ec47415642efcf1c60cab12e57571a41f11bb543de0d988451d651b3468ea3ff

Analysis

max time kernel
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 850KB
Sample260713-2v13aact8s
SHA256 ec47415642efcf1c60cab12e57571a41f11bb543de0d988451d651b3468ea3ff
MD5 31b653c47e9a89d7498237a2bd954766
SHA1 6f7a53c17ec0862d7bf0d7a532f9d74d3093f379
SHA512 66687e0dfcfe9885635071bd08535532e8cc512d1856e4cca14bf9d322b2e532d7a1b46c67e054b7e762581debee40fad226302e9045105460b313bd54a73701
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS6:t/sCv7rTiw2RYwZCUsjwS6
TLSH
T164052A1767EC4895E463A13489B58616EB72F8551B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3744-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000019cc1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3744-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5080-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-231.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-529.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-603.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1126.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1357.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000019cc1-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-59.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-231.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-492.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-529.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-603.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-629.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-825.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-915.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1065.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1126.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1215.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1325.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1338.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1357.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1376.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1383.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5080	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3744	2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
5080	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_31b653c47e9a89d7498237a2bd954766_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3744

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 850KB
SHA256 ec47415642efcf1c60cab12e57571a41f11bb543de0d988451d651b3468ea3ff
MD5 31b653c47e9a89d7498237a2bd954766
SHA1 6f7a53c17ec0862d7bf0d7a532f9d74d3093f379
SHA512 66687e0dfcfe9885635071bd08535532e8cc512d1856e4cca14bf9d322b2e532d7a1b46c67e054b7e762581debee40fad226302e9045105460b313bd54a73701
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS6:t/sCv7rTiw2RYwZCUsjwS6
TLSH
T164052A1767EC4895E463A13489B58616EB72F8551B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c5a0177bd07dabffc1cab4238c3618e813b0330d74f9059db22c52ccdd67f01e
MD5 14a8d95173d0b5522ee73d73d709f7b7
SHA1 1d6b5d071ca982c68e631ddf89af779dc27d5b0d
SHA512 d809923b2808cd022329852e0eb539858ef4fd0bd6462de907c2c7bdf6487c97d20b3252fad873ea35b4c93c29f7d922b21535d64b20ec6075a686321ddcd209
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwSK0Le5ji0hmxNrM:x7iw2TJPji0Aj
TLSH
T1AA654917B6A84661D073E174C5E6964AEA72B4461B3087CF02A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 897KB
SHA256 cc663263956a1b29ba0599fd7ad9bc0d340d610d44d8f8b6fdcf62951d49787b
MD5 9f6d0bcdc90fce554d3a1d9c7d11ba2a
SHA1 cffd0ac514071810050c80df483576be0375bd81
SHA512 4bfc43ce3a69dfdbfb5a3dc31446554741a37a4d9ab15ba719bebc16ec432fd15dbe55b62168cb42f54bbcf4e57d1163fbc9edc58c82ce7452bf2a263d5c1bf7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSPb:t/sCv7rTiw2RYwZCUsjwSPb
TLSH
T17D152A1767EC4895E4A7653089B58606EB76F8551B30C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 873KB
SHA256 687f94860de9675f7db5f4826d3032b153009372d802b400710d977b140ec5d4
MD5 7663d18d6456f782bdb0ae0320b467c1
SHA1 eade9cd3a4a522908a2329ec583dc88fd01754b2
SHA512 f12e9dd80c9f2d323e8732ede4b7b9209248b8dd31412649ae7d5107888ff9b1fff607a1199176b5f18d0347b933be30e3a48b0a93556fb9c488f43957661396
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS96:t/sCv7rTiw2RYwZCUsjwS96
TLSH
T1FD152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 873KB
SHA256 062ccee421378e81e355c479a95112d08200082f914571742e3e5766ff32b7d0
MD5 05777b7d1b722e2656dbad6d73d804c8
SHA1 99d479b4397bf37552613cae9c90bd58ea053474
SHA512 cce6cb83ce8b0bd48d1c2b60c59414122482482052f2c083ac9a4d057abb9be18cebcad72d6ab6931b5320facb6202d4f6b0c109c5d4982864fe819ca100a98c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTN:t/sCv7rTiw2RYwZCUsjwSTN
TLSH
T1DB152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 873KB
SHA256 bbf4033754aae2747c1eead65215a594b3a78250f28b1142e7e29c8825ac6a43
MD5 ad70f8e25b933632bd2c88d80d3f5367
SHA1 e4950b874568884100c4376e09edab418064ea10
SHA512 e91a8028398101cfe4425f631dae8a44de678c68121375a4e97368035c71de6a859631d0e45bd675dfb63ba033a7d2f47a846818ad5834e76e1331d3885c1484
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwShf:t/sCv7rTiw2RYwZCUsjwShf
TLSH
T17A152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 873KB
SHA256 e514af5feba1a7d25a32536061e9626000a1f22929cad0e36384bb9ea0018c09
MD5 a9733d0b9ce06a07a3af7f891f2f8f07
SHA1 d529967bc210c464306bc4d0abfaf69cd435aacc
SHA512 ac7941063bf896439b8d87c035a90416e4798e1b5aec578a95642e9c4ec35ed2afe2cbc0bf8bd9b5848b2a666bd6214ae9063be73615f88390a8b2b66e274b5a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSDo:t/sCv7rTiw2RYwZCUsjwSDo
TLSH
T179152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 873KB
SHA256 05fcdb85431d06d45778437bafe84b931daa4950b609e5f8eb622a79a99e34b3
MD5 c36d0947f9e8b153ad01abd80731c5cf
SHA1 4b0c917e5a9134e6a78a141367ccc50e8cdad327
SHA512 a36675a7fd266aca2476a35105f2bc2a0dbdad11895376663ca2e3a706823db923cfab7f5818c84823937dc0c85cf9607efb9693931b6038bc6835c2a13eb42f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS3u:t/sCv7rTiw2RYwZCUsjwS3u
TLSH
T185152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 873KB
SHA256 0b4baf8e8855e95572d463e87dfac62df827d946aaadfd5d7be16379f4cc8104
MD5 92a6e4ca9d7bca38a8eb8aa37a2bc69e
SHA1 aef014f78dd2129ccd0f81dd24edd14a1756d581
SHA512 77e8691840a2d8110b58f4a978fb8cf553127493877275bad16c543d3dd3bd088cdc2f34f63a87abf8691912a32c7620b236b7842e59fcfb1dedb9cfa7538828
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSF9:t/sCv7rTiw2RYwZCUsjwSF9
TLSH
T170152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 873KB
SHA256 86c31eb01e0bb78f1581914cfb1553c08c792ea3a7699a4db1e0c8714abb2803
MD5 193f970e4cd31fa7da447dfc7dd5bbdd
SHA1 990b423e5f54b5d2284f005361e0e2ffa2089500
SHA512 a3dd0f2dfdf58e9f60b159c21c6646a8f6ca41928349abd292b645a5c909e9ed5368360de6e4aa34a5ad6af26e0d597238fba9b3039b7627e433b17bc3f1a066
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwShc:t/sCv7rTiw2RYwZCUsjwShc
TLSH
T161152A1767EC4895E466A13489B58606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 873KB
SHA256 e5c44f73616cf29b2c637f8591a832431489290cbf3dedd2886d26a5e2cb60ad
MD5 40224876c147604e0c5490d447e5afca
SHA1 851ecaf0d25a2a6091ef6430cf920de2e03e9924
SHA512 40872f44eec6d0ab7c13fbd942fb15bbae6323ed1ab0ebdfb736bbb0a2ebd7c0f899173e38f6786ca0bd11eeacc61286fa85679b05cf13a45729e1e0812f6d2a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSKp:t/sCv7rTiw2RYwZCUsjwSKp
TLSH
T1FA152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 873KB
SHA256 2fd03e15666b96e88b1be1b3b3548511f357ce88d70113f5e8298768332bc9dc
MD5 f71ede4cc78a81e6dee06dbc1dd974c8
SHA1 2d4479a8d67de096b00ce5afd6b07b5c8e266d74
SHA512 c051adcd774df9d05cddb9a09d6adaad5d461041490f5142c5e091bc7ce294a80899175e1e8e8b9f19f0322374bcda5a516fc8136e6c8e969a04a92e620acbc6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSt0a:t/sCv7rTiw2RYwZCUsjwStN
TLSH
T172152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 873KB
SHA256 5ecaa1880c3a3df31a8c958e0086eb12820811ce40b553be39e156a6423506b6
MD5 2a320c64df1fd882d944b32ebefc7f42
SHA1 ea9967038253f40120d108f5bd43445f220c86d8
SHA512 1522a3c8e46f34451df32352a3a8521827ef527186236202f8ac39e10208194b0e7a12d6d86d4b9b5b44fc87dee8413529b8a480863606251d1b2e3a0dcf4046
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSfF:t/sCv7rTiw2RYwZCUsjwSfF
TLSH
T14D152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 873KB
SHA256 8bebaca351c6f28add807f4ebc80e26d72ec650c042ec30f34a67ed9cc039fcf
MD5 599af64ad7f703f18fd502aa2ee2205c
SHA1 c2e5c257654ed3fa0142a91d20541faf46d07e14
SHA512 e5f630a4e2df272892426233f06d9eabfb00a88b6ba9393deb46b7a56a0b04c9695b8434e36f158732a89af74c15d3856de4a55a9c14d65fba8f406278f1bfb9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSAC:t/sCv7rTiw2RYwZCUsjwSAC
TLSH
T12F152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 873KB
SHA256 5bfa8d7d7de3f69804c4debb275cd7b8925b57be176a180df325790f639079ce
MD5 7930945fd96f900caf1559bea4d39bc5
SHA1 c90211b909d47cf6b7e3bac3a29c37647f2ccd6b
SHA512 9c0596defc97e234294ba1dd4572e041063ff0afaf39e73869b49c13c1841597b5584bad58f578b977e9e378964891340ffee906c6a47c64380ba6d62efdcb45
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTw:t/sCv7rTiw2RYwZCUsjwSTw
TLSH
T119152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 873KB
SHA256 80d4d13018f8a72224ff979c7071435f4a5008a61e16769536d998206994dfc2
MD5 e6505f0bdcf5f37297dab56f4c6906c2
SHA1 cfaf7e8097c660452f420276fb23567822342f7c
SHA512 7638490333806d37cdfd341c89e7f49bfa897fb876e4e9082e53e45293e74fc0b30d34be5d7f7325edee6e3d8d7fba985eeeb42e14661c759ca58914ddfdec6f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSaT:t/sCv7rTiw2RYwZCUsjwSaT
TLSH
T1B8152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 873KB
SHA256 cebbc81a5bac4d72dae676abb08aeea36ec14f831921aed27fdd0f7f737a639e
MD5 bffb270b9b548ce6117d8aebf5b0c12e
SHA1 0306bf3f5681d765884976b5bb72c095ba059af4
SHA512 00f3fed769dbc3f9323b26a722bb87ed1a31a4fe38d1fa1cc81c369e58ef8b743af126e798cbe1221c7b94c36f87d1257de2c247af59b54721537b2330c65d21
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS6u:t/sCv7rTiw2RYwZCUsjwS6u
TLSH
T103152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 873KB
SHA256 e2eefc56436a9d7dedfe3299030fb3066d0212edd93bd12282e58f951a234b18
MD5 ba3ada0d9f2623df06bdf0f8ba5bd1bf
SHA1 2d892a1639d829d37882ceae7755416489070b3c
SHA512 2b2ae10a48e5d62acd89d70cc36326c75429bccd6ebbcda0f6181ea42fd67279dc96fc3e84a3061cd8cef8da51d1a0f0bd144a920da5757b020c816036687d6d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSEb:t/sCv7rTiw2RYwZCUsjwSEb
TLSH
T1CD152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 873KB
SHA256 e201ea9eadb350a77a303dc7642b56189aba76c9aa876458bf942960cb41d135
MD5 7374cb84237613e2a8b40d741bfed6a6
SHA1 b38e869f70e21dc4fbd6c4a7a0126a6d3cf210df
SHA512 edef26785df4753e85d0f6d971e7713e465f7ee355da74e8923063a0c4d6988d0925289f680161a76602a7946e222ac6d5d3cfffca87b64c07c80f65abd5667b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSKf:t/sCv7rTiw2RYwZCUsjwSKf
TLSH
T1A3152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 873KB
SHA256 df0980cdae6edb37c29785f946c2949effe028fa2a27e0b280e561d35b04f7be
MD5 1a4c86eb8aa45915ff3c4c8007c7de2a
SHA1 c04a907e6f6f681e491a8dd3117965839e362fc3
SHA512 7c5d724e8797db083ad67af62bb3008f8bfa3ce5634ff19e4aa9eff995343197d65ee696747af5d206a8ae6f0cea4769e6d95c78b4445b03e015ce9800f37b8b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSXK:t/sCv7rTiw2RYwZCUsjwSXK
TLSH
T1DA152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 873KB
SHA256 d7ce0998a606b0e28e0604ceefc88dac3241156cbfbf8c14f4f35a29ee49e0b9
MD5 f0b2e60bcc5a40f85b5b3972d8a73045
SHA1 d1f3755379f46d9c5278f129d059baaeffe624a0
SHA512 ef78dfd337e1212c020f4429bd5197403c88b42bdc963d2d6f26df602bc914801fde20ae71e1193185124a7e09998b49b046f6ff4df2f16dbfa424123d45a36a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSgk:t/sCv7rTiw2RYwZCUsjwSgk
TLSH
T16B152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 873KB
SHA256 5b2e9e9f8dacb3bda9c12c4528294e8d0c1587a11e01f9e731dfe6fcbe87e4ff
MD5 4f73f217e3295efb1a735357eb294d20
SHA1 0153b97135458295b8d938991450c56c28c90975
SHA512 00d0e31055aa660b0c6c190e5e0c6a65d9e239d86143e8a3f285a3e689cedb1a13145d693f4d7f3bafbad589f3eec0618d9a8da3dd867d0ba1c4bd6bc8a19582
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSR0:t/sCv7rTiw2RYwZCUsjwSR0
TLSH
T1EA152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 873KB
SHA256 eb23135a5f47898df407ae4c58dbeaace9a976f267e9cde0f1554ec5681585c8
MD5 928710baa3bf29b3ffd9b28db2a16402
SHA1 e9002f6241b37c34c56acda9a190037d2845145b
SHA512 f7ff5c0fe1834e1c71feff70e1dd3cb0b42e0f9c22b6dbc6df11e18d9527b991ec93de6ee24aa4720e60e7ecdae2a2ee756227887ad7e843db9c035285c3ea84
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSE70:t/sCv7rTiw2RYwZCUsjwSEg
TLSH
T1C8152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 873KB
SHA256 7e9e1671713c2bd51e1a5579d6a29b782e8691278aa0832e03990661ca02f6c7
MD5 b69a4c8a82740285ed8b0127207fa169
SHA1 143fea95adce834fe2c7855dc15f619a5ea77d74
SHA512 d566e2e05684e9ddb033eef30bd8a0d07db8924ad2a232d829a99bf7935bf080daf4303d402662176ad72f331d4feacf9931fcb04a815c607611c4e41d2ca5d5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwShr:t/sCv7rTiw2RYwZCUsjwShr
TLSH
T1BF152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 873KB
SHA256 142b7eb2e6ff70fc0c0802bd4d2c02ace0aff4df2df6c5f597923285bfcd16c7
MD5 6092eae917b5aae63106b5fe5b43444e
SHA1 3c4dd14ac79e815e2d05143749760fe1755ad8d4
SHA512 2d96a854d49ce735a2c5eb9c1f411d388836dcdb18a7167c24eb2dd8ae47020fa6da26319aab278a63eb7e0c6f7304e860c4aef6b88c18f74f6d34e26b3a8323
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSjn:t/sCv7rTiw2RYwZCUsjwSjn
TLSH
T11D152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 873KB
SHA256 07a973e1cdf5034bb731688f11887a9cea5245a1e3e2168c0e9e5f1fbb31cab3
MD5 a7182852d46df6d3d2460fe478e0ed42
SHA1 cdaaf6734b4b88b98539f9211c494e4b98eb0919
SHA512 cdba8b1b6fa12397c53e04f2eb934088e042c6bda2650017c9b7ff3e7dc3adc1b40be0f5f78ee75b8da50c6181fb297c360d45b41a1c5144d6d404068654d91c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwS/x:t/sCv7rTiw2RYwZCUsjwS/x
TLSH
T179152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 873KB
SHA256 7b8acd7705f8f64de9f819bdde2a22039560d4c1477efb2bbb5146ee80c606e5
MD5 67b6eab936f57e1491d4c93077cc02aa
SHA1 1ade16defc4d846eb82370c7e9a95e7dcb554df0
SHA512 4f66f76b5dbea4d0b4b542ed43126bf0a886a56467c5fa2331ae245c0fbbd8c3d4118c37e1b382f7aa091f8d51dc0f01dfe09cf394d556ee18c8b59f5d4cc475
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSlA:t/sCv7rTiw2RYwZCUsjwSlA
TLSH
T186152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 873KB
SHA256 5c947084c453feb9b15ba57758c0ef259b892dfcc5d8de39cb0cb15dd1fb6c33
MD5 6f487437d098f59d92e3a1ec0214e4f3
SHA1 76aceb7197c0594413e5c679e4658b453b543546
SHA512 d098930ac6a6b7231fd510bbdb7565b09ba26fac0cc56a8a4e5a9523872f6b299f06a8daa41bc3d5cd3a0cf160e3b12d74c1b3921be9639fd5ab8b9b39f78f1e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSe9Q:t/sCv7rTiw2RYwZCUsjwSe9Q
TLSH
T125152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 873KB
SHA256 337276ce8d197d256bc85c5077e0aefa62ea8090eb4b3acc5c71b8483025148f
MD5 2d66ae54504a4cc6fca6ffb9588bd83a
SHA1 a69fc154bc9f0de17bcc941d6a560995840da5ec
SHA512 c14cbbc33208174d2627d42db3ce412c006e4c1bd3e251003a2bd579bc2423762be1cf364f6de341284bbd6e78cb2feaeed3b355e680cab246b1c2b6b5b2d3b0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSL4:t/sCv7rTiw2RYwZCUsjwSL4
TLSH
T143152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 873KB
SHA256 6b5a703b84a1821d775d189c662ce12ca1d96421ec522475cd75440c1702e82b
MD5 dae6515c7a5080614a0c29ccda2b4944
SHA1 60662e8472fab8aa30ddaa7599fed4b1bf8c246c
SHA512 b4bf91f102d9e6daeca172b8451c81b0ed9f7448b6d7d1b67e70dfce25139e878667b887560aeb3a08d30fda8a14de367f60e97df31f933288fc1142053cde39
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSCu:t/sCv7rTiw2RYwZCUsjwSCu
TLSH
T134152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 873KB
SHA256 062af564c41ff7961dc7d5c10fbc394dec5eac045a82c94b0dc34a03c260c891
MD5 38085d2731b70f6fd65571091ac1ca00
SHA1 f34e80699b6782688d693bb39452ec134f1dd85e
SHA512 771b73a2829e537dcf0f3506d309641597b69cc126917a74ccb5092c5229d30fc2f21c2dd2a99009708d8d847b731f9e51e189d684b6ccc32c333dc4f3f90a18
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTj:t/sCv7rTiw2RYwZCUsjwSTj
TLSH
T169152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 873KB
SHA256 af282188345fd8b44b2dd9a2c0c69eb031dfe5b8a66e9379a57d068c0fe0c629
MD5 f602307946b5517a0b486e212db8f7b0
SHA1 8a476593fa21029066240446c5c97db49523af36
SHA512 72418af479014976c9f4b891f841ac414cb598e8e3b2946923719ccb341088fbf7bdfeb620d476f89a80871ab51d94d74ddba6b7d593344fbdbf5cede9cfc84f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSeg:t/sCv7rTiw2RYwZCUsjwSeg
TLSH
T1C8152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 873KB
SHA256 d348c91e2f70157f5d0ef9d3385fc7bba3b47dfa93aa90197ff66146c54d2d9b
MD5 cfead44dda8d19893b6cebcfddd98d34
SHA1 caabca86c34f2ad46762df34360de4139a4976f8
SHA512 478d848b9cf2a2e0d11954b9dd734469ee8b9cfa4ec60aba90460ede8fc1b065d06ec3ddfc250fadc08154d8bf482f7c640b47874a26ca6f8448f75d3946025f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSRI:t/sCv7rTiw2RYwZCUsjwSRI
TLSH
T15A152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 873KB
SHA256 9ad9f533262c8176de35503864ffcb105d6010f0f744dae0d43051a665be5d9c
MD5 c8eed7e5bb38c8ab03b9bac66cef3f98
SHA1 66b2c0193a9d32ffcd0637d217e7389aae81165e
SHA512 64439bf3cecb696a12da2b54928616e1a645922126d250cb74de04826ba6fc83649112938650cbff06abc382dfb8913325debf0e6c0a822481dd43a16d16f72b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTo:t/sCv7rTiw2RYwZCUsjwSTo
TLSH
T1F4152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 873KB
SHA256 e47f946117d719eb682f93398860103b6ee3cd5e8f69838652c31edc0bc0237d
MD5 3280cac0b941e150e4b1b7e5adb07a4e
SHA1 1f1bd64437ae05cdbc9474785baac019e69148f1
SHA512 69982015eb92e07d4cf168a901f3a8ae948f92c068ccf38b9bdff944b036dc7d80d792d9488b8141f1089084e788bd9c3224505e26987536d7cebc59f5839b1c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSY+:t/sCv7rTiw2RYwZCUsjwSY+
TLSH
T104152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 873KB
SHA256 f68b245724ad3f44061fa344f900b3f5026150f3ca019bae7a4c3fe4f3a7eace
MD5 cbc4b2fd0239d77a6e62efd21f933558
SHA1 52d4e493a55fb72c331fe4c671698af122b8a74d
SHA512 921aa3201c4f545978dcedf76c85872b575d0d5751135fc37aab415f31c93418d9aae9280f952e6f751e99eb89707203928776eef5e58ce93406a26ebc2c9c3d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSwQ:t/sCv7rTiw2RYwZCUsjwSwQ
TLSH
T151152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 873KB
SHA256 199c0eb73dc417300a06204e8551ce5562f4f6a2908baece89420609e6efe1dd
MD5 d6bdd8276d6093ee215c776e9dff79db
SHA1 affa680ea71f1dadd2e5dd530653f851ff9f4d8a
SHA512 b6b7985219d37907d6444f40cb8a73a691d5bba39f3b5e3bef4249eeb250a7512014d27e361edc48b8a580594b0a7c222d1dfeffa61526b5bdf9344af02d8535
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZX:t/sCv7rTiw2RYwZCUsjwSZX
TLSH
T192152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 873KB
SHA256 d03c42d669310f3b1e179e94b229aacd0c23aa40240332234cf5acfd33885bac
MD5 5070fcaae13e92c2134a38c380dbacec
SHA1 c8173138a39cc84d4b6e4c108b3d1208e2acdb88
SHA512 fd061071980b36824d4fdc7cc76eb5c5eedea59b6771bb5c41a341e8e2c4ac7601d9498c8639722b84019dfda4602aa22433554bed5d9f20470baafef6479430
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSzL:t/sCv7rTiw2RYwZCUsjwSzL
TLSH
T153152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 873KB
SHA256 ca7c91755eb79e76a66ecc5669198e8eed43eda1e3b26f4136360d8fc6c41612
MD5 71142ba4a83657e03002179de8dad4ff
SHA1 574731de3dacd74dbaf238c006c462f273811ad7
SHA512 ca7f737297d08b1aec21335171ad0edd92660463b0e106dd7a798b0bee963273cb539f2268527cbf1ccfe3f5258f200654323d1e197dc4a29097256a2dba3e79
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZFC:t/sCv7rTiw2RYwZCUsjwSZM
TLSH
T1FB152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 873KB
SHA256 ee19605d918618d73c1448fac52a9d5e0dc3d9cc8aed52fbf05606dd014d2b91
MD5 9badb7c0c36030bd182e71d7ea0d4015
SHA1 d5886cd4533b356a50029aec432c6128ffc89aae
SHA512 352f570210df010444f101d7d7dc000b08769646141b5ef6912532087c96bce7b7860f5dc95cc7bce8dbdd25a4b448d25ea427373d8702c33dff63f9fe70d13d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSih:t/sCv7rTiw2RYwZCUsjwSih
TLSH
T140152A1767EC4895E462A13489B58616EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3744-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3744-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5080-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads