Analysis
- max time kernel
139s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 16:15
Behavioral task
behavioral1
Sample
2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 886KB
- Sample260703-tp87pshv9k
- SHA256 e8e426618372c18e246dc84903be076ad8ca2086bcd5f3e80cd564268ae63621
- MD5 35fb771fd9131712cc9654697bba7955
- SHA1 b20efe8934602f7903d7d14b048f0540d3142ae9
- SHA512 aacbd302b368e1c331dcd8ccaebdd966165f15993477510abcc7e12223b7be3dbdc27de559e6482b8da85d6c32d5003eee17d1a6bc671a070e59911548f86557
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qp:A3k03kB56r1
- TLSH T14E156A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/6116-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c696-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b293-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a8-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c60-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6116-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/7052-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ae-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198af-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b2-221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b3-234.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b5-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b6-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198b0-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c69b-460.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198dd-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-487.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001993c-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019948-543.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001994f-580.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019950-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019951-606.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019952-613.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995c-620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995d-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019963-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019968-643.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019969-644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019972-657.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b3b-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a5fa-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a5f8-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a038-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a54c-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a54e-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0f0-1061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019eaf-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d7a-1222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d78-1350.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019d73-1388.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c696-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b293-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a8-39.dat aspack_v212_v242 behavioral2/files/0x0003000000019c60-58.dat aspack_v212_v242 behavioral2/files/0x00030000000198ae-201.dat aspack_v212_v242 behavioral2/files/0x00030000000198af-208.dat aspack_v212_v242 behavioral2/files/0x00030000000198b2-221.dat aspack_v212_v242 behavioral2/files/0x00030000000198b3-234.dat aspack_v212_v242 behavioral2/files/0x00030000000198b5-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198b6-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198b0-267.dat aspack_v212_v242 behavioral2/files/0x000c00000001c69b-460.dat aspack_v212_v242 behavioral2/files/0x00040000000198dd-480.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-487.dat aspack_v212_v242 behavioral2/files/0x000300000001993c-518.dat aspack_v212_v242 behavioral2/files/0x0003000000019948-543.dat aspack_v212_v242 behavioral2/files/0x000300000001994f-580.dat aspack_v212_v242 behavioral2/files/0x0003000000019950-599.dat aspack_v212_v242 behavioral2/files/0x0003000000019951-606.dat aspack_v212_v242 behavioral2/files/0x0003000000019952-613.dat aspack_v212_v242 behavioral2/files/0x000300000001995c-620.dat aspack_v212_v242 behavioral2/files/0x000300000001995d-634.dat aspack_v212_v242 behavioral2/files/0x0003000000019963-642.dat aspack_v212_v242 behavioral2/files/0x0003000000019968-643.dat aspack_v212_v242 behavioral2/files/0x0003000000019969-644.dat aspack_v212_v242 behavioral2/files/0x0003000000019972-657.dat aspack_v212_v242 behavioral2/files/0x0003000000019b3b-736.dat aspack_v212_v242 behavioral2/files/0x000300000001a5fa-803.dat aspack_v212_v242 behavioral2/files/0x000300000001a5f8-811.dat aspack_v212_v242 behavioral2/files/0x000400000001a038-873.dat aspack_v212_v242 behavioral2/files/0x000300000001a54c-1014.dat aspack_v212_v242 behavioral2/files/0x000300000001a54e-1022.dat aspack_v212_v242 behavioral2/files/0x000300000001a0f0-1061.dat aspack_v212_v242 behavioral2/files/0x0003000000019eaf-1141.dat aspack_v212_v242 behavioral2/files/0x0003000000019d7a-1222.dat aspack_v212_v242 behavioral2/files/0x0003000000019d78-1350.dat aspack_v212_v242 behavioral2/files/0x0004000000019d73-1388.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 7052 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6116 2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe 7052 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_35fb771fd9131712cc9654697bba7955_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6116
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:7052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 886KB
- SHA256 e8e426618372c18e246dc84903be076ad8ca2086bcd5f3e80cd564268ae63621
- MD5 35fb771fd9131712cc9654697bba7955
- SHA1 b20efe8934602f7903d7d14b048f0540d3142ae9
- SHA512 aacbd302b368e1c331dcd8ccaebdd966165f15993477510abcc7e12223b7be3dbdc27de559e6482b8da85d6c32d5003eee17d1a6bc671a070e59911548f86557
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qp:A3k03kB56r1
- TLSH T14E156A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 ae0e358fb0b6a506913cfc188e2e88c7e8298b911dce8855b0d43cae7d343cd1
- MD5 db3b7d0a00e5bdc0ce9d6e9c00334196
- SHA1 dabeb8c04e045c3f8d5d9d9fea000a843d63b565
- SHA512 c37dcd47ab911a30a3408c0d978c260534bc018f9451ac7ae633e42c3e5737c1aef7b24ba8e3f20f16599144736aabf0c74e1da1942f74eb649fce408965f1a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QV0Le5ji0hmxNrM:A3k03kB56rxPji0Aj
- TLSH T1FF655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 900KB
- SHA256 481266a7247fa3dee1a6a14622dd275fc14ddd0be82e36481651f6e6c7e47f48
- MD5 2c669a7033036c94924a3733a80842cf
- SHA1 1e8dd887314053049589da8e2c963b1be0255938
- SHA512 0d8270265f953cae1888d24e4845da71b7b566e59482d07747878a5fa8cd6cf2ef6b20b2e04625edb6fad883926cf6dc2f5e4c5fa0e1ca17e1753e1e1e4c8284
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q3a:A3k03kB56r
- TLSH T18F156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 934KB
- SHA256 4349e8890a9eef80891137a97b682da48264eb50b25670e18cc2f810fa162654
- MD5 85622ed90cb88dd20d1681e0f224e384
- SHA1 81c53c78f05aa0ba2db5e72db4e848f4e7befd1d
- SHA512 4cf4cb2849884cad58d01dbdd36a754016cab6078a5465ca41163b597b340164712f33a2b07289f35f28b339547b34ff7b8279ee10334c2c40351085e9eb6a7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q0b:A3k03kB56rAb
- TLSH T1F5157B03E6840FA5D00FC1749A958662EA777C466F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 909KB
- SHA256 c031d6b8e85c938db92fed5369bb799f366f0779aa97753f5acc4e57b66de7da
- MD5 c2f7c9ea0a5067367c8335e93ef2db02
- SHA1 12e56fb68d09bad4370bfe8557a57a9bca590a7a
- SHA512 5424e3ebf4a098d8342e57f9b256988478eec401381b2045f4b061d63c737f7fa84033e67c7e2a98aff57980626f9915062f74bf61f2cab94cb3a64744a543b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QHZ:A3k03kB56r1
- TLSH T151157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 909KB
- SHA256 2b0f72d7b999aa2e54352065a57bde419d009cd2a785ed7e5ce34476b0c63394
- MD5 2abb278bad60854e511b094925c83492
- SHA1 3181a592f76d551992f9e064ffe16f4a7bd86209
- SHA512 3bd2d007f2a8ed49de2d8f11910154979dd639c0e84de55685bfb64dee71ed7e733cf3ba3f5a86e4ab0f8eddf40c6f8666364f56fa31b61bf53dd75ae269fac1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qc1:A3k03kB56rS
- TLSH T1A9157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 909KB
- SHA256 86990899d2628e1e1de6f602a7d093b5e0d829d572c03e465150a99e42b6f775
- MD5 a9b5e1866b93fe4a14bb3a49a375d0a9
- SHA1 924dcc21eda546762fe0ef06d26babbecb26ab38
- SHA512 a6f9035f753dbd6de4ca49329dc1b67e4130c185fb20eed24df351def7c76e740a07e224b1f66ff27590ec2bfb93bab9abf6bb183d514f0ea3e77ddf69e02bda
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q26:A3k03kB56r9
- TLSH T1F7157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 909KB
- SHA256 7519a0a4df9b773314c62a853f4043b7c1906dcc5d38b16ed629153414c9af43
- MD5 905fe626b2093e6f8e01be361e8b73f2
- SHA1 99d5aeb9abde46d9ee9c7a51dce87fcbbb0ce5c3
- SHA512 044ef8699ff68f26e8b343872633b984743e738aab7913304044b2a241abbba90a776f43a3674589cce9859f3d7f4fed212ee961ebccd35508243b989342e644
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QmN:A3k03kB56rc
- TLSH T1EB157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 909KB
- SHA256 b2144659a7188d02437d5f3c451f6646fc4df2d7bc374406e56a435055fd4fd6
- MD5 3ef713f18ae7ff0e6c20952fcf1c7264
- SHA1 e82c3e63be1b03c2083fd5f56d5d0d9bf69867a5
- SHA512 663369bccf6d043450e15dce05ff3d0ca2cca6860d8f65c4888b2bdcac7d43a73e2f59f5ed1a14eec13305c6b50b425a3a6b9dd0d6141df10c4553642a615378
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qkf:A3k03kB56rc
- TLSH T193157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 909KB
- SHA256 ac145930be8afbae080f1bcff8ab95d0c3a6def270d4cd7af15c45a8ea5c70fb
- MD5 d00d331378d3fd23202a392e88e45b9e
- SHA1 ca241cb8c7d2528fa822fca6c18995e1b2c58142
- SHA512 8076b5d6b545d2265ad332b3052db86a77e154f4238b72349709a6e938ec26d9a60bfaae5b5d1ffc33499017a724671b1c7cf27e8627a2f7134897c03a5d52e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QOo:A3k03kB56rR
- TLSH T1A4157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 909KB
- SHA256 bf710c0a5ef289ded6443e53b0c63c0da56a0e3ec0e308c582a6051b3eaee39e
- MD5 02cfdd85acce09d7103060fa38f39f3c
- SHA1 89ac3403218e6c80851c4959aaa19676c4d916c5
- SHA512 a43e0a5b2bca25971de1acc39f7b1f3e3670a180148c4f3baac806c777d111285023f6509bc02651fd1cfc814cef8fd67610562415687cb8ded0eca08760ec8b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qiu:A3k03kB56rD
- TLSH T136157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 909KB
- SHA256 3793bdb819b80b7c76fefb320f00f1f7f59b382a9590bcebfb5aecb95edffb36
- MD5 1d494b46c33a2c56a30efdbfad7318fd
- SHA1 8e4505be17d77d4a4ef8c7404005fb6b216d03c5
- SHA512 17326b62cbd07f09aa6a400c2a4a648df0a08e54d98cd63d42b8a03501001e73f2479e902f578eb8c8a9c6a51c27a5d0e33d81b8f1ea4917a8672b59a798fe5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QGL:A3k03kB56ra
- TLSH T1B1157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 909KB
- SHA256 8b856bd5995fcb0ed7f5ba60670c08df1023e3c4934dd7a9f538096a8e2f7efa
- MD5 8b00e40c1f6e7b9bafd82c4f816ee5ea
- SHA1 2c42208570295c30db67bc033aa29a9e40ee3496
- SHA512 ba4bb88bda874220c5aa9b17d8075f8d6013e9771b64483562a40f7a934cf794bc000c21f8f95d3d71548e9633b274ad45053328520fc40d8f8f34b54749ce3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QaM:A3k03kB56r3
- TLSH T144157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 909KB
- SHA256 b5f9db903c6ab5a0a7082fa938b0fdb1c45cbc38b2d9c45ecafdefab83e88a72
- MD5 310aac4234675cdd1550c8bd217a2fe7
- SHA1 252d332c36ab76cb32f92e3a0b820195dbb157eb
- SHA512 55399d8dd2133d78d3923d312a848a7f2173db4ff7d64762127cdba606cc7566d8e8d0e5c756aaeb1640f204afbb2adeb56fbc59599007423a0de59e17dba5d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QLh:A3k03kB56rp
- TLSH T1CE157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 909KB
- SHA256 dcf9995e28f7af794d8f5cda274ff09be3ccc609b88d74ff673d68f5ebdafb40
- MD5 1fd713cbeb2f0c8cf20a58a2979826d1
- SHA1 e1e43ebad2c3a72f37b0c5a8a5f686614fa8d5e3
- SHA512 3d4962a858e8d207dad906017f0b3eae82ea982c933b861d26aa30398fd8b60138fe38f0713ef304f39efafe3d714fd207f089fed08b1b509264d54f05adc3bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qjj:A3k03kB56rL
- TLSH T168157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 909KB
- SHA256 81772e594d201c5ca54cb03addd72dc49c36a7857662168106ef2e75a63ed176
- MD5 1904d07ae0c2cd52eb94b6728c940564
- SHA1 00d6db4c68977a4c645a521f3765f316e40d88a5
- SHA512 60e239d9134661ea268c6aa87dd2acd058a010ee13e25aa18dd77b4999dd5db7d2e28d3de0c32d37efab9c00a0db12ee613210f2e4884c70f2dda577a648eaab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QRD:A3k03kB56rR
- TLSH T123157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 909KB
- SHA256 232ad02e01d792a5b3f5d5904791e24ee4e69cc42609c2e70a6bcd42716582fb
- MD5 17db5d28c66b92af0ad5fa4fd0498ab1
- SHA1 b8d8bdf85f424241e940471d59055bed07903079
- SHA512 6b039492f77389ce1e58d8572cc36c46cfcdc28ea7e50ebc74ff961addb9a832c6e06207e901cf3d47ca61a7f523ad4193385d88090d616136680429784f52c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q1d:A3k03kB56r7
- TLSH T117157A13E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 909KB
- SHA256 5a55bea1be0fdd8904ae19aa7a0c8a42f64f8d2077019652215944d25c33e54c
- MD5 bcecdc97780165b046bbba822af8a540
- SHA1 7694b60e914d7c2c04f5d2e40a8f1ef2d5cc2233
- SHA512 71d14ba926e9bd9ca307bb8905a1738ea3b189bf13588f0a6a3b0fca3ad765da8938ee497ede31e23e3516c1694777c29b4ed7b98df98695620aa70ceb254737
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QpM:A3k03kB56ri
- TLSH T1CE157A03E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 909KB
- SHA256 1182dbb59ea727c4e471711fb13e2790ac0d61307a832f410e50bf169766a0d2
- MD5 be824be9511c59beafc286bf81a05570
- SHA1 29a2cccf66901067a23001319770a0892b5fb191
- SHA512 5abad60e78b95f50e28e636fb63faa0fe733fb28f630b4b3022a19f3276e4d896c268a643f7b053bb200a8684dd0d10e4a9e9a70627695c43575cb4eeb8ac9e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QmW:A3k03kB56r1
- TLSH T182157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 909KB
- SHA256 bdbf00a2369eb2336ccace88fb8d2d374a98fb8845e8a9bb21067ad9021633aa
- MD5 81351acfd591fd7d4e6d82515f0106b2
- SHA1 95099cca9ccc373d6fdb57de80de9a99dcd23b12
- SHA512 a79f56d40ac9a5e8ca4a98c1b4dba080c5b30c66ac7e6d49d2c8d2180adaf3c40d3d49f3385336eac5fe81621030e1120f4259893f7e0113cefa9e1059ddcd4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QZ93:A3k03kB56rj
- TLSH T1FF157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 909KB
- SHA256 4a5d242e8bf0f77a735a37227623334d8b9084264ff4921bf1b8b0f4362565f5
- MD5 ee2d923704a8491b5d2a7ecca9174529
- SHA1 2f629d89695ebe6ce96f314907f17dab492d740e
- SHA512 d7037765194c4657672684ba7abd452b95c48b2770ae2fff088e7c79b0c8c86697e32a65597d14ccdcf658f00d6a6a656cc2c54620ad0ce2a900834122f3b927
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qb/:A3k03kB56rv
- TLSH T169157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 909KB
- SHA256 87665a9f5bf020ca9080e324e5af1ef4bd5d6cdf2b9215e0270342f2736fe6a5
- MD5 f2f0a9634735786f53ba019b51b41fc8
- SHA1 405ee133902ae717039e9a26397cb36ffb74c86e
- SHA512 d2486679141352188f56f739e45fff5f2097936defd39e9bf792be24dc613205fd04308efdcfe2f669e49f2da786d98e144a38f70229ec334796e5f1c62d0a96
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QJa:A3k03kB56rQ
- TLSH T164157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 909KB
- SHA256 d41ac4519353b0e41940d550cba3e727648d830941625361303a3ae30c29343a
- MD5 11ce97f32b5a3aa7d3327beff43329d2
- SHA1 cd71fd01d4c3259ac960c7d680e8734143530222
- SHA512 d006f001c13e352acdc61b558e245615363b1ece81ff4eb0ffba3d0d6dab2be59924a2437bdb7f885a20df4f066f810af637bdc27bd7fb6de7384f1e7f0d6174
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QJj:A3k03kB56r5
- TLSH T17D157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 909KB
- SHA256 a51257c01dccfa86c14d9903b4bb3125fec4871638dc2889bab76b40a45cd448
- MD5 86d173898a505eb02b06dcf4c48ed5b4
- SHA1 8fb98abeb1b2cbb7683c70443c63cae2aa2f6534
- SHA512 1fb3b3f2d0684826f500b391903ff4365d6b305aff3bdbc650f94e050a2e273e63e10260d79a131d3c8345368e361aac2df0e52bec8ba7c1de94f51c9eb43719
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q+Q:A3k03kB56rx
- TLSH T16F157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 909KB
- SHA256 012f6cca5de8665030cf069ecef65b1cb6e06343320733eb46b4f9e53e93aad3
- MD5 eb10c62980b09577ab18dffd2e6e16d0
- SHA1 15add24cd2ee71f3ec6f9d2a63908f2d0add03dc
- SHA512 cfa9a04d7692dccff6a0b99fcfdc00fb465770141e9be8cde3c8d9f96f5014542ae284fb92eb4f5887e785a834b65011bf391d64ae1422556d98560b8474ff23
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qti:A3k03kB56rw
- TLSH T158157A13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 909KB
- SHA256 6fef61a300a04128719b0c4d49c373adfe1cfbefcda8e372a2a4e80d8d8d7f4c
- MD5 99b15112b92f6ff9f1829a0eda35ccf3
- SHA1 944c5bdee6e27752241dd63c004c850135058475
- SHA512 e6142fdd8f664e4598b42d8be4da3150bbbd058e4e78e201d1c11e549a39c510f88351b98843aeece1567584c90c64ffc10258c6177874f8a3202c5efa7273f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qh9:A3k03kB56rv
- TLSH T190157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 909KB
- SHA256 79412f04b2efc7707fa99201df81fbae279839d47b53df1a9750181088a31b0d
- MD5 a3f6152a8c46c237540ceb50e8c84c99
- SHA1 6f7db27180b261908294de10e8aab4c176b0b0ff
- SHA512 010b5b59b7cbf770a0697a867fe79e6369e8959b8c291dcaaafae5d10af27971b494e7791a4135a559e5974c28068d4b91a09fe59c19c41cd31c1fe11c75f82b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QLv:A3k03kB56rX
- TLSH T17B157A13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
- Size 907KB
- SHA256 273c3cf26bbd837c0713b266a013521eca676798786a56c3f574fd766ec0b1ea
- MD5 c525dae41991170f5b02390962ec4b84
- SHA1 f6b5da1d304184d8cd8e81bdb931eea376d76d5c
- SHA512 aac72413dcd916299848405377758d933888934ea3246c183de83bbdbe484bbebf0d99d723845e96a25690e0e3feb63de078c81ea5c9bdc69b8e7e88492c75d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q8:A3k03kB56r
- TLSH T168157B17E6840FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
- Size 907KB
- SHA256 2e5cb629512567c50c72ef41a618b6d3d7710aec3be64ed682021705c2631186
- MD5 462c9e78c4718de0b3e51aeda256ace2
- SHA1 569640958a5f67c87049bad2ce66578fe762b9be
- SHA512 f0465ee26663d0b6ae9c5b26d7488e9329af57173d068807c2320b1565f71b35e9dbcfb7a7f48b075ab82efe5a73f5254339335a34055c890ae5b2663d3472c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q8j:A3k03kB56rq
- TLSH T1AB157B13E6840FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 919KB
- SHA256 3c33df86c7cfbede9a1b8ee983149340091a7d28be22e2f22f77bda34d007bae
- MD5 43a052e776cc575d665aff5140574896
- SHA1 51bd10a7653642a932b764b500e43aef3589cc46
- SHA512 cfafaa9d6f23991aea4e6a9447e3833326ea5f25efc213529405aaed360d0e4652fa1a8e096bd26ef08872ed408e8fafaa303c196dddeee4eecbd9cb1ffbd947
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Qg1:A3k03kB56r81
- TLSH T1E3157A03E6840FA5D00F81749A958672EA777C425F6093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 962KB
- SHA256 710f97a81b490542f6810540d4d127b32e61b626352c6f0141653d4c60ce2ba6
- MD5 84af73ef675a1acafef00dc1fb4ac2f4
- SHA1 77d75e4a2621b1541b7a6aa60b69fb5d9f293275
- SHA512 601e80fd6bc7805099b48f3a8f565d174cfb3becc953f252f88ca46c66d4df80e98bbe4e384a98975c012abdc500cc061a358d1ff265e2ad4c7b5cb9c6a62c33
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q+kUl:A3k03kB56rC
- TLSH T1DE255B07A6840FE8D40F81749A958672EA777C425F20A3DF2358BE153F72BC06B3A657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 930KB
- SHA256 4b5d429992ecedc0b02f19c09bc64c52d829d08dc11cbe9ab13380d3f32e24c5
- MD5 a78446ce0a5d41020b2478d76d34b237
- SHA1 5b1000613e952b0c992d7f2c333c082afa9f6c65
- SHA512 e52496eac6a445167188cddf9465c4b4b609bf48b95e73db9f3b4437e357f818810d54c3c15805de231791a03d4aba85b62b8532f08507285c4ddfdd000878d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q4wE:A3k03kB56r+
- TLSH T1B8157A03E6850FA5D00F81749A968672EA777C425F2093DF2358EE153F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
- Size 942KB
- SHA256 cfed42e4b86fb89e5c772771f3eeda388f88549a953419e8d690f7f149e93cd8
- MD5 55e1e414aba85d1b29b9479124c3d90c
- SHA1 7fd501d5be91155053bf0b23fdad6b13262b5778
- SHA512 aa41acd0271d086c05477783846914b6640ad495ba09e48001dad78f0e6bfa3eba40b1dbcf2f846c915fa8adbf32955fc795aab05a7fa1b905450d5f9a7f286f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q2nlR:A3k03kB56r4
- TLSH T1E2256B03E6840FA4D00F817496958562EA77BC4A5F2093DF1368AE153F72BE07B3D6A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
- Size 925KB
- SHA256 087d093f108e0c2d99fa52cda03bdcb08fe49aa4f5e6ce4d7f75f91aa182c712
- MD5 928dbb0c3a4d20ba745708e440edc9a5
- SHA1 977e343d950e0fb3c11078cd639d47228f9136df
- SHA512 444512e15eafc11fdacd0b3cad5b77a9d440a06c71cb5a6ce5d9afbfc1a31083254ef5ebb7f4fec3b531a54687ffc8e4233a3883292444317487441fed5fb262
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QBWl0:A3k03kB56rt
- TLSH T1E0157A13E6850FA4D00FC1749A958662EA777C425F2093DF2358AE253F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 941KB
- SHA256 df7478f8acf00170fbeb0f54776fc3b102e2f7940601195ab8f306bc77b4a4bf
- MD5 38251e75c1a04e36991a28e1efe8475e
- SHA1 20924cd94732d67aec906012f934018b2098a039
- SHA512 4f5fa4411ef9c84fdd64b994428645db979ea8060707752949b66afc7797861d18ba3afbf5e5e233c89d5bd7e3f18d61742b441f8d2daaf9d2c0653be1353dcd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QP2+:A3k03kB56r6+
- TLSH T171257B03E6850FA5D00FC1749A958672EA777C461F2093DF2358AE253F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 947KB
- SHA256 516d0e6b095fa36877a2c67b1f2d2a5d3208753788f364d902d6a65ba8878363
- MD5 0041ad291cadc19a6bce35d724c56e41
- SHA1 edc006565f1a31c0d3bac67e693f9a33ecfaf654
- SHA512 c4afaed75405dee05f6dd4928a0ff5cd2864c7855f88d3996731d945a4cc35597a0120935c2e9a5940ccd6af6983e521187aced99ddf3e6b88b765c796edfc08
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+QG:A3k03kB56rq
- TLSH T1EF253A13E6440F94D00F917096994622E673BC0A1F6053DB277CAE253F66BF07A3D6AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 965KB
- SHA256 732deddb3366f8f9f585b5c360302c794f0920787fc18079d8a38870b274d3c5
- MD5 470bf77a90a5bf8f185e0a4aa439d024
- SHA1 75a6b4e787ccb08aa8787fbab3612dacc72cf780
- SHA512 105495c57e0f49f7ab5d16bf7361bcedd6c840dcc22c7f87485b5a8c77d6cfa9643774d1082a29db90f8d4659370d4af9a49051826c7b66cb1fb77da31e5b8dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxt9+Q1F:A3k03kB56rz
- TLSH T1A9255A03E6850FA5C54F81309E968662EA377D821F2097EF2358BF253F327D06A39657
- MD5 SHA1 SHA512 SSDEEP TLSH