158a5e9070887f34efa133e9b470bc624ddd18381d7d853b3cc054832a3ebb50

Analysis

max time kernel
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 886KB
Sample260629-vrhcfab15n
SHA256 158a5e9070887f34efa133e9b470bc624ddd18381d7d853b3cc054832a3ebb50
MD5 2e4830905f3adb9c47b673d7e7308a73
SHA1 62d37aabd4de0dfd7087fcbe94bc187daf70b390
SHA512 8388a49470dfe245df14ae8b743bdcf2085d194feed364f39cfaba8ada888c81fab682bd341c225330a39d780973dc27fb5315cba88bde7c9d2ab00698f3b75c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIu:A3k03kB56rt
TLSH
T1E8157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 47 IoCs

resource	yara_rule
behavioral2/memory/3708-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c60c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3708-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1620-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e4-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c73-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a09-204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a15-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a4b-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-237.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-250.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-478.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-754.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-834.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-944.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-963.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1012.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1074.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1111.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1195.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1241.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c0a9-2142.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 44 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c60c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b7-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e4-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c73-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a09-204.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a15-211.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a4b-230.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-237.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-250.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-263.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-478.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-754.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-834.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-899.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-944.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-963.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1012.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1055.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1074.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1111.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1195.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1241.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1335.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1354.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1406.dat	aspack_v212_v242
behavioral2/files/0x000e00000001c0a9-2142.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1620	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3708	2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
1620	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_2e4830905f3adb9c47b673d7e7308a73_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3708

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 886KB
SHA256 158a5e9070887f34efa133e9b470bc624ddd18381d7d853b3cc054832a3ebb50
MD5 2e4830905f3adb9c47b673d7e7308a73
SHA1 62d37aabd4de0dfd7087fcbe94bc187daf70b390
SHA512 8388a49470dfe245df14ae8b743bdcf2085d194feed364f39cfaba8ada888c81fab682bd341c225330a39d780973dc27fb5315cba88bde7c9d2ab00698f3b75c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIu:A3k03kB56rt
TLSH
T1E8157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 9fc4e2901f9c58a745563c7e133a0dad78888f234aa2ee84008b8139ad669aa1
MD5 e53a389e7fe0f6a06ba32d5e9c10edfd
SHA1 fa40297cab1bf5f2d75b55da1efea296d705525e
SHA512 2ffd5b4468cce0f36d16e34b982ce04af8ad68b4029535e135c2128cc03494dc9cd40fa39448b7e5cddd45340aa7dff8064629b0b12dc65e029f83bb46eb2675
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIe0Le5ji0hmxNrM:A3k03kB56r5Pji0Aj
TLSH
T110655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 900KB
SHA256 895c6cb8bfde5acbb0184b92b0c614879fc2a0972f7b78cee4cf8265e914a3b3
MD5 3aa8ae577dcae84f79804db10a74ca4c
SHA1 c3fab099982df0fb269bd9daf5a679f9d5638678
SHA512 421fbd84662fa97a686e55dfdb70162cbd155eff63cbd11b885a89c6267134bb5c0a8904c137da9a02d84af5f4b6504d022036b7b74e6f1d3d973ed0afdf0e3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIYa:A3k03kB56r
TLSH
T1DA157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 934KB
SHA256 303ea474e0e05ac05e0c74a10d37681d53932ff18f33c38f36a0b9c8e90cca72
MD5 81883f0530e3c4b4f8c9ef1bbd7bb443
SHA1 075d0102086baf2edc5ca1dee47f556f91f33619
SHA512 d161bc7baa082a93c65313bb4a02bba8f7eb3e90793fbe75fc3bd5a8afc7dd45117a4785880497e4a37c354a8985f7e234c3362534d9d8f5736cd933828566ec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VITb:A3k03kB56rob
TLSH
T1D3157B03E6840FA5D00F81749A958672EA777C466F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 909KB
SHA256 22242e7784a688a0d6f830e4e66bd13686d465687ad5693c1cbf97e0a8609b1b
MD5 4dcf2b7d6ece7ba1785a1c3730f0ca0f
SHA1 0afbd33b9f95223c77bb01585d56104c9ebc52a9
SHA512 4c2019c6104fd356ec790ad599d387faa44d8825b9ac44917eea706349c050835bd267f1f3b0128bbab403612cdbbcc97ef88252c0a4f2c03f5f9770f3f33e59
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI6Z:A3k03kB56rN
TLSH
T1EA157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 909KB
SHA256 96d1d9a5ac151ed16fe127b4e6dc8609213461425a186c985ccb728f26a26542
MD5 ce69f4470e081945a7d90690f24e0616
SHA1 abeb30c99350a089d6e82d4d1bc2b96f8052f1d3
SHA512 4c9687a65922fa5b6d1adf2e01d75c19026e4121ecfbd2752063852d4041e4840364758d80dc236699eb09444f03a7df3c4cf253a87e1bf2b19fb699f224d6da
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIF1:A3k03kB56rq
TLSH
T114157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 909KB
SHA256 6df6910d948216325a07b6944a63de5d53959c2f9ebe7006d1bcc3f47dcdf052
MD5 66ee2fae5c8512a8a71df78dd8032fbc
SHA1 bf5f6142c7c18478ffc1520b7674fb208ab3a310
SHA512 2021470b55fdaf45914c5502cf5d9731a80170c15c4b05915014ed77b8993dd75882c9b1901161587905d78c007c6b866eec861eac91aec552b6d73a47a13bac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIx6:A3k03kB56rF
TLSH
T144157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 909KB
SHA256 d7f81fc2d68e3c3ebf976f46432e552d746f14d9295def811b41a902d9bfc0e3
MD5 571927e4fa3f4b65794c02a4b9a78812
SHA1 c339ff74e54f45e0172b57bcb1426e7f2e4ef41b
SHA512 b06d490ab76a7f19801addb30fdb1bc81d4032f98777394fafd578bdd63518dd79270522a028b7d5e8805e418f985ba17286452d1e42363cb8e21a0386cee735
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIvN:A3k03kB56rU
TLSH
T1AE157B03E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 909KB
SHA256 22be4d52434d1deb2e8447d7f629881cbb141be21b92fb092ac1094719eb9dd1
MD5 6f10f92970f9a1866d4e3fe67e17df35
SHA1 20fbe3070bc3aa0cf1458fec40932074f9d478f5
SHA512 8e3bbf83c0ca4122c03116bd3826c7f1e1d07219f3bbc158646ba2b80a612ca8e14ea82cf474588121bf997e610bb2b249eb2c931b32b457cb0697a69af6dcfd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIVf:A3k03kB56r0
TLSH
T10C157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 909KB
SHA256 9419ed64fc6ddc3ce269ea900b78bec5d2fe37af479193c8a10cf005e16b0bb7
MD5 fbe4d8a67882ee5727f04dd4ad3fb67d
SHA1 3c377798cf9d08e93a2f0076126f8f4a58c48a0f
SHA512 cbee42961b2fdb54885ba3e91c683e97f30f6de93de2a0ae990a24e5d5796c0840e97e6bce337d35b2cb8d7faf3be4c127fe4707b844990310ee99e5ddf56aa3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIXo:A3k03kB56rJ
TLSH
T1EF157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 909KB
SHA256 2d5516bbc4a05571b05a245b96d9bfa087ec5fc9669ebdcc301186485993dc33
MD5 761425c09e57f24723ae30953e69453a
SHA1 4feb689f8feddf4271a3653131a7dafca7bcae85
SHA512 b70497822a53ae3d8a8d1ea5c6a619514a1df2e63e48864b1f187b34f9cccdbd128150351de9cae691b6c3f47510ec55dee6e0955d507016d67f01c4022515d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIbu:A3k03kB56rr
TLSH
T1CB157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 909KB
SHA256 e55784e1d846fb3b35d46fdeb9ab509791fcc071869336209ae1ff6f4b60e64b
MD5 a906e455765f585916db766342bc4dcb
SHA1 c8f30c7d90128e2c468c76ac208e6b9b72a27299
SHA512 9756a549c054844f0c35c6bdfc174b1ddcef3c91f62a1753e001ce4effd47d876f8755cd6157b5ff4b6f297059b320180d914e324c9c9086d9aead2d80b1f011
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIJ9:A3k03kB56rK
TLSH
T1AD157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 909KB
SHA256 206daae52f0ec386d6994f445f9e782df232636296d9482a017d7a52f1c74845
MD5 3bf4b0bc8779402306fa37a00658db1f
SHA1 6bbc7c4fe514643aa90fb4722f7d79884cfa570f
SHA512 baa20e5deedaac18422bcaccada6814491c6a31b2e8130a50a1bdf94156be9e501c52dbed8c58895680220e83d4c151e9e40bb5e9b74ce1aa62d3a94b74772b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIlc:A3k03kB56rn
TLSH
T1EF157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 909KB
SHA256 c9b471506c76fea496ee7bcb9b91dd6b99ede7cb28d30f08a3f477468a7562b0
MD5 2c14266ce36919feaf42235881513489
SHA1 e05e798fdf4a5a15be1757088bfcc2ef7f27156a
SHA512 512c8dcca516a03e3be8e14cd4b8bd08f6aea3bf6864a96bcb5e05f300e141b27047c64583c9c26b5a944e95ab4d8c78f12adb8458d17dd95f70bf5babe03c22
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIep:A3k03kB56r9
TLSH
T150157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 909KB
SHA256 c03d3c343891c25bb0e4cb47e5a248b7e94f82cc77907f22a306f4366d71f69d
MD5 b0042cea0f1c1d51cc93d25dfb74182c
SHA1 6ca1f19366670580a733e71b005c9ee475229325
SHA512 ed37bed9c97a6e15f919a5c2490c5198f463cbcb7873f7cf2d0d4a12b0834c6669e2b2a25f186e19da399feee91f57223e2835ff90bea9ae40df4f069b649b6e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIRN:A3k03kB56rG
TLSH
T137157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 909KB
SHA256 07fe609f58213dc391042bb803e4dbfe2c164c3c69e89ea8914529e9e1035249
MD5 e1dbbeff1abb6474d3e3b66e0e978423
SHA1 9a6e361be3f4b75cbd7b10ae137d9d3bebf1737f
SHA512 9461dcbc71de619560885664c034251e02184f7422e1b070d62f1d0f6828a05892047883cfc8e7ff484ddfbe964c1d4e6e611ada83d6b573ba58ee761871d251
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIzF:A3k03kB56rk
TLSH
T16B157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 909KB
SHA256 b2440879bb0c7f859d12f137d08db81ba400864f2d5d5f46365ec5f7944e915c
MD5 2b4cd36570e7c2f58f47a6ab1dad4c7b
SHA1 0532ad3ae0043a9faad013c3f5ed78217e713791
SHA512 bd69ef4c5b69b66089c5604f939a87cb2321e77162963c67e645f9d1ff3a18924a82b4b51014c1a98b1240634941735ba5028e80fc33d459838d8ea2d8ae2b13
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIcC:A3k03kB56rQ
TLSH
T18E157B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 909KB
SHA256 2c2dfb52b217aafc2647607e7f7cabd1d8cf743273809b008df97e631c9d871c
MD5 2ccd51b9d5f7b7aa71685196108455bc
SHA1 4b0af6af5c166cdd20ee8dac20165b95d430c4ad
SHA512 e4dc17f2362c631f1c8ad68ef9a6c0b9888e4db3890e38dde2441b548a90fdfcb1e49b4367887c55eb1efdcc096a7dcac793e45d51bb57370c26ca9e061f8ab8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI3w:A3k03kB56rt
TLSH
T13D157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 909KB
SHA256 2e6cb09be1d01578b543b799e141adea496a808fdea356283ee35ec43aeef057
MD5 06c00ccce40381e1172282bad36671f0
SHA1 1b1475ad7ee489a9b030de0de9ead2c46ceaf2b7
SHA512 0d5cbaa3e88f6df9da8ce2652c902f46b0fceda733d8b39bf3dd95b3defce91f5bc4eb8876d846d870ec73a0f736290f371068d9f8f9b93d7dc0162f3a140b7d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VImT:A3k03kB56rh
TLSH
T143157B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 909KB
SHA256 1b296e7a6341e43c2b75d565e91ef912334c3cc24a9687cc96b589ec3cbe4465
MD5 10534e0368ea23b96be4461af40cf009
SHA1 32737d5ad3c528e000722480c73734b38bf59b6d
SHA512 989237a9956ec045f39cc02a3d513ff55310eb373dcad9ddae32276e25bce77621034240e847f1c03743163423d050fe7662483f848371f74cf96472b68c72cb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIeu:A3k03kB56rW
TLSH
T116157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 909KB
SHA256 c270872fcfd24d40c7b8378d70dc172c233993c18fa11419d92344e1fd79afd4
MD5 36688799815cfa433b2555caca2219b8
SHA1 12c5d6539a3aa9b73c18be212a599d5bdbd013f4
SHA512 f49b4965b2cdd5492e7cc8630ac68e5cef27f8a3db24ea12183e7b267753293cd38e91c5e4ea5239bffd836f2461a0a783a80a9191839c003f1bd1c3a190328b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIYb:A3k03kB56rn
TLSH
T119157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 909KB
SHA256 1d1e556df3def05325e5193b30992e52871b203e000dff44150d5f995abe66b2
MD5 2b80c38795ee79c1bc1157ec6db9f003
SHA1 c25088f72b80c0c15c899e9bfa8ed27a6a12daef
SHA512 82756295d850a82bae1ac3d71c1d208796034367f75bdb8bc5d9338c3c3801cfe647d150bbf8b819ba0481c96fcc3239ba5dce47151f87e12b91d64788f35507
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIGf:A3k03kB56rP
TLSH
T1AE157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 909KB
SHA256 0e2652dd887d223d7632f2342525e4276a9f4d15ea007092b8659380c2ab4e94
MD5 ac9bb7d1cd672995a0fe580f9d751362
SHA1 4c93e5cd12d62e691bfbce07672ad7c3d36a3fcf
SHA512 943569200c39b76a927801885cd68da6d2b3444e3a8263cc85e7d77bc5e979ae4f75b40e9f821ca4cd6684c0533bb153c1902f5860b400ffcd834889bb85f80f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIDK:A3k03kB56rv
TLSH
T1F4157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 909KB
SHA256 f2df2f30dfd7b844c31612212f560afca627c7f5681bdc7a1ca3e2c2c68d292e
MD5 e308a182dc4ed4eecd5dfcc9984fe969
SHA1 3f47676b1563124086051fc1893c26a48bc34262
SHA512 ef9a1e911b7a3cbfa8b8a974513f8660a45a60781442025c6b4d45a3bf294e8538bcbac9e9207623ffedbc94478d3387a1c1485188265c1316f149a0e1ddd006
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIkk:A3k03kB56r6
TLSH
T1F4157B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 909KB
SHA256 325f99597361a67a168d4871f788df17229f51f8162657def1ad423111ca7224
MD5 bae6d710d4e97a0635b69936d3ef98c9
SHA1 ce56ed66199c0bac230e38e7b847516efbd81c75
SHA512 0b6f00b74f6c723cf69ca6b6bb2353dcf58eb8ee84be3f2b51d4dd4ec37d151b150997832fc902eb2a1b6a1bac695b9436a733e06923fb36fc98e9c7bee0dc12
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIt0:A3k03kB56rP
TLSH
T169157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 909KB
SHA256 666053d954b8c722853d5e8dc3ecb05ef1f2ccdb5dd2d73c58be95ff4ccbebbe
MD5 042d8bac98d9b2e2dbdf16c098f9eb02
SHA1 48c34841931aea221c3de3430b0306631bdd3655
SHA512 6f1142b5f29399e77a212704a337b691881453e08d595c96783c16c6181805c2db70f0afcd9f7f56e64fa22c79347fc8b07a0d351be3440acf7628f3506116a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIwg:A3k03kB56rS
TLSH
T135157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 909KB
SHA256 995c5fd00f1a9e4574d137f96b0d68e2327daa7159b99702a236cb00cd3d0cb9
MD5 6e2d00b262f162a1bf4c07a62c283343
SHA1 21b8045761061a01634fec6818779133d40cbb5a
SHA512 a58ca0002bdd99d2fbc469e1075d22011333d42afb9e956cbc7a872591485230e7f5510582e133f9c483e2d2b2d01fa25e1639b0a3f83155ccc689f7db2e0d65
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIFr:A3k03kB56rc
TLSH
T1DA157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 909KB
SHA256 23a42103af58b064cf9c0d829d6801838fc2bb2becfddea95d6b35058faa0660
MD5 4d0e5314d23ebe9d935768af6e01ee1c
SHA1 e00719d2a5232e001caefa07da64f47d9a8cbe3b
SHA512 e204dc18932c28e84dd7dedd19f6d689dc120cd7c341564b8df39df7760849d6c29b3234429164dce01bb356b67142152c66c5f31c535e652e17dcb34b0565ec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIPn:A3k03kB56rm
TLSH
T136157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 909KB
SHA256 9dc15e124bcd1de5944443a1788e7ff4ed8181b2094711148e30693f8767126f
MD5 98c753e8da09f8c700e1c50b754459be
SHA1 518b0ccfdfeef56f2f092795235cda5602c782d5
SHA512 d7ffd073ac4c5370f082337bf351548109b4e4347413f4b116bd68a66eff7d1c5e415fc2379f4304ca99d6ac583605968201195a36bc668296bdbfb73cbd036a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI7x:A3k03kB56r8
TLSH
T11E157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 909KB
SHA256 e5a7ab3b10b86450e08fd6228a33dff53d580761cd8e034d35d7f59004e56f31
MD5 258c4e956c63dd2fbd9caf5216fac70c
SHA1 cb2cd838100c76f8be83372ae9469fac3072d0ce
SHA512 a960e5f7f4857dd87e3da03a7dc81398891ae90a9bc5219014d941d257dd7ea3201e15d6f00f882078d5f90029bccb0b766716429f8b2e7f1549c604ce7d7455
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIpA:A3k03kB56rH
TLSH
T11B157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 909KB
SHA256 e4544e309ada91ae8878021dbf9ea641faa2acd9f81c4d91109c3b7450b6f661
MD5 41b9314fd407daba392aa26fbb64322d
SHA1 db8475c112b6b35c0cc64dcbb3fb5d71518cf59b
SHA512 2064e8b324773ff818fa2eee3a53451878682ad3f8a55ee0a7f763b9a403521223704e479597f384a71b3ea573b51a1f8e5238a0bac1e13e2fa326f023ef40a0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIi9Q:A3k03kB56rq
TLSH
T129157B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 909KB
SHA256 09bfdc0a9b6ca0c4aaebf55d1aa49633dedebb9f7579c2c42fcedbca553fac9e
MD5 55ed87babf84c0f6d398d1f64836bdaf
SHA1 b3e70f52f3c34e727178b7275d3bf06053fde9a1
SHA512 a64b9d5ea7dc3680ef4299489329c5c38bda3610ff711db849f4492ef76b0f03a9c5ad34dfc80d4af3660c39b39ac88498048b521c474b2a0f874c57458da43f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIH4:A3k03kB56rp
TLSH
T152157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 909KB
SHA256 5cc35330d6a51266b2c2a65e63f69342108ead5cb4c1e0cd7511d715846f1ebb
MD5 b3172f6c35d00f6721a46369a92bd4df
SHA1 232623275d0be5e662d3ec635d3a23c66decf667
SHA512 3e26b7d7e973468ae1d01b51337448fdec93a028924c2e721586ceab17ee2eca447ee21d12734e4c883bffd6e5edde7f3c723fdd69e8145115fd7a481f3e02c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VImu:A3k03kB56r0
TLSH
T183157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 909KB
SHA256 08b7ec3d37a175c3e742b67146a58ff8359722ad9b7e0ec92e47a9d8bb41f257
MD5 9f1aa987043b13c76dab60b29ec91817
SHA1 58beb237c1f8a03f30169da43d1b028920c6833c
SHA512 b5b71ce4d4bbbc5fef398c355aaff4d47dfc677a414e6eabfc384684ad42f85efb250db31e3fe0222fa9606b413a7e33d9ab25ac47cb2e6962cc624e28727ce8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIXj:A3k03kB56rW
TLSH
T102157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 909KB
SHA256 ea4a676e8eb0dbb642607ea1ce19cf3baa9d58a361a79d0080987ae00ff93970
MD5 794425c56f5554f7646c203129b4b5d2
SHA1 4fb640f991a2440368df9d6dc23e06b01c4f1d70
SHA512 ebb4b816ef96f9da191b158eba4a3a45a3f04a876fc99d74de0b5ac966fe7197cefba52de8125aa429d274f1c0638753787c7e5730ee7cc7c08c0fb3788e58fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VICg:A3k03kB56r6
TLSH
T1AE157B13E6850FA4D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 909KB
SHA256 57bf2496bbbe710452ae15b715972d70a82f9fb1736219ab85e1a9bf1b6a0556
MD5 0ba5ff4f8444fb8ec1e15975938a411d
SHA1 46cdb8693b3be7a7fe5836eb12516fb0170f5a16
SHA512 fcd80bf8609acfa5758ba7be96a65f24e3d6a5239deb5ed2ec5b4865c39f8615ebdedb39a5d1a8a681d3a275cd37ffd6fd9d1a4dcee04f4e9e88543fc7a192a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI9I:A3k03kB56r7
TLSH
T18F157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 909KB
SHA256 64055c5aca771afdcf887a9d02fcc479e603e7ede1a0f5e6a6ed6a3f051714d9
MD5 c0dfb16e0f7ce694badcbc287556288d
SHA1 2a5c46ab66ccf8e2b21e6adeed7330885f3c8e3e
SHA512 5814d83b6a4566a6cf9f6538cdd5a2c6a85fde1b0d6ee44b973d08f450fb576646773b11d46c003a1f7c5daefb6b0c31007f967f7fef09c306d931967f9115a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIvo:A3k03kB56rF
TLSH
T1BE157B13E6850FA8D00FC1749A958662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 909KB
SHA256 39dd97a8dbb772634fdbcb85ce05df13dbfa409b466f9438500d827081afe241
MD5 1a81454b89a85d9fa025f2dbbcb39987
SHA1 c73f05222a14636f83442a119e4e73ece9a40d0d
SHA512 3da23b5705c56b2352e74aa8a751348ffcbd990f945e81ef6e2e11a25e65324552d05db0052545ab39f8b715717064d351b536b21a5dfd51c39c0f59428fe584
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI0+:A3k03kB56rA
TLSH
T16F157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 909KB
SHA256 f6a6f8478365f9b70c1d5195082b31c897fb1f4d7413c6c4bbd9f87261799b82
MD5 6c09e2fd02246ae05ca6aa666cf75d7d
SHA1 717ef74bc9d6793b552392a94b8fe930051d0ec0
SHA512 5649ff4e511b6665735b9966b67cbc9e8fb3528167bdb1f9b0d00b76c157d3b4083a3e4ef5dad08877aa1df48e27eee1a5b03c93a3c1bc56dfa99434a18200a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI8Q:A3k03kB56rQ
TLSH
T1EE157B13E6850FA9D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 909KB
SHA256 741f22696b8231f9f9a6baaa037d246b8ca327fab828ad1be89ca5738fe4b419
MD5 29571d1dc8872a08a5be12c676d4ee74
SHA1 7ae6a193d32bdebf98c9c67850dd766ee21c2e9b
SHA512 6b35d40ccb5e09b1968135cb85c17388aa326cdfe1f2b28267e418309c525bbf0b64c1cddf40655936fb792ae0ee1595b8865aa54239c05d31c57e68f6edd5c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIlX:A3k03kB56rg
TLSH
T1AD157B13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 909KB
SHA256 cb953dc577cd625e26014a7f1a668f29e99442605b9f0ab0c27e838b4733e396
MD5 badb95ff253da7544e9cea4f362cc65b
SHA1 f3a57d6986149e14b5ef4c9b78230dbbec19c999
SHA512 00b0e4aab84629db321e6ab0970edaad0aa21767d1c5506355c017bc997d61db1cc047d33400265d951445a3617970deb94718a43f804cf6719b4c17d395a0ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIHL:A3k03kB56rC
TLSH
T17C157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 909KB
SHA256 e26f4e44f90a4096b268bd0ccc1946c614cffb028fcce5f129fa7de26bcf2ef1
MD5 33a6b706d75c182ba0e6277f0068eb2d
SHA1 64cf7f46b2fa7628706734e4d014b129e336b3af
SHA512 d2711db543aa749659391fa233693f21ee2dba37786e1eb59ba7181e2de38f1550d02a2a17dcfe6b613a95b64f863d5a696cc9950a52fecc23f41d89713f42d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI9M:A3k03kB56rP
TLSH
T1F6157B13E6850FA5D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 909KB
SHA256 c9c05435a2e89e679bb27bf9b03c8caa53817bb342a9cf584dc3be7f50a7ce44
MD5 13e67726a9e1187a7295c1710335b964
SHA1 ef967af137da1ce5fd2b251c43e0ef7bd66f0b3a
SHA512 a8f1a10368d371d66f7cd20b666d7d6f51d76c88f1f1b1c2315f30c36023f4974e1e0f97647bb620307c6ce2ceab3fd0f312f86459da4b5527a5deaee3804eae
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VIuh:A3k03kB56rB
TLSH
T176157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe

Path C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
Size 971KB
SHA256 4e62fc8d52a4fd0be7be09923eeb81fed19b632ec7547b1563e98851906ccf72
MD5 edb211f1d4b6a5302baa8003badc961c
SHA1 15e69271d76021b7d498f7f296e5aeaba108f05a
SHA512 dad6a8648b965b145ef447bf56604fa6b3692b1501335171c1746d6bc35b28a43324560bdb6d663ae2cf9956030dc6fb3204084676307a79f09e99eaf257ecfc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyr2VI6x5:A3k03kB56rxx5
TLSH
T14E256A03E6840FA5D01F81749AA54662EA77BC425F2093DF335CAE153F72BD06A3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1620-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3708-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3708-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads