256A17A6950FE8D00F81749A958622EB737C121F2093DF2358AE153F72BD06F3A697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 2c00b9f42df94d193052115e9ef84de7f0bfb97d5e03550aac05e1f3fb493908
- MD5 70b0cae23bd04e1e38e7be7ed4d49e1e
- SHA1 dc3e2a25917d37f803b49183ab4261517defa344
- SHA512 58bbc04548f78f1d1acad5d63dfed44a38bb22ffbe47f15e53377aef17c486181b841f38e4c48e887243ecd0b8e51f9fe21e6c70528743e09106adf96a77195e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1Z0Le5ji0hmxNrM:A3k03kB56rUPji0Aj
- TLSH T1B4655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 900KB
- SHA256 a2d7d6afa81894989a2e7358f36ad2b76b7e6dec60f3f4286ab0732fa93cffbf
- MD5 2211b7a2c4d9fe07a87959fa708b43e0
- SHA1 b15f689f8a40e6fb7018a771f99ccafa4da463be
- SHA512 d030c313b37131e4bbae33f48bab175861ad6922ee56bd37e56548ab1262f138386122aa5e66d84b080efb26825ef2515e6aad61f460e2c082d25b26950d694a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1La:A3k03kB56r
- TLSH T1F0156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 934KB
- SHA256 ed44899444a5cf21d0ddd9b09926a06b7c0d9c0147481f84061a7b306a74a9ae
- MD5 c583c635b95baae349f5e63233d7ad2c
- SHA1 e94f50a95642e5bcd40e34a2339a53696905c932
- SHA512 d7400bb51fa6766012949b1916baa549ac6fa5ce4f165209d7f1ff7f9f5928bda97b93a4bca70ebbf74ccbc8a884e6d22d5c5eab4161d4e76b871edacad6a498
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1Ib:A3k03kB56r9b
- TLSH T1A5157B03E6840FA5D00FC1749A958662EA777C466F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 909KB
- SHA256 dfb82a9d021bfb74cd13997e1fc237bcc4c1c2537b768b672dfdb8ee8b6cfe60
- MD5 69d94d3474dde2e383a2c3e0e6c594ed
- SHA1 dac541dccf40c98c04da048c68c89a9e6da0ce87
- SHA512 b51469635658f3a3fc5e1a45ba9f1fd7fd4b28f1e3927cdbf6a78ea87d898ee28f902f5fab497dd3c1f8aec84db9c60b2b5084d803a00fbb4fbf948e5a737733
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1zZ:A3k03kB56ra
- TLSH T13E157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 909KB
- SHA256 35c61768ac0f872f4d97318aa155191e4f098f2e9d707e72ade1c234e51a7af1
- MD5 ab2f2434dd47e690cced0bf525f2e22f
- SHA1 90ed7923d91ab7bb2db749a19c9c7ece05ecea85
- SHA512 da8d674c0930599b476570bff47425a2d093cb881a8bc5572fb99382ce6713d34c62351759da81030bb0707d47616cd188c6a5335844b64971847298f2573135
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1o1:A3k03kB56r1
- TLSH T1E1157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 909KB
- SHA256 9d0450597d665d11680e4b30796776219c079340e98275c41d07939f7b7f5a64
- MD5 543a689f3c50550c46db2f8d87bb310e
- SHA1 7c34c4912885e1cace26af8338c43dad4704e9b7
- SHA512 dd29c9c1344104e121724b6217e71d4edf45664355c3e49c3edc23088f844e3c21c326cdfaf6ee0b67be9c5b5024d97a20a179668794b214a0aa07cf12d821e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1K6:A3k03kB56rC
- TLSH T18D157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 909KB
- SHA256 8ec6515eba75dc40c11343158963d2e199578045140afe1527a0fb7ef5cb96f9
- MD5 4a53ea8f3f3dc24651bfd3a1ea643c2b
- SHA1 b09d69566de09608cf3033339b94d19a36dbdf21
- SHA512 57b7473f6a6b8d4305ceaa9c33b1515e14bbab035e0b9a062221390dbe1dff15263e471339c34760b0f566c1878fddbb8d4f1d5b22d4a29e5811e40a48f98ef7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1iN:A3k03kB56rr
- TLSH T126157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 909KB
- SHA256 08a94272ef711b1e8d7ca3b75909f9d2b24728ae2e28fe8419b4d0782fb82450
- MD5 08390082ab64c2d5a17e7950a7f11f6a
- SHA1 fd050b688b508b132944c8d00f67028a6c6b5613
- SHA512 da1527f6ef3c6e7b07941c0baaf73bcdc1e4e6cf3e6e2506008226c593d557d58bd17268bd068e174397201c48aa3b83807ad92a68018f3902eb2dd587f75b8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1Yf:A3k03kB56rv
- TLSH T10E157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 909KB
- SHA256 e4b2436754caf08ee9255a41ded2e598755a9f4964b821f7c72364e361547fb2
- MD5 2ad8b783f299ce7592777c4be8c68226
- SHA1 cfe07af1ec2654de25c44798830a9170b0a12095
- SHA512 b79a6353a0cea4459156e7e8c3ec5dab47d44a9aae3c3cc8e9d7f199663b527749ca0335f580501432eb4b3672ff4e31545c6c695f6955983f674a8d5bde1cf0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1yo:A3k03kB56rm
- TLSH T14D157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 909KB
- SHA256 131b37de076b970682595546dfeb5909cbb8044046c78b4decbfc7c471a2edee
- MD5 924bb1a6607488aa74f7b1ee46c21024
- SHA1 e065c95c50b1ef616148034df12431a26ff8b00a
- SHA512 e343dd7eb01607b3ba83a5cfe826aa6fb9513f8fa40f17fe022c4ca47e1d0efa42c9698db6a807905f697eaa924f7ae17fe33b65042190aa6169eab9e117d43a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1mu:A3k03kB56rw
- TLSH T103157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 909KB
- SHA256 fa87281f786e55f43be7682aa88c81108c41931b184094d196a5e773dbd3b008
- MD5 f8e99aa301856ea4a88aca4dfef73411
- SHA1 88243fd5b285dd103682aabe23f03a970a7ebda6
- SHA512 93a108ffedd4da7e5c6275cc25946b4e34fb48c91c27e44fa1ee59a14ff5c48b11742b312f56b8e3742885939baad7220b2b8be71072c0e966f113b47a9fe167
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1aL:A3k03kB56rF
- TLSH T188157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 909KB
- SHA256 9b3d5a340da17dc41229c7849ead2a79dd8824a3ce31df4b65fd0ae8342bf6f3
- MD5 095f0c258e162d3c4fbb1a52b2d1b427
- SHA1 7bab7d6893c042e4e61ea07305b17ae3be9f071a
- SHA512 cf5bcbd695f936ac1b0e5aa93d0e132a07beaa85790c773e62f803691ed7e55e07e39ad725f08480440152c6e45befa75452560302fdb2b110e600f09ebb9c44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1+M:A3k03kB56r8
- TLSH T11E157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 909KB
- SHA256 d6835e1fb5a4073bf2792b721911e1c2abce8808cd92153ba42006de878f42fd
- MD5 f04be1f9628522948dd0bc1a0cd9bef7
- SHA1 8333a311c485b6fb1f5c2b2b98f2ce078e32b3d0
- SHA512 298c632f906193bff04ac28eeb61a6d7d17ffbce8f673b3ec44bb021f9909aa83e5722ee0713c6840d8da9e2acc9a3a75ae16994be4bbc2ae5c4ea53c60a1877
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1nh:A3k03kB56r2
- TLSH T162157A13E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 909KB
- SHA256 70c740654d0d005ffd2b1c070c8d03820a7415ff0471b2c87eaff30de0478f34
- MD5 a35bb3e283ee0b5da9072796557874c8
- SHA1 f0a92fcab7adbc4c86cbfd225b889af62b8c3fe1
- SHA512 a37b08506d2c160f21458042f57ca22dd42f244e4402482c37aeeeb07e8e144ac0f99e80666bb48f8cb849ff0e23621696672ee15843fc985ae28af42774c0e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1Xj:A3k03kB56rQ
- TLSH T15C157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 909KB
- SHA256 09af23ae7bc1c818a290775a0625b4966ee40ac1022476ae645e2dbbd1c9996c
- MD5 f54579ee37d5429f5d3d94f39eef51bd
- SHA1 81c14ad630b304e5e0f1a9c74d68a3dcb309a7b4
- SHA512 cd25b7249a54e37b8c3f3d192aa83bbe60a4ebc6d8b1f09c83fac1e9307f571cb60c37adf48e7b167e891caeca15adbf0f3c862d248ffcae1161580080c1e822
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1dD:A3k03kB56rC
- TLSH T171157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 909KB
- SHA256 dd4f3a6e5c7a8d97ecc4bf5ff0465a1059e1b19bc130e6a444dd58973660d97f
- MD5 cda081f4315db175a081f9f25a280ad5
- SHA1 660a669507511e9f04580a7c7656fdf1bb0ea221
- SHA512 f0b7d4d0caff7a9a73318d87164aa2d356d0be0d3192e3c55a5bef828b3687242c46c9f7e581cb40689ea2428fcd4ba63f2a4fcd3ecf38551ac20a400da0edab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1hd:A3k03kB56r4
- TLSH T133157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 909KB
- SHA256 13733722a8d11a8fb18e56497bb72af878a343ce07d3d28a4542ed3b18ae7bc1
- MD5 5a1d52e656e9d3acab3687f963a6d4fe
- SHA1 8ac0a1dd1f0bd7a7db2ff4ef1054be6d07072f81
- SHA512 d0b1c593e3a87866a3613e2ca81debc417ae70ba1bd8ae82abd78c748eefb8b9865b6f04ce8d15dd3453ec471c294699d65a273567f4b22957da160e36f47cdf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+19M:A3k03kB56rd
- TLSH T147157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 909KB
- SHA256 4f22fca9af9502b05ce894b0fb034bf594f1e433948b4375c187a4f55b32da03
- MD5 74be08d4102b352ea04c5eda0d705874
- SHA1 067dd7568222655bfb7f3340960ce787659423a9
- SHA512 45e080adb508b7ee8fe98f4b8b9b6b476cad6c5b59a79a4f84cc7de4189b7280bd849902fedff69eb6bf1183425c020324f7bb5613850c9bbf3d62540c074c54
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1KW:A3k03kB56rW
- TLSH T154157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 909KB
- SHA256 32ffde18e18600d2820de7bfb8d4db6750d66f3ddc670d5564228b7784a43c44
- MD5 1106469560ed91104d06590278bcdef2
- SHA1 48c9ec7f20464624c063894b9e838100b0044f18
- SHA512 5a65350c033a7bfde85fd65363712fd74c464c93eba8473d86edf4202bb64130f626957053c847c5bfbe1eb58f2822177be3e522b1701ec6f4e8cc588fb2ba8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1V93:A3k03kB56rw
- TLSH T18E157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 909KB
- SHA256 eb1484c60ed1403dfc721e7ba52ac86f1cd12849b3f6f74da4f38dd62f72f089
- MD5 2228fd09007da581096a912c8a1059e7
- SHA1 e2d3cf623499c62ab02523f0f955d800c85a63fe
- SHA512 1fadfc6db54f896edbb4ab4dfcb1f299a33f50c6b80d06407d4a3e286a0a28dac21ccc1c62665b9ca740106d1f8de5bc59fffc173b7740531a01f6b5846e6890
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1f/:A3k03kB56r8
- TLSH T14B157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 909KB
- SHA256 cc82b007d94e5193c6d52fc6ce2350d5662224371b79c06379be201e84479cb7
- MD5 816f0b94b9e6f4cbd88b02c9045600e8
- SHA1 572f94d547d9c4a74b2f0df390cd69e2a21d43ac
- SHA512 504c692166bc618c18991a4f2fd2d04dd888111e6d95a5a8171c11bef1ecdcfb9da548e3d4c5bd473176315d9429e5d571d94a904f293e8c3b96ec042b783d79
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1Na:A3k03kB56rv
- TLSH T171157A03E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 909KB
- SHA256 50b3c494dd150af047e4dad4310c286c41896ffc344c68247e39e8982ac6b8ba
- MD5 3e7a57fb0ca310f43bdde8237e9afa0f
- SHA1 73e0972d87de406beacafa09a6bb55a17bf7245f
- SHA512 2da4a80ed375c63306b72f47a56d533db654df9a44c5c0c31787a90f9da327552c9acbbce2c54c1b6d7d2442e9837fa3c450e278d7dcd3bb29cb9a9c28a12f1d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1tj:A3k03kB56r+
- TLSH T16A157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 909KB
- SHA256 cf51cc1a7030584c0b36a2a3c358ac84a2845bbdd21c31671d576e37183d1f62
- MD5 f6f302499e45acf947712db3522414f4
- SHA1 9e35a32c0485dd2d751b8f18c90f16d748bdcfb5
- SHA512 556733f7713b2d2a0e6e90219792e6545da8d66a2f90f1ee7564268f9b5fc79add55b69ecb01e5f1c68c7041c533605de668ba97ea860d550920f2d9ca069660
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1qQ:A3k03kB56re
- TLSH T127157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 909KB
- SHA256 f01d64dace29e65c30d8785556e1465d3985e923f1d3606301998b1c7a80087f
- MD5 9b032638efe6870330eedd7ee941224f
- SHA1 f0f1268b497896abc5822d8eb158bf1facda402a
- SHA512 33016e736420a53babd7ec28eb64563204453e3c7352f8fab991787c742e26f77c273135511574bbbbe4f2fb6e60eec893cbeeb8373bd97e96a8b0f4876a6205
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1Zi:A3k03kB56rr
- TLSH T12F157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 909KB
- SHA256 28bd5d12b9bffe0627be0c263a2d59ea0be0c55135ca0574b2ec1cdd4c88e980
- MD5 06149a5245a218084b9179aabe3c2f4f
- SHA1 95de74952974a179a9b1d4dc584aae4422393662
- SHA512 e6c33787cad638054f3be9001e8d047f680c1064d0ccd576c7677d60ae8c6d848b297779e9c269b3a02e2a32bda0fd4362c32e2cd430b0a91f9cb0d6ef8d3e31
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1t9:A3k03kB56rk
- TLSH T168157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 909KB
- SHA256 c04719a25a7069d8e954f9cd8c6fc1363f46a8c23d457ed92acefc5942cf500a
- MD5 917c1b25352d32759d8ff0e4fca70702
- SHA1 53c51f5246929935de55ced2f80b04ca2c4aee23
- SHA512 6fb262f96a88a7472f94b546a277452227ab50bccf2f8b0f170c7272f2e556560fa9f5285a86ed3f9f52a9034bd5a352c7c4f097cc42ab1e4eb87f6406b4f4e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1Hv:A3k03kB56rg
- TLSH T1EC157A03E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 930KB
- SHA256 b914cf1c38cea05d8974b31c74d5dc505824d178486b6fa839ddeea4f901424d
- MD5 9a0e80d2cfa19e3ee7e5d1b973f88fd0
- SHA1 fc5f844263f36865a65fe4c318a5a3e667dd2d0a
- SHA512 619fff2b448b56193863a5848b13263b795c706c56a459eac94d2f3030f8feb00a9edb777c0d08a06cb275f43dc50ea34a324846e6431615dad80ddeca10e772
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1UwE:A3k03kB56rR
- TLSH T18F157A07E6850FA5D00F81749A968672EA777C421F2093DF2358EE153F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 941KB
- SHA256 62ccb41487184f4ba76050f3eb8a89affb201077f108569f275a668d1f98c722
- MD5 f334c62ea8659657ea9e2f950da16c8f
- SHA1 c6874353fb4295c8d3376fe389290a69392fccea
- SHA512 d65a77c10d35ef6637f0b1a6d2fa67254e77fa8c488a508cb4ae6c462828df2a4b67d61efea4461d67e79fc22c3456cccc3ad43dd2837ab2d2b7885ad56c3f76
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1b2+:A3k03kB56rT+
- TLSH T11F257B03E6850FA5D00FC1749A958672EA777C461F2093DF2358AE253F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 947KB
- SHA256 514b6455182228fb60024345ac7d06c9e6c064a2b4ff82b77fa906507d0631f6
- MD5 ad2568da25c10b03a22ba540f5fc3f27
- SHA1 1aaaa371b7594099618bf100a9bc7d1eac7ba610
- SHA512 e60c59276f01ab62ab6781bfc57ad676db8601e6ec02a33b22ffdcdc9f3d206f57745578f08c6512950020a4bcedc9a36cf578cfbdc3682b75804a4c21663745
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1i:A3k03kB56r9
- TLSH T116254A13E6440F94D00F917096994622E673BC0A1F6053DB277CAE253F66BF07A3D6AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 965KB
- SHA256 5c3df5f50cb311f854b115c66c53413469f3846fe47c8cc199837ccd4a2546c0
- MD5 12ea039edff75639409086cb06c9a892
- SHA1 2f490620cb70faf4cfa10986765e28d1cfb05220
- SHA512 c9d3c610ab4b9a4b974fc952a6b3822072ca316895eae8d614d422745ac883d226aff3ea57b2422d9e5e8f5df7775977933c19e02662d8da7a3a62a9fd35ad2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+1ZF:A3k03kB56r8
- TLSH T1B1255A03E6850FA5C54F81309E968662EA377D821F2097EF2358BF253F327D06A39657
- MD5 SHA1 SHA512 SSDEEP TLSH