Analysis
- max time kernel
116s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 03:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 809KB
- Sample260827-d4yfrayhnd
- SHA256 65ab88d7c54e9927e36e1380f96423c7f2550b71513da6284dfe0bdc72223dad
- MD5 ef342d7086de0cc83f4eeeff54f4e13f
- SHA1 fe8cb5719fea59ab8d93501b4ba94793e75b775a
- SHA512 086e76fc3edd26773a9c63609afa385909526b03cca796f8bd754a0a7c0765c69d17a1350503785e75e2fd7ae4d33121918017372eb7115500309ca49529f1b4
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar0:cPE/72wcCvRR5FTjkWIw2wEHsxqp
- TLSH T1DC05081767EC0994E5B2663049B54611EA72F8561B31C6CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4316-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c32c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000000436-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7b-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001896e-197.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-243.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a4a-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-425.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-453.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-454.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-522.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-651.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-774.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a767-847.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000019fca-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a57a-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a6ae-1073.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a764-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abb2-1299.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abbd-1355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001abba-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4316-1403-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3812-1404-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066ad-1855.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3812 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4316 2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe 3812 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4316
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 809KB
- SHA256 65ab88d7c54e9927e36e1380f96423c7f2550b71513da6284dfe0bdc72223dad
- MD5 ef342d7086de0cc83f4eeeff54f4e13f
- SHA1 fe8cb5719fea59ab8d93501b4ba94793e75b775a
- SHA512 086e76fc3edd26773a9c63609afa385909526b03cca796f8bd754a0a7c0765c69d17a1350503785e75e2fd7ae4d33121918017372eb7115500309ca49529f1b4
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar0:cPE/72wcCvRR5FTjkWIw2wEHsxqp
- TLSH T1DC05081767EC0994E5B2663049B54611EA72F8561B31C6CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 908KB
- SHA256 47b5ace39f7bf541e20e47c48f5b0391fc5b5267f8a1a78e2a021d1ea23a62af
- MD5 11808dd8b0cd499868539dcc1d1bf3af
- SHA1 a9e51b2258a0032e8a64d5b3725f60983396d19b
- SHA512 9406cd84172f3e51576cb19ffc8898378dc7d2c8651ad9ed9d8284ade1c83572c83c32c42099fdcb7a9a31fcc1ef7f89f7d9a1a61eef4f4c28a32be263aef728
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2wEHsxqm2LoqDB+Uc:J/sCv7rTiw2lHsUm2MqDBxc
- TLSH T101152A1767EC4894E5B2653049B58611DA76F8561B30C7CF12A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 77b53af76f6bc1f152c02b9bec02b3b5f1d0b326897508444cbf0f40017a373b
- MD5 a8302327194a2e64ace13dab60b446f0
- SHA1 dfe0c495b4920b24867a1bda395e3562b0c2c919
- SHA512 3ea6e57874c72fdd74141daf77c544381a08944bf9d18d9605687c6d125a453bb473a08e17014ba8a6e733787f4d0bce646c4280ba48a451c68e3fe2454cff35
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2wEHsxqjXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:J/sCv7rTiw2lHsUV0Le5ji0hmxNrM
- TLSH T15E553A17B6F84661E073E174C5E58646EA72B4451B30C6CF12A9C73C2E63BF1A939B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 824KB
- SHA256 4400cbf2910a1f68328d7fe97d55e242c93fea6dcc2eeae58dfc6afc651302a8
- MD5 2a608c34307ac4a85b323d1d27cff23b
- SHA1 e2a3012df07fbc3f6d71556e7eed6a7009121254
- SHA512 677a9a98ba92861b3c1e527d8d3af0ca035c15a9e226a84c47c50a2a2b9fed46ebffdc2d2de3c03694485074c2f2d4352f041a787324de6c3a089bc47f8a4028
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arV:cPE/72wcCvRR5FTjkWIw2wEHsxq3a
- TLSH T1FF05181767EC0994E5B2663049B54611EA72F8561B31C6CF11B88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 857KB
- SHA256 7224730dd097a628a821f6ff111b8eb4807f923e082643f7014402483b4c61fa
- MD5 c921ea1fbb3c9a52838c38c2e42067ba
- SHA1 8782216ed2032bedef066eab0b143a40d839a9db
- SHA512 1e9d21d51fe0b8547e6aa2552097d438f75b57eda07e8b8a5988edd9c077472c3a5ba59c261408d883f882523b92f88ce44e2f93c7e32ac2a8f0d6ee31616cbd
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arJ:cPE/72wcCvRR5FTjkWIw2wEHsxq0b
- TLSH T16515181767EC0994E5B2663049B58601DA72F8561B30C6CF15A89B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 833KB
- SHA256 12399e3ddd7512278c94f12d136bcee490582214d40926e530d4cb6b18bfcfa1
- MD5 481c4936e15b7ce3ba391edf29b4320e
- SHA1 e9ae8bd111fee7f7ae2cdec3998fb9e32705d25a
- SHA512 4bdca58d1cdd5e4b2b68d5292a69764e21d7095b5386c2d5d682a718aa877e461a99f64a165df351fdfe2c5ffb6af975713f3131bcec7766e7c12aaed54b7118
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ari:cPE/72wcCvRR5FTjkWIw2wEHsxqHZ
- TLSH T11505181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 833KB
- SHA256 6c2b621150dd433bfa952aceda70e62ec792fb2fc30992a8c940c960db8de1fa
- MD5 80abde6f9a939ea89c8d4a583397e5ce
- SHA1 490810e77709a76c541e46b4223adcb0852679f7
- SHA512 9e54b1bfc423d05566d9bc05b6dfb50e50b04b5d117eb4770d5842032e239fd24e4bf09e6b2e28b4798b8ed44654e20019c37986a609256de19b96ac55c0a48f
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ard:cPE/72wcCvRR5FTjkWIw2wEHsxqc1
- TLSH T12505181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 833KB
- SHA256 0a9b6f3dafe950d40d7dd7b51895a1ca0ea8c803591fc154945b9fa894713cba
- MD5 23d7a4102cc2769e6b0f3cad6ff747a0
- SHA1 d7323283d1c53605d2fd272bcee16360c40d6ce7
- SHA512 c77ce50bbe22f4fe2129aa21f7daef7dfd3c6d57d8666b8e7f0c7a54649e58c5e3a60350164d025e9531289b79cc601081ae3c40222456b700481f6fe494e6ae
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ara:cPE/72wcCvRR5FTjkWIw2wEHsxq26
- TLSH T1CD05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 833KB
- SHA256 a216228f74dc1fa51e338b9a16ee69057e4c189352a034b8948246a8b4d23dfb
- MD5 008f398d6f33571ae867422a1e949e65
- SHA1 aea6b1bd868cce5613a05c907d5bef6b4782edba
- SHA512 8e65c3073f2f391e95b8bb9597ebdcf6ff0dfd1a8959e7e0d3ff41653d56d9ea4b5d8ce0c15a8252859e8f3db6e24383dddd6941a1144e77421bcab056219ec3
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arT:cPE/72wcCvRR5FTjkWIw2wEHsxqmN
- TLSH T19A05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 833KB
- SHA256 ef7aae607d2ca82310cf28bfdd2e25eec6b1d7bdf524626bea0b30930bb86126
- MD5 f7e902a2e09be2cb614ebcc8461cdad4
- SHA1 ae7e7494c9bd80b95bf3a477c7c1ce10b4818f40
- SHA512 d85fb21e7f3896aa9f7892a84dd4d4ff761708316da9d15fcdbd976d6aa11e4d92e0cbd30d744a6d156f0ddc665997cfe31330b46623e1e0ebb89c4490abc77a
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar3:cPE/72wcCvRR5FTjkWIw2wEHsxqkf
- TLSH T15F05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 971KB
- SHA256 1d2afe398a8ce33ada79183ed5bf72bb8f0a76c4842f39b34a256dc634dcff8c
- MD5 f06faaf683c1296e2b1b77f09d082954
- SHA1 ae3e94dc147aaf0c9486a1bee114c45208542ced
- SHA512 63f5f2855679cfa04bdb7b3facd0e4c83652e93335f6a00f81809bfbb1b7d63c29138da711e2556c899c165e37043ef2fc8e42ccbf0ec35ec58ec8096da1adab
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2wEHsxqSyPz5L87:J/sCv7rTiw2lHsUPzy7
- TLSH T1EE252A1767E80594E5B6663089B54611EB72F8651B30C7CF12A88B3D1E73BF0BD38B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 833KB
- SHA256 e8df5827994aaa57bea0cf22ae713a3b78238a677f6816bc1fb7cce154472332
- MD5 f83b822bd32008b975943e840cbd4fb4
- SHA1 c7e29cbd849e968d4296aeed4550348b6c0cfa63
- SHA512 6cfb8ef6247cfb5d0112dd30723ae70431f27068c4aae76478856bf1685cca5f2d7437ac72ccefd4ab6f3b6935310cf6a0e814d9c1c3f4e052f3ba85c95bb232
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2aru:cPE/72wcCvRR5FTjkWIw2wEHsxqOo
- TLSH T1A605181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 833KB
- SHA256 0d15c8f1f6a662f84377e50f1f7d74b48d9cddeab07947cd8b503684c24bbdc3
- MD5 816e2001f66bea6aaa86655c07f6c3ef
- SHA1 953015be5f60d88ddf377b422590679ba75b7db9
- SHA512 e920a3d994e695e7be372a35def2b3750020ede9b75ee42addd2f2e4bf476e596b5f72e13496926b9e2166cb3031301c83a6e60faad7ea826c591fd9ff3319b6
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arI:cPE/72wcCvRR5FTjkWIw2wEHsxqiu
- TLSH T11705181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 971KB
- SHA256 b377ee4710b39405f7a960d202eb0cba294d36461f1d9fb05a17d510ee7fce4e
- MD5 11eb213a30c5c7c694d7622a10c8279d
- SHA1 245c097e881a55f1c1fce5a0f2f5e1c01aef4ecd
- SHA512 c1bb1a0fbd2d8478e86477aaf3fa406bbe9aca80144bdb0e8aa0598f8d5bfc5f7de1b597f0a040f0d7dd12f8348f4e9abf0d38de3f0bb80fafde5a4f4cf23803
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2wEHsxqvyPz5L88:J/sCv7rTiw2lHsUCzy8
- TLSH T192252A1767E80594E5B6663089B54611EB72F8651B30C7CF12A88B3D1E73BF0BD38B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 833KB
- SHA256 8374ba166d6976956f4a3a448667a00dd0b7a706b90093abe4e0194810217e43
- MD5 8e728562ea8d60b73f4a0640ebb88832
- SHA1 9635f4119886e4492fb8128e2c13ee780cafac7e
- SHA512 933bb3be554955ac0627703af41cc2a07438ee7c49c14b99cf261da89eb20d78d1eba2f4bbae457a0301c347ae7d87f4e7084490bac57c528cebf67473c5dee1
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arV:cPE/72wcCvRR5FTjkWIw2wEHsxqV70
- TLSH T19A05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 833KB
- SHA256 18797313915641f2635edb2750b4cd3523e973df679d97d5b55b0c83edfb0329
- MD5 03eed5349e061aa4a43730d24a2ad3fc
- SHA1 34c799b75337e83118876f46280e40bcf8d898f2
- SHA512 ad6231d08c4282febd254d52e375e46ad5a50c238519a760a937caa6bb0d87e73e2a8e2fdf2f8377f3db5914de0741d1834df0c5684f435e1be90c72011d0acd
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arX:cPE/72wcCvRR5FTjkWIw2wEHsxqkr
- TLSH T17305181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 833KB
- SHA256 526f59df1deaccc45283f2c1d4acf6fffcbe70cdff377ebf860b5150266c884d
- MD5 7a0c2c366b33f8aa3ed8c80d3c20d64d
- SHA1 83a1c458d0f6bf233705e2b7d457cd350dac2a83
- SHA512 2abddd4f74516875436addef586699b34cdd71cf77db774380fea84facc2bea51fadaa1e8c8584b2f370e0229b6a720b89d2bcda72ab714970df25f2099c9428
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arh:cPE/72wcCvRR5FTjkWIw2wEHsxq6n
- TLSH T15C05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 833KB
- SHA256 4a8ef79cdaeebf53e1759284824df6386c7b97d51650c23aab46f6849293fba9
- MD5 f64f807632799f8e81a5950edbdf7147
- SHA1 61002afb0066d29d88e70a64708fe2c0890273aa
- SHA512 6a0bc2e53768a7978d02d2899bedefd5a4757d0c4233e43e2496cfb32ad3c9a298ce12e180f68fe1dca58480f94a57afbef0a6b2520c0bdf0dbd0bf1db3c320f
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arP:cPE/72wcCvRR5FTjkWIw2wEHsxqQx
- TLSH T17F05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 833KB
- SHA256 41f60ab33d01252595e3dc39caf962d8d89879ddafaf1be2a2463c7ef55d7bff
- MD5 7f00d0ccc086af70c79b435b2254919f
- SHA1 56b935c751d6cfb2af50ca7319a828df46b45cfc
- SHA512 04898e9ccb97562d13ec02f71a57f9405cc0085f73d056754e01f4fec8d6cc942ff8fc0e932745adf4b54e382a4384cd619123295149559dfb0715d82fe5ba09
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arQ:cPE/72wcCvRR5FTjkWIw2wEHsxqSA
- TLSH T1AE05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 833KB
- SHA256 cb846f37876c8c19f617e5e67940cc89fa16b02ab15ebf9d8edf878f7d09f751
- MD5 650fce1330cc609acbfd1319fad51c7c
- SHA1 582ab05e679d92bcf0c00c4962b05582256d6d2d
- SHA512 5a6161519e067c39c159711ed95fba22ab3443df2dc7bc6c59285eff75f02b860d88e577f9cc269e26a12131caf1cdf0794858a206c98eaaaeb8376d6c2c6c57
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arp:cPE/72wcCvRR5FTjkWIw2wEHsxqr9Q
- TLSH T1A005181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 833KB
- SHA256 2c87916083b149b52c38a7a4b9c284ebafb2dc6feb40cec7457d60e537318c1f
- MD5 6e72612ff28663eb4ea0a701fe81f903
- SHA1 dd6e1e289616822698801694406a9fcce8d620d9
- SHA512 fecff32700405887a57c05f8b120ef7391a3c8ce1babf8e1e048ae978e185d7f7fd6d14fd605133ad8433ce8bb75b17df686b7644dc83d5a27ad7352656ae1db
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar+:cPE/72wcCvRR5FTjkWIw2wEHsxqa4
- TLSH T14705181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 833KB
- SHA256 7737e0ea3d17b57add5f3c2eef9b65b7de9dfb7f821fb907da52260eb00c0014
- MD5 b7167a274a0fdfdca9964b32a57ee4bc
- SHA1 5253dd5fa05be9ed69d8eccb016b2096c0f3b183
- SHA512 521a4183c40e22429e8bc3e943b3a94e441974919e415dc69217f50dba0532ccdb69e4c2de16b1c4774f95c9db7d17ec4d874155ed49c780d4f9c35c2441dfd0
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arf:cPE/72wcCvRR5FTjkWIw2wEHsxqBu
- TLSH T11705081767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 833KB
- SHA256 8c5ad9533a9c7471a3d2b96512ed12cb54588ae1816700315685fb20c50dc9ab
- MD5 d39273a7deb1415a33201434a3142f26
- SHA1 0853299fd6349002e7d2f54709dbda1bdcd90fde
- SHA512 5d5b7e242ff5cfdf101ce9f9ccee312d33c6858861d62aa001778a22533d39277bd692a90b7706e50850019a53aad148814eb646062b7f92292353ab48ee8426
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arB:cPE/72wcCvRR5FTjkWIw2wEHsxq0j
- TLSH T10905181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 833KB
- SHA256 b60b6e092e716090f67f52e125e6bfc57fc1bb7929bf6c3313dcf7dcf397aad0
- MD5 e0baeabd98e3bd938cd279b535486e71
- SHA1 cc5d254ff5c12fe6eb122d06c87770babf37e603
- SHA512 de65bc0c81c0e9deccf709c16571e24ef7685d851d83fc5e1b33869580e21d3de896eb25dd4081f1ad3b2cb322bd3227cbf6f6b76c55391fe3a21bed62253d72
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arF:cPE/72wcCvRR5FTjkWIw2wEHsxq1g
- TLSH T11405181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 833KB
- SHA256 2defdd10ade1baa15e8a1a519a254ad3f3f01c9929af268657c8b3fbd0ea8eb6
- MD5 fa5bcdaf80abac87526e1cf3c3486f28
- SHA1 7844b680c0951f5f6dac1ea9110b635495f8a7f0
- SHA512 858d463368e00dbb3fbe75905adb12d17c091184f796075a02d6c3d14f43b7180163e7886c501649380294affc602a485a9c4c41599a87fc8bc440e9631db2d8
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ars:cPE/72wcCvRR5FTjkWIw2wEHsxq0I
- TLSH T1D305181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 833KB
- SHA256 a9f19c3482a3d2404a7f9673cd0f1bd130bc6ab647113e05e0be856953f68d14
- MD5 c0a8f6109076e172f874e7b6528565eb
- SHA1 599ff4def0dad71040b264cdc771684147371a46
- SHA512 836b237e4a4dde74f918a6e74d7937c6d70cd9033acad9f6c395dfe0379e48223a6c249bba29e281fa9fff6d453b65279a149a3bc2ce1a0191d23bdfe57b6de3
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2aru:cPE/72wcCvRR5FTjkWIw2wEHsxqmo
- TLSH T1F805181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 833KB
- SHA256 f538cccee12930c3082bae53750f1c4d05f44b7f4fb2245e0540a6ed91868192
- MD5 99cc8d7bf291dd3039c3a47ca2bba704
- SHA1 8d0046ad0504a5bee08e3b88d01277f6abfd0bbf
- SHA512 5b81a4805b8fb388d1db409c223d02378d76c3a1735c6a59a36f43fc8333ba3fe773323442ad51eeeab380007d70c072fdf02e625d4138932a4c5de23caad0c7
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar7:cPE/72wcCvRR5FTjkWIw2wEHsxqN+
- TLSH T15105181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 833KB
- SHA256 80785f12420b8f5570c88879e7097c8f511eb2a2aeb8812562ae492c17d881cc
- MD5 1954dcc7aa7ef3d955c1365793454aeb
- SHA1 115580bcd2c81f9b1f25226868055fec4420a62f
- SHA512 5659a80a56e2da7409521cb1dc8f5816b272437fb064883dff074239b5014de30648e57622d921677eec6fd3f23fae4b29f53d56aeade013f6696ce1125ab719
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar/:cPE/72wcCvRR5FTjkWIw2wEHsxq7Q
- TLSH T17705181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 833KB
- SHA256 524910010ad13f9c83dbc0383a0d722b996e307707b8b787b24cf07c14230349
- MD5 04319a286f5f19917e1bd700ae2bf50a
- SHA1 9e33f6566f0c86a5848ca88e6397da0eb2de7bc8
- SHA512 6e1bee2b82440d62e389d5a56ea6b5a82fac169bb6438f920b5f02b73e3f5f92a86e612f50c634872d4a5c4d269be3341cd19fd593dd79fd6c553caf3d6de31f
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arT:cPE/72wcCvRR5FTjkWIw2wEHsxqwX
- TLSH T19605181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 833KB
- SHA256 be8689e5d5945469b53bc77e1f4c0114671472d640a71cb10d8cf7c206729430
- MD5 1da0938d3a3615cb0ca507b77020a430
- SHA1 df140a94bd7305031882abf38e34359d928ef094
- SHA512 86569f6105c0c169d0594af1acee483e384b24f4bd9ce116661b329ef50777387ebec60513982f04af57186b2ec324a0e48941d6a15fefb894106d321590d8a5
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ard:cPE/72wcCvRR5FTjkWIw2wEHsxqGL
- TLSH T17605181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 833KB
- SHA256 18424f8408cf4fdb3c0ee8e943874f9f56d1115b0ae124d1e681291c1923a811
- MD5 98dff6b5b302251f5a9f7c4b5126b027
- SHA1 50a39dcd942b6c7ca8b121fa4024f4eef4176440
- SHA512 71cfb63b580443679442f4891ee24d52faa88d9301a9d5478fbd3dd16843e5e83d63aa35e9a54667c91e0a246bdc2a51676f8e962b66900f72095ddd799856bc
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ark:cPE/72wcCvRR5FTjkWIw2wEHsxqaFC
- TLSH T10D05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 833KB
- SHA256 2418def6182b18a397f974332bbd0f43890ae3fa01d9d07f23fa0fbf79243f70
- MD5 e5c2dc918dc1a097847f66f9ecb288a3
- SHA1 b719cd2e4bdd27f75b06fe8db20fe6146b9aa7fd
- SHA512 c6993d40c3dad4ccc4c320cea9882d03bc91b5a8e24356998be47fd36d54f0c2903b0b8a6ccde5e18b85e717b5e13f7e053c34b1b12fd69d6555470a1e993f67
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2are:cPE/72wcCvRR5FTjkWIw2wEHsxqLh
- TLSH T14E05181767EC0994E5B2663049B54611EA72F8561B31C7CF11A88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 843KB
- SHA256 fdf065bac3bac78b83819ddd520c28b8d6ea6489112d147517a8d9bc1e731c70
- MD5 0d07e70cfee5a12c62b39ddd70008ab0
- SHA1 bb6564e918f465d470785de3298f11e1f77aadd6
- SHA512 6dc97fdfef2d76c8c6edee980227be98b6d7327f577e003aacf57da2448a05bc81bab5268eaaa72d62f4392c53ba41fb8781efca2f8cf3c151ae2e5cb603eb14
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arn:cPE/72wcCvRR5FTjkWIw2wEHsxqg1
- TLSH T1A105191767EC0994E5B2653049B58611EA72F8561B31C6CF11B88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 885KB
- SHA256 970aa685956cc3f464f144414a903d8f9bd47822ede6866c570d3964e2dae688
- MD5 63d1e7d0b3dadb6199b624847f349b91
- SHA1 96bf87b70b2c99d3b87330ed775636387d738598
- SHA512 27ff23d9ebcb3564b5c14acd282d3fa3a3404033337c67afeb65f1e87f890b0165e61cb06e0d714d4863a9ec8a17eda138913a0a2d08ed0ea37bc2d0061d1f8f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2wEHsxqVKHkUl:J/sCv7rTiw2lHsU+kUl
- TLSH T10315091767EC0994E4B2653089B58611EA72FC551B30C6CF11A8AB3D1E73BF0BD39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 853KB
- SHA256 c2086a812e842823f336b06593b4a174d2af7bdb080431ed9b20a3ee38fd7c24
- MD5 0e83146e22e3ecda09c0f00cd7bdd2e5
- SHA1 c800306bb4b7d8b807b2e69065d83ca7ec7da4e5
- SHA512 075bbefbfb04c4f8fddec0eb77709225051f48a69a0449d7f75ebf40f6fabebe969b80d6046af7b7d659fdf5630d956017a05f7142200e01298978511a8401c7
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar5:cPE/72wcCvRR5FTjkWIw2wEHsxq4wZi
- TLSH T1C305191767EC0995E5B2653049B58611EA72F8561B30C6CF11B88B3D1E73BF0BD38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
- Size 1.2MB
- SHA256 3055b6e431f1a9299b4b54347c506d650b9933dfca9b61a54d24e88f996a6638
- MD5 166a03624c98799000ad2d1d225c33cf
- SHA1 a7d55e6aacbd19cc04c95253216f8ae4a2df51cb
- SHA512 53078b633fe4c9445fdd4764385a7ddfb818af12736d2a49ec92191087e931154dec11822b122f9e668ae334c45fb0b3d1759688b5af17afa74ad6b7063e4008
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2wEHsxqyIpzuq7xgUe+wdr9RfM3X:J/sCv7rTiw2lHsUxZuqZM9RfkX
- TLSH T13A452A17A7E848D5E5A3A13485B58621EA72F8591B3087CF12A8C72D1F73BF07D38B25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
- Size 866KB
- SHA256 47931a4fb190870cd8ed67e166775f5588fc320edf2786a3f96b4a51cbe51e31
- MD5 79135980006d3e458b3976d7e3b63fae
- SHA1 87daee984306a95a23bf32299c4c08dcaa4e7178
- SHA512 ac809aced8d40215c7ef8ca160f0fd15102c151ef74aed999475bef754e4e05a95908ee8706265e6530e429ecccfa6d1d2bce5c8e7f74dd4a592d222b8102feb
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2wEHsxqXa7nl/we:J/sCv7rTiw2lHsU2nlR
- TLSH T19B15081766EC0994E5B2653049B58611EA72F85A1B30C2CF15BC9B3D1E63BF0BD3CB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 865KB
- SHA256 49eb04d2e718ffa6ddf175290124298eee46956453b9bceda89d8443b7587ce0
- MD5 8a4178bce83e5c5fe49b31f48424a1bf
- SHA1 fa7e4260f74d37eaced1171d357d29f749c2613b
- SHA512 437f5d879264b65dafa24950319667cc0b4656661576a10870ef47aaa35fcea4f593c1b4077533130ee8a83026bd4541173eea49735e020293c3b66ed6186141
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ara:cPE/72wcCvRR5FTjkWIw2wEHsxqP2+
- TLSH T12115191767EC0994E4B2663049B58611EA72F8561B31C6CF11B89B3D1E73BF0BD38B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 871KB
- SHA256 1be5ed7cf4c4d3db3655289337f5c3f1a78550d822ba463a884e0f03f48dfcac
- MD5 c2a5a9783475f5b995f2eaf335f16dfc
- SHA1 5837fc70194152e3f10e8bf79e8514e42c9397cc
- SHA512 06cc9469015c21eece96fb204dea87fd7cb0ef15a35cb6643e052abf1ad2e952542569183cbe328bd79e9f19012590c26bd25a9f78cbae4f3ec1d159b7ca83bb
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arF:cPE/72wcCvRR5FTjkWIw2wEHsxq76
- TLSH T12D15F817A6E84994E4A2753045B94601EA72F85A1B3086CF15BC8F3D1E67FF07D3CB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 889KB
- SHA256 366053fe8f9e8c371eef2014104fd8aa8fa8cfa2b7fcc4dbc01b55a2d0e1b70d
- MD5 bca6f8be35016b9ac6bfcf81af82f04b
- SHA1 98113ec552c0304f6c62acf934675f459a02f87f
- SHA512 597826e025661cabbab3be98779138e3106c55f3263614e883c380b9ed554f0c49cf191f43210eb56708acb7a7c39e0a919fa0be1782ecc3a158aaf409ebaf38
- SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2arE:cPE/72wcCvRR5FTjkWIw2wEHsxq1F
- TLSH T1BE151A17A6E80994E5B261308DB54601EA76FC951B30C6DF11A8BB3D1E73BF0BD38B25
- MD5 SHA1 SHA512 SSDEEP TLSH