Analysis
- max time kernel
97s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 03:47
Behavioral task
behavioral1
Sample
2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 821KB
- Sample260910-ecbncaeq5x
- SHA256 e34db24e0827a98a38499e4971198a832f4a18e3c66250a76bac9c8862785327
- MD5 a0028845d16fa97ef04e35062a52cfde
- SHA1 dec8f204e4cdba9e2b7cbc9c3937339c4e62ce7d
- SHA512 64de2448b5532692f334fb458596192bd92cf4130708a020153da1b662661a503387e64d30fa0500a23c98bdce4b255734a731e34ff508207481f0cdc9433032
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlF8OWcRGJlFvF0BU:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaU
- TLSH T12F059D17F79900E8D15AC1788A969A22FB75BC560730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral1/memory/2464-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024324-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3716-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024325-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2464-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bbc-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3716-42-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021620-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024329-153.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021279-294.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127a-439.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-482.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-501.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-586.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002127d-605.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-631.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021280-711.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-736.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021285-749.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021284-792.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-799.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-830.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-861.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021288-880.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128a-893.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-900.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128b-913.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128d-927.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128e-940.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-960.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021291-1015.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021292-1052.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1059.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021294-1096.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1109.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1146.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1159.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021297-1184.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129a-1192.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002129c-1303.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002325c-1364.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002326a-1383.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023268-1384.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e73c-1479.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e73e-1510.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e900-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001ede8-1537.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001edec-1545.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000020338-1631.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000162b2-2100.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024324-5.dat aspack_v212_v242 behavioral1/files/0x0008000000024325-11.dat aspack_v212_v242 behavioral1/files/0x0003000000022bbc-41.dat aspack_v212_v242 behavioral1/files/0x0002000000021620-61.dat aspack_v212_v242 behavioral1/files/0x0007000000024329-153.dat aspack_v212_v242 behavioral1/files/0x0002000000021279-294.dat aspack_v212_v242 behavioral1/files/0x000200000002127a-439.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-482.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-501.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-586.dat aspack_v212_v242 behavioral1/files/0x000400000002127d-605.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-631.dat aspack_v212_v242 behavioral1/files/0x0003000000021280-711.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-736.dat aspack_v212_v242 behavioral1/files/0x0002000000021285-749.dat aspack_v212_v242 behavioral1/files/0x0003000000021284-792.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-799.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-830.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-861.dat aspack_v212_v242 behavioral1/files/0x0003000000021288-880.dat aspack_v212_v242 behavioral1/files/0x000200000002128a-893.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-900.dat aspack_v212_v242 behavioral1/files/0x000300000002128b-913.dat aspack_v212_v242 behavioral1/files/0x000200000002128d-927.dat aspack_v212_v242 behavioral1/files/0x000200000002128e-940.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-960.dat aspack_v212_v242 behavioral1/files/0x0002000000021291-1015.dat aspack_v212_v242 behavioral1/files/0x0002000000021292-1052.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1059.dat aspack_v212_v242 behavioral1/files/0x0002000000021294-1096.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1109.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1146.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1159.dat aspack_v212_v242 behavioral1/files/0x0003000000021297-1184.dat aspack_v212_v242 behavioral1/files/0x000200000002129a-1192.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1223.dat aspack_v212_v242 behavioral1/files/0x000300000002129c-1303.dat aspack_v212_v242 behavioral1/files/0x000200000002325c-1364.dat aspack_v212_v242 behavioral1/files/0x000200000002326a-1383.dat aspack_v212_v242 behavioral1/files/0x0003000000023268-1384.dat aspack_v212_v242 behavioral1/files/0x000200000001e73c-1479.dat aspack_v212_v242 behavioral1/files/0x000200000001e73e-1510.dat aspack_v212_v242 behavioral1/files/0x000200000001e900-1530.dat aspack_v212_v242 behavioral1/files/0x000200000001ede8-1537.dat aspack_v212_v242 behavioral1/files/0x000200000001edec-1545.dat aspack_v212_v242 behavioral1/files/0x0002000000020338-1631.dat aspack_v212_v242 behavioral1/files/0x00040000000162b2-2100.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3716 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2464 2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe 3716 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_a0028845d16fa97ef04e35062a52cfde_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2464
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3716
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 821KB
- SHA256 e34db24e0827a98a38499e4971198a832f4a18e3c66250a76bac9c8862785327
- MD5 a0028845d16fa97ef04e35062a52cfde
- SHA1 dec8f204e4cdba9e2b7cbc9c3937339c4e62ce7d
- SHA512 64de2448b5532692f334fb458596192bd92cf4130708a020153da1b662661a503387e64d30fa0500a23c98bdce4b255734a731e34ff508207481f0cdc9433032
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlF8OWcRGJlFvF0BU:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaU
- TLSH T12F059D17F79900E8D15AC1788A969A22FB75BC560730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 956KB
- SHA256 0d713ae0db1328390d83c35267d08bb0611e97b1b5b8fd8322f026d5e8cdd754
- MD5 1652c70a989392ef93c3b1f907c24f18
- SHA1 ccee2e31dfe0b44c6dcb1014f23b17422606aea8
- SHA512 42e0b01cc58613848d8e149862f6a3f19c161334345d90a5704aa4237897309da648068e0cac5ba915d106ebef765f09d7d11a367d19e97f32b761cd03f8385e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFadqU:A3k03kHRJARJg
- TLSH T1B0259D13F79400E8D14AC2745AA99A62EBB5BC220730A3DF6354C6162F77BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 912KB
- SHA256 cce44b342b31460b1ff13962c8f6a2fcffee35facc8af1a8b6c5984f9427ccd0
- MD5 fba3bb89c20b3ac41674e09258ba330e
- SHA1 9479c40a95cbb351f1a454f289b1e75bba7e93b4
- SHA512 22b5bd6cc681d695501d83f7110419e78b82bd9e190ee2616f75c8f4d163820ffd5f3f77b65b27af60e60c41a2b7d98d341faacc339c8fb591ea151ee3e5222e
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlF8OWcRGJlFvF0Bu:A3mnXoZ643mnXoZ6i6cMJlancMJlBFau
- TLSH T10A159D03F79900F8D15AC1788AA69A22FB76BC65073097DF2354861A2F63BD0AF3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 905KB
- SHA256 9725e2daaac0e198f1c0e676c9a602ce665a76044b863dab5995c3ff24472053
- MD5 ed336636db825b2113883912bfac0b43
- SHA1 2426e85f6777e4ec9c07de018e20563ef43c84c6
- SHA512 941b42f2578484dce1965a3fb9bdcb7a9cbdb7f961c6d8cc36a0ce0046628410f8e8b5f13ea97b6f0aef55e7dc204d12f7c6e733c63818e5c3ad34974f86c975
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaN72:A3k03kHRJARJm72
- TLSH T1E8159D17F79900F8D14AC1788A968A22FB757C661730A7DF235486162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 873KB
- SHA256 b74725c1d0fe059455128b7e4ba826dbe518c1578fe6e0b3dd28fe1ba0dad38a
- MD5 ccf38ab107c517923853011365717ed8
- SHA1 a8cbda0a0cad464c2e6747d23bf89ad5d726ad51
- SHA512 c8ad10f66a9a4321eb95e74fa34c1a03468ae1c85d20a054efb94eba2278a7fbdbe7d35a1e9ee0422c451d26d3f10e87f7166f7205165bac16bb4161eda54a9b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaLfj:A3k03kHRJARJYj
- TLSH T1EE159C07F79900E8D04AC1788AA69A22FB75BC551B30A7DF1354C6162F67BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 928KB
- SHA256 84205ec0abeef1f032d49f779fb5117fe8054fdbbabe91490407f4b6245a2a9f
- MD5 245cca2dcea57af964ff2ef0256456ef
- SHA1 18b72666d6eab818c5903e91ad9e5622252f7547
- SHA512 6ffa11ca97c88ad28be2563770ae3fcda4368dcf4e7b7a5f9ad26c56d00c0d187d738f7d3ee90c5289789e94886131108008484392d7760a20aaed700670eb43
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaMhk:A3k03kHRJARJXW
- TLSH T12E159D17F79900F8D15AC2788AA68A22FB75BC650730A7DF135486162F63BD0AF3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 935KB
- SHA256 a76a3a3d10988dfcc8af3cfdf43ed21b1bc2e0fdd538a2c662ba8e29e36c3e1e
- MD5 a85cc969d3b9a6a0958387ca147bcca5
- SHA1 f5dfeecfa806183adafb3fa004e0113e1b3765ce
- SHA512 7eec85e5309e8a455b11b7e8569c2969399f39ac07c0c6c2eb17d1d55487a16708773a823dabf86e6b49708a8e879aa0e6734fc172755b9d462e0260f988e7d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaoTjE:A3k03kHRJARJJw
- TLSH T15E159D07F79910E8D15AC2788A968A22FB76BC650730A7DF1354C6162F63BD0AF3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.3MB
- SHA256 531ea586841065dda051712e322e6b795d9f458293a29cddce41c61527cd4a4d
- MD5 79c0f630d3edb02605f479f2d8755023
- SHA1 9d4814b75b222683c8b752bc1c7234193e4dfa67
- SHA512 a9aeeac93cd7c7ba900304d6e495dd3b9fd3a5aa3aca3c61a290550c49f1b9f16a645dbe2cb1266c6d47ed222218d9283dc6aecc139cc60cc4b766afee21e7c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaI0Le5ji0hmxNrM:A3k03kHRJARJnPji0Aj
- TLSH T159557C17F6A802B5D067C0B9C6D29A5AFB713842073097CF1395C7292F67BE19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 835KB
- SHA256 96dd626c9cb0bc978bc4f8c380bd23e51872e567f43ec082150ea21bcd07e59d
- MD5 3dfb461e3c80b5bba61347c119d04b05
- SHA1 ac68218d8749db1c09406773a5c28120c0a52785
- SHA512 ee7816f9666419bbefd61b8f33af48c1f30caa4611ea752f9fb39d5af6ffa5a8ca779a7245c02b34f2873e37aaf63644edea17ad81353a5e7b26f39743474df2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaya:A3k03kHRJARJ
- TLSH T112059C07F79900E8D15AC1788AA69A22FB75BC560730A7DF1354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 869KB
- SHA256 c829171353452eca8ab8cb6e61b73b8f50adde83b5d2b773c57e15f1d55672fa
- MD5 9327680f27a7355e0bdf396cc9507888
- SHA1 45a9122a3c5e1fa3cebb336040778c256afe5bd4
- SHA512 e9cd2a9ed81326cbcfb79d1f1f324f0fdbbf22b5694af024bb7a8c83691be677255b849464b4aa6a956400d1d3936d58753b2c76bdf107e401294d9f1c0bfe08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaRb:A3k03kHRJARJqb
- TLSH T137159D03F79900E8D15AC2789AA68A22FB75BC561730A7DF1354C6162F63BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 964KB
- SHA256 2742f7d0808722f61ddd22434792e2f89957e06ffd9c524033f933ea07118181
- MD5 00ca5555d82f7bc83f85c622d85d76be
- SHA1 5c294f1b7abefd45be167aaa7318672d81e3a757
- SHA512 bc2e99d08972d0d81da423ef4abd9029c4c4bcedcb0ed4448d6ba90117024b245e5796a1e98d117c2b08ff1a9b2518d99f2c832abdae2044e66863c28c784526
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFa1D:A3k03kHRJARJg
- TLSH T146252707E69800E8D05E8178C7969A22F777785507E093CB13D4E63E2F62AD06EFA753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 844KB
- SHA256 413e5c4a7e94db6a2013d97de183d6e4af9e6c30088c44952aef0f9f65673e60
- MD5 5144d008e451d944df27edc5164cd905
- SHA1 53befd259187bd33c38c1cb7ebbde422d1b0ee50
- SHA512 19997eb97631e12104704ce6781147e7857e4ac3acd1d9def37c53803b55c1a2e94a9b376af5cc132f2d502f7526722e3c51799d6e3c88016b63fbaf1a61b7dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaj9:A3k03kHRJARJ8
- TLSH T1B6059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 844KB
- SHA256 e8ada3b5ea9ecc0ecf28d65c162f0a73f7004942be217b35dcc83c75ebfcd9c3
- MD5 196e91c26a43a56a957b555fbc31e48b
- SHA1 6fca5a70239b59188c6f1163d49dc4948f33fc76
- SHA512 c2c7457b3ff4205c6216b20d426bbaff72c2fed7babf75e8b14d367a80fd24a7ea5dc8f93db3f15a1874a6ed8865f7cfc205ef2fea0eefbfc77d6fc05bd1a599
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaPc:A3k03kHRJARJ1
- TLSH T16B059D17F79900E8D14AC1789A968A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 844KB
- SHA256 e8f402cbda10d61b700ba7c372942297520795ecf5b518f6346c034881a39f20
- MD5 08dccfb0928f2e45a2a8b8fcfaa9007c
- SHA1 56bf55ede774f13f8219bccc68fd8f8a7cf842c8
- SHA512 621f67265838b15166b50727d69f5d5b142b8f9411794b60a29450e5f23bd3bb07b18460a0612cae44c3ee1e3ca909ec548c88e854444a724316cde07bbb27b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaIp:A3k03kHRJARJ7
- TLSH T1F3059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 844KB
- SHA256 3784047be734cfd40d9d79a25b36937ac27b51aa5928d17876d4773b3cdd5c03
- MD5 c37f907b6200097bbd2945a63c6fd5d5
- SHA1 783f6c6ca83a7c912db0a4ae6140ac26b93ebaf5
- SHA512 c494831fa4f7dd1ac8d56e4f762dd40d935921edc030d2cb0625cd67bbcbcbcc316195ee1a4825b64c7dd09997113591857fe61c0a3da8135b3423eb7b8bedf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFafN:A3k03kHRJARJA
- TLSH T1A0059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 844KB
- SHA256 b8e2e617f719fd68b966b5a57134b13a739bd3bf4d191f6df6eef8ddbccaa034
- MD5 bea7cf96f2df75066e8fe4ad29f509d6
- SHA1 4ca8f405ee4b23ed2648a850a1bdbb26f835ea63
- SHA512 42fe864781c5f9e29a3d17f5a93187d23f1af68596b39cd19a935a794b5c66457d611def1ee57a19f565f9e0d0ffad1f046627dc4a327d2ed7870fc65fe85b4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFadF:A3k03kHRJARJ2
- TLSH T1DD059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 844KB
- SHA256 c3e4bc58564d560d04ea89ab401a5c35ab4315731091a33a868b9d143d745659
- MD5 1653f69fcadc69612a431af581966064
- SHA1 0dd9e03ebb30ac310547e29e617bc0df0406f0cb
- SHA512 6fa06b44d4e72d7b02e132baa07cba1c290a37d62ac8369ca639ae81522c65c3a5e145ddb8473d0d7d1270ddf2538189f449f28b85906fd42fd03e4128ab4756
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFauC:A3k03kHRJARJy
- TLSH T141059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 844KB
- SHA256 f4f38b0bec37d200e655ba611b4ced2f0c1a6af633fa39a23ddc604021c4cdaf
- MD5 512a2ff3a4c94a9bc4549c3a462697ee
- SHA1 8503c520ad14505297546d4d5bec746af60d2acb
- SHA512 f4eb2f9a787d85fb5566b05e227de15ff9ab66b5d8ce0c98d2da1b5123033efdc9fac816e89a846377bcac1ec55bb972e5dfbae4b9066200fcde8e2f882398f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaxw:A3k03kHRJARJH
- TLSH T111059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 844KB
- SHA256 63dce4eda7dea42ce367350708e17b1813d97b9d84004fda0609af5c193f4927
- MD5 4fe24d441e1bd1f7b449ab7bfc1b4d2c
- SHA1 66c97003cc2be19805264507bb35f15829705d07
- SHA512 aee2789a3f1d9a8b74b9ac810d7733a0bae8adeb2a277b039eee7aebdd56192cf1b23974ee6f3922265540e19349d30e400fa6c53d4149d68136986f082eb06f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaYT:A3k03kHRJARJD
- TLSH T159059D17F79900E8D14AC1789A968A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 844KB
- SHA256 77d6e619e33fb63d680d37db2718b9d06936900456b6d443c45d645bf99a4a9a
- MD5 bda74633c35e37afe47fcc8741d0805b
- SHA1 288d15c932fac64405095ff3cf1aa07ce865ba7c
- SHA512 2b8433f0f7c0b4b128f4015e5becfe626134ce215b9c304534df07cc0225a3edc0c14686c9084a87fb9cf36958bd06efddd8a65c2b28ac89a3050f50468f8824
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFa0u:A3k03kHRJARJ0
- TLSH T1AC059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 844KB
- SHA256 380dfb373557caf127265f4ecf2c93cc67b1c6e3030af7b34794b5062c8ea2a2
- MD5 73d39e3cbe83a4e827eb97bca3a7b256
- SHA1 74f71a2faf8e526c69df7130d2761ba1f678e5fa
- SHA512 ca264ba9a8e7365384e759ade84df6365cb5b5f13d870fbbb3b60cf2b96ec73a58574dad3ac9fbd2cfc9948a269fcd823411ce900dd6fd82a4ef25f219c97703
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaib:A3k03kHRJARJd
- TLSH T130059D17F79900E8D14AC1788A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 844KB
- SHA256 2733d4c94ec5081e51fbd9fae47d005fcd6c81c831572ced9b20732b6c25a760
- MD5 56758f238ad22aebff80457598de8c9c
- SHA1 cdac6ed4548c4e2a21a6b8faad3687da11e0c78f
- SHA512 8c6b1163f12d13030f33f81fea00f0d22d2b9f9bdbb1478f9c4c5bf3de7cb7a1d38dd170fd5b847e3af2023e63785e47d15d9d2af9c020bc415c31d15a413566
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFakf:A3k03kHRJARJN
- TLSH T196059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 844KB
- SHA256 fc499edad942e01421c445083ba544a638c2a935b486f9a72397cf44b6ae57dd
- MD5 8eb380651c11ed331ad1097f41fadf52
- SHA1 63a436dc554c0811a0b4f90b9290949598d5292e
- SHA512 325bc0807c3349cdbcc60feec449c7daa1a53797a8f2000003e85e0fbde41d61bfd112afe13e38141d406c3f5668e3df582a3c3d01de2d680689d380b689a3ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaBK:A3k03kHRJARJF
- TLSH T16C059D17F79900E8D14AC1789A968A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 844KB
- SHA256 0c488bf2c4cccb8950f43fa3487e2c98017d5a60febafce1db06f6c0bad67db8
- MD5 545ebf61be3485895dd296dca5ed78b0
- SHA1 14f2456f2d45d2be0bc5a569ff6cc3080191cc45
- SHA512 3791612625ef9556d5fd5274c9a680f768908ed283fafa58a948d609ad0b640234868a202269b5d0d30756e2be95bb57481c6d9635cc26290131da9394dc1ffd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFa6k:A3k03kHRJARJs
- TLSH T18C059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 844KB
- SHA256 f61abdbba0f027eddb00110f744610c98e65c629a480dc67bde5c24389613e98
- MD5 a4a2684ae6af60c02d246450ce112604
- SHA1 3be3325116b395feb558521df87e4533ad390275
- SHA512 4628eacd8f8177dbff8fb0db9c5430504b25bf7d807398e2c612d25ad9d5796195926c600add04719c0f2d73095fc705ce4756687771852b2a4b0f679149c80b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaf0:A3k03kHRJARJF
- TLSH T109059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 844KB
- SHA256 cd12f7bd96f1bc746cb413278b4fc057fd07a8e44819bdd02e0e5b14fa843efe
- MD5 8eae4472765aa60f6384f1dfb9bc5202
- SHA1 2e821d9f10a3f6e906c6de04c0b7005089493b7f
- SHA512 ca9635a8c95edc9cbe808f78312971064d46b8d753bcba33ae884b2fadb0d3925ee16444e58c4778ee38bc2986d696f159e2b7e808b10317d7140a92796e5227
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaug:A3k03kHRJARJk
- TLSH T149059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 844KB
- SHA256 50494dee67a37c9283195f27635b47fdae63280dec6a39089920f02f48bd32ad
- MD5 a8338c55051946c16e1dd84da0c0f60d
- SHA1 e4e5f7e9a35cb007b45e742a602ef33f2e5fe91f
- SHA512 dc8067063ced303b6253f3c434cd5f86800a4b1306193894fcd8a40207dd61315d69e8e3f14c2729622b6cf2c55842c454f2a3d6a9e631182e9a896e334b5cf4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFa3r:A3k03kHRJARJ2
- TLSH T1C1059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 844KB
- SHA256 cb2279eb63ba44c78d7f948ceaa87e01c0f9f20416623816227fa8991b6dbcfc
- MD5 91914944b9589a3c0c2a69895189f834
- SHA1 db9f3ab191ad7bf66073898ca4a77d08bee76d46
- SHA512 d0234fcfcaf70b8b02c7a99423e9701ab8479aacf86172739595f66204eabd08404a7ca74d2945178ae30008fc85dad6b1e30f4e34b69bfb7041bba3fec4fd96
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaBn:A3k03kHRJARJw
- TLSH T19A059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 844KB
- SHA256 b2f0116371582ab62acb70e0455bdfad46fd8974570975e1f27d705fd2750c95
- MD5 dedefc874cb5dac63a3ab6c4edb21a40
- SHA1 e4c59bb830a9aedce24144842a17da2c006f6627
- SHA512 bcedc1defad9fd0a4c44290d522a3c6975b0f8fafff567f8262742b2eda55a1a36071910be4ed057060b7f3f8c90e415d910ea303dcb3a4b98af52f767f186e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFatx:A3k03kHRJARJW
- TLSH T190059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 844KB
- SHA256 72472ae19a3c40f2ec0b46f99f6170d3a93559a034318a4c8c29cb0f72175a6b
- MD5 4d2a15f62cedf358eaea554a4e7bf75f
- SHA1 fd9098e9f0ed61e1205a05162609383bd5fa89a9
- SHA512 9579aff18a6eff71153cabb03ab58ac0bb3a165b845b63a13fc0d33741a5953bec1a5f214f6806ac26ca026148926fd5fd4f205827bb36954468a3ddfaedfa74
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFazA:A3k03kHRJARJN
- TLSH T1B0059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 844KB
- SHA256 6ed01a265d67e639524f376fe027713bdf32d44b9619c118044d4d3de2bffbbd
- MD5 78ac062032b29734096f024fd24fc27d
- SHA1 a0802077b77aaad1e90b4f34116356139ce24adc
- SHA512 3f1436a0c433fc4edd6e89b7e5b7337bfbbd76686cdfbb234ca8521f95d6f87d3c622b7f1b80bce303e0fa130e637d5ff8b6b0b4156e9b802754e3cdb3971a05
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaE9Q:A3k03kHRJARJc
- TLSH T11D059D17F79900E8D14AC1789A968A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 844KB
- SHA256 3409f800e1da0396449271d2d3883ca146cb5f94fe9e21f0e4cb023935129239
- MD5 a02e7bba4f3880d8a824cb16093b5855
- SHA1 0f8ce2c11258af6bb8be800f80f3237247418140
- SHA512 f36a18d210a0b4b1fc7249546254c81f7ade931f5f83b9d249d8723b5c67bc547316f9011ae51b491f646c9f99ddf196e92853d3a884faa58dde0a322387c41b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFad4:A3k03kHRJARJ3
- TLSH T1AE059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 844KB
- SHA256 24807a23716f345c4c4bd59068b59b007a7c440064de70abd73cc44a80828a95
- MD5 a24a3873eaca448fc9fe823c7ac182d4
- SHA1 f83b8f32cc4cd99b9a23d3025277e6a3f8f70595
- SHA512 57d29153ecce5e523840d0eed876d9964bc85d353d24cdf1811b1cef0c6227a9bc4258b365e392ee56e4cc6e14e6f3486a210f1b721fc3f097503d1e6c5ffbd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFa4u:A3k03kHRJARJ6
- TLSH T121059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 844KB
- SHA256 40aa8eb0a8bdc425672184c92da7b8b4ffb55ba0bab35f6efb641fc39b58e869
- MD5 e09778266ce79402ec6f463f00427a5a
- SHA1 c8c9c50c70b4cb5e7a508fd7ae9aa53aad387c87
- SHA512 ca839c3021aa0b1dea5f040a607d86d7ada1868a76a588c9ddddb6cec5da097518fed6dfba7e846695dcc2145d32a17260fb600894a315d97379069007212afa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaZj:A3k03kHRJARJU
- TLSH T120059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 844KB
- SHA256 de784d86b83b4b077e73f823a9f4216bb8492612ae1acc71e048c7e12f42f788
- MD5 7b1312067f32df6622afd1e8efeaab29
- SHA1 c62a454945ba2577c69b2ae72dd3a19d494d2bdb
- SHA512 f937a24f194c178ac16906ec53fe50e059a93c5fce5850c927a3a882febeb2a07a08183055c06bbbaec0601ad54d8d7255062f2df793eae8c389075d4193aae3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaAg:A3k03kHRJARJc
- TLSH T1B2059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 844KB
- SHA256 9ef8e6088642def8a4e23ac3b7ffa57df9d4c06a7f80ffae129fb1c25a9fcdf2
- MD5 d21ea3a13abb2fdaf366b627f43b18b8
- SHA1 16513607277dcfa733e8a620106d7740b08383fc
- SHA512 6a83ab4dd266e572e6ab70afe70c5e23e5f011d5063d5e18e79ced22d644f1e51ded01ea9ee1d097ea8e0c096520443cea892eca7c7262e8a4c1bf715a95dddf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFavI:A3k03kHRJARJ1
- TLSH T139059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 844KB
- SHA256 aefbc35b274aebcfa9bf8eea925923892009707e03a7dc73f8f724df2a9d8e6f
- MD5 284c6e850550687eb9205bc32c299f18
- SHA1 3cfec8b1ecff5434f447c81897cf2f7a63b2eb47
- SHA512 bbd597b0a72636894978f73b7508958ae605af59aae8cb14402b5d207562f188c41eb89796ccc4ebeafe8dfd67540bf1274e026d36eb58d3efd449de00a116f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaVo:A3k03kHRJARJj
- TLSH T198059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 844KB
- SHA256 cb66a3e78de1fe2611a74d9a8eb88988ecf0e2b88fc94bf477b041e0e6f1243e
- MD5 02b9b893f8e8d14782a85c7cb183dc7d
- SHA1 81ac3e3d361815f3d1fbb9e37ed338d7445e6cd2
- SHA512 30d9309fb78fcab9c0475039c4f1b2e935df71c922cbe69a0e44a79a17efd3e663bf2d5e45e309b2bfc8ad7284f445fa35411346b6fcfe67d774e8c2ee5564dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaG+:A3k03kHRJARJm
- TLSH T1C1059D17F79900E8D14AC1789A968A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 844KB
- SHA256 5c187e490c7dab07680d77e31de3e3252c23ce0b61a3f4327a4b083dfb9fa23b
- MD5 91e8c450b1eaa1c0ebc0e6914eec1277
- SHA1 84572c01724dd4905475bd32379d3c4620ad816e
- SHA512 f59843fd514453eb787563d3f181fe7c8d3eca309d2a39da772d85910668d68150fba97cb979fd80ba01cc40d6e04f5488d480ec3f86c2a89bef74ad58955142
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaGQ:A3k03kHRJARJi
- TLSH T19C059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 844KB
- SHA256 f44464ffaf58410b009299e678cfbc9c533abf7094d4887940cd1298c472473c
- MD5 5f553800168b429298edfcb41d5e8470
- SHA1 036c1326310af0669612509b2d0991f595fd4f67
- SHA512 eee52c01f0719746bd82b18ef4eaf3566f57a80b0be560e45277803bad098723b3c0172ff2caeaf0399ffd062939cdd95967f641bbc8b06946ed7f24d0d088b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaXX:A3k03kHRJARJy
- TLSH T1A4059D07F79900E8D14AC1789A968A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 844KB
- SHA256 bad347d6d3148a807c3bf44bfa6aad95f651f4d439eebd3706cf7546fe86f3a1
- MD5 51fc52393448436561a366226845ca9a
- SHA1 6da270bc1817abf1b6f3c88bd409da64ae066706
- SHA512 01c7502411b304e8cf9276b85fe9df75d234caadc14bfcc92521a238ba78d397a726b345e40cfacc31b4d48279c76ac53e8aeeb5d9080abc8c677ed5cfc0d28a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaNL:A3k03kHRJARJc
- TLSH T198059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 844KB
- SHA256 8e2613e57a79e2e414c7b9985f4e7b49d98dad23d4a02c8081b227427b145ee9
- MD5 e08b60bbffb29bae22706ed257fb9f9b
- SHA1 5439137895b6781bfde027f9b3f9da2a438918cd
- SHA512 e19b228ab148bd4b3ea1dc35408b1d357e3457995c64a4d72d9a5e8998317929fc1dc242ee0b5ec4b45727125ee1d0816c88ff2f89651e94f5e0013eeeb36def
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaLM:A3k03kHRJARJt
- TLSH T13B059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 844KB
- SHA256 b70024032af1a4f0fad7440117287f624be64ebadb582712ce721798264f5600
- MD5 37d16ee0b01ed5eeea9e5811564e1d26
- SHA1 6e72f5fa0b334489183d189aa638569bc8bb8f42
- SHA512 94cfb953d3bf4f79b1a0b7432d3121738b6e8432258ed253e47da494958f79f49af4f74abaf9b58146a13752cb32f40c7bfb1d7be65f610b65ad037834c9cb66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaMh:A3k03kHRJARJH
- TLSH T157059D07F79900E8D14AC1789A969A22FB75BC561730A3DF2354C6162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 904KB
- SHA256 e6210abf4d90a90fceeb2efa4666191de78e4994d075a7fcfbc022605f17b119
- MD5 7f9d529191818a129864bd31a984079c
- SHA1 de88587597b6bed478444f9db01d987bcfc4687d
- SHA512 2eb9165d13953f9d34f6d343558365e792474e2c9ec9d9e995ccf0fc5c6080d97819c3405dae12aa514a4516644c66beb2b591b4c766dc905a1aaecc38ae72f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaz1:A3k03kHRJARJk
- TLSH T16B159D07F79900E8D05AC27896969A22FB757C560730A7DF2354C6162F63BE0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\plugin-container.exe
- Size 961KB
- SHA256 445d56aa90e61d41a441b0b4b688fd44117d6e083f66a4c3a969c4f812317e6f
- MD5 75ff2ff2b07f506d9ee16cc146cb1b56
- SHA1 b54bc2ac76b4cc5ebab76dc5af44024fecf827fc
- SHA512 28ee7c5b737b2706b33e18d54e32fc6341f2a9c8ce7d1d59b990153ab403562a7e99ff2b1a570d70c9f737fb0e39b2ccfd3f0020a648965d95c481d6f00fd522
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFai6Iam:A3k03kHRJARJj6IR
- TLSH T1F1259D17F79900F8D05AC1789A969A22FB75BC560730A3DF235486162F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 885KB
- SHA256 381bd75c5c318070924e1e1ed0847fe53d6678e4995ce22e3155b6e0f5fd6cff
- MD5 7cc7915c0560270f7c0b3cee138dca07
- SHA1 4a1e626c1eb8e1e4bd5d2b8fc4d9cc2936d7db23
- SHA512 6fbcfe04f9df85cbcd2988f842b5b150063a031433d6f3c77e43e7f3a3d44e664c73bb2546467f0f479ba2984cecf94c99319810df3ba538bad257825f4e9be5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFanp:A3k03kHRJARJOp
- TLSH T192158D07F79900E8D05AD1788696AA22FB757C550B3193CF1394A62A2F73BD06F3E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.0MB
- SHA256 38b9189c2a81888133cd42fb9f2d37db7baf59c5f82c682dec4522c29eef5bb5
- MD5 57dd8612fe8acfd0ccc94a418323775e
- SHA1 0a6517455380e26f352040f17ff5ce8ea423365c
- SHA512 67451fecdfe3382a1de37483b2da3717ff33c0aae3a8f5303b47b534d950624592b03417f6991023a750646fb851f409fb875bf63e99ca143ddc1a1c36e8b620
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFaSV+PAk2hMH3:A3k03kHRJARJji2WH3
- TLSH T183359D23F79800F9D15BC1784AAA9636FB35BC52073193CF5354961A2F62BE0AF3A351
- MD5 SHA1 SHA512 SSDEEP TLSH