e9faea5dbff59a21aa061f23d8fe73e14d0bb454de1cee313262b6843d9099c1

Analysis

max time kernel
105s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260714-vbftnsbw91
SHA256 e9faea5dbff59a21aa061f23d8fe73e14d0bb454de1cee313262b6843d9099c1
MD5 7a961e4b6d818a3a5115b94f8be35c55
SHA1 fe7a16f4744f2f096112847ea0bc058c01edbc9d
SHA512 1bc5c8736c7f03e3c5de82c7fd9a8110cdc752ef4d0fbda112d55d387bbc21a87789ef1ad557b63799605da1d3043c17e1fae2eb692e17ecfc113035a5f37af8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy76:A3k03kB56rL
TLSH
T1C9157B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/1484-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c535-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1484-160-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5772-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00060000000198d9-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-679.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1022.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c535-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-259.dat	aspack_v212_v242
behavioral2/files/0x00060000000198d9-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-580.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-679.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1022.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5772	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1484	2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
5772	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_7a961e4b6d818a3a5115b94f8be35c55_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1484

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 e9faea5dbff59a21aa061f23d8fe73e14d0bb454de1cee313262b6843d9099c1
MD5 7a961e4b6d818a3a5115b94f8be35c55
SHA1 fe7a16f4744f2f096112847ea0bc058c01edbc9d
SHA512 1bc5c8736c7f03e3c5de82c7fd9a8110cdc752ef4d0fbda112d55d387bbc21a87789ef1ad557b63799605da1d3043c17e1fae2eb692e17ecfc113035a5f37af8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy76:A3k03kB56rL
TLSH
T1C9157B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 40da8a7471f5fa7b74ee161457bbc7f652d777b75a3849b345dceebd7b74dc4c
MD5 b8785cf0b804f332ec47ef18bcb6e4c9
SHA1 5f8b250995f2b439307ba845c85cfc9631cf64d9
SHA512 d6b9bc9728538a53c49b48b628c17d3d6013880a1c6acb2ca4f3291f805ffcc5ad0fd08946bd306d7ef2002611c578feffa7e09e8b85fa1fd184d9ad7c5c1fb5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7K0Le5ji0hmxNrM:A3k03kB56r3Pji0Aj
TLSH
T15A655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 3c44fb94e29eca60160824fd18008fc9f2aaf0d76fcc3a19773c499533433ceb
MD5 7a72abce4d9f9b9fe8372cee0e2344d4
SHA1 e3a51973b9568e90d8c44d118614f9e0a2ec4ed1
SHA512 e4cfb69a7767743ce1b14f39df4640ec43810cbbc465349b01293ebe71c56d610e7b5cd3c9db53680e0bfc1060a6950c35fbf64610208c8a26f6e03af7494e61
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Ea:A3k03kB56r
TLSH
T173257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 29f5b589ba8c19471e34f6405a147e8c676b0ee7b6b0eb187b6ee15ff73b32e4
MD5 e634f5b52c0b1ea36283d0cbc6fd6aa2
SHA1 984791d3759158f70ab07af40a0112ab9cbb519c
SHA512 a61c6578aceca093e9ee6f509dbae57ab1d872b49489db5a68b5c06df679b6f2419ab99b653a2362639904939545acc912c01bf0503da8afb7ae4445be878035
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy796:A3k03kB56r/
TLSH
T129258B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 b08465516c4af6e6826ec27d503300a01839b5d2dae9298c8790ba15612cc3d2
MD5 5d17828c5043146f75e03451b3a72738
SHA1 b8f0c259fdea0690020e5a6012693bdf4ff8c720
SHA512 d4eca231c6659b097b0422cf9272cc754e2d174d25ddba2f18426f5e0986dacd7bbedb82d067dec6cfcee5b18925dbcb084d7b44e753a3b6d24d2687973ec5b4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Do:A3k03kB56r/
TLSH
T11E258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 c07057f6c595b3d6bc3e67c2269839507697b5b6d1567fb09722c9a2744cfc5c
MD5 abe53f179f4aa0aa542ec9e54bcd236b
SHA1 b81f077b3a4949202cf6179a87a1457e6f524232
SHA512 3eff0e1d0a3e1a73f8bd53e4ed8e653033dda3cb3bf62d7829304fb7d793138bc98c10ea006d85c0a7873e6b2e47704e8169185b7726b4cefcf5bb4ae9127ef0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy73u:A3k03kB56rR
TLSH
T17E258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 a795f33b5a2929be9587c1e8707d03583d45787d9d157a89c775a388b9186379
MD5 4c9a3181ba153392761208678e529bfc
SHA1 6de6c13a41e21aec18737fff9be6ddfd0a3e50b4
SHA512 8a80e923d4cf0030238da184102d388214ef1b1b8fd413062ba858970261713106c26788f04d4371122a5862abe0f7668ed52334e34271429ea4aafa2752f2f4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7F9:A3k03kB56rs
TLSH
T1BA258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 e203ba92b46fb310770791c254bd21c9f7dc0b99e18fd8a8681790151e6ef4e6
MD5 bccf17ad5f3d86f824700e7ff049f380
SHA1 5041f6b9d03be4e725fe8b8e1cbe35b524c05294
SHA512 56d0e43a8cb390b0358688f0372dfed6777cce382e24a7c0be25c69bef41d9ea397b25c14160053dc39a2f7da7c7fdb8ec924f57213820b8ba2315b2a1e184e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7hc:A3k03kB56rl
TLSH
T181257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 10140d2e682451227e692da78c4d2069434fbf25a2065cfc7a20de96749f628c
MD5 a5ee253ada86b8ddf962aea4350d8a06
SHA1 b7aef73c2d196586493ecc898de6546940014509
SHA512 9fe0223e2543b9c2c942a16c622d4b8cb480827d512c4b885613467dbc3d6d105ba1dee2fc6f669b2b1941fe0b0378dd16164c386c3f21ae0f9d4fca756b8f9f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Kp:A3k03kB56rL
TLSH
T14A258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 84630417c0011752a2b6014ba25eef7e44b2ef800984fa843e6857f3b1e98ad9
MD5 1be57879ab1bf6f4ba28c9e53fb14f33
SHA1 a1ed53e91c2b5d0af63df5462d474e9f220c691c
SHA512 3f8ebbc5389f70821aa427f4741d7feffe6fce5ad36aae9261d6c4114087934372bdd4cc0447dd648d8d55bd376aa0c90aadaf458da7a91238dda01352442784
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7tN:A3k03kB56rw
TLSH
T1B1258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 875271821651d42985bc7899083f6de2b1724ce6b109ec965dd0af4473223801
MD5 ca3d7947b1e9970bbb0583c65dc02d82
SHA1 eb19a17513a279a03b79e89e407cc59e1184c632
SHA512 b4fb4e7c33b6df39de78656c13c41f3afe0cad113eec5f7b941c11ff6436392dcd45312ab0e934fe74d195f8875e814884837db0b41c89a6f17ecea1207f3615
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7fF:A3k03kB56rm
TLSH
T1F2258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 b4e105723750fbca89ee6c75d23f2015ae0f7b132153e5648d2936190bffa9c4
MD5 6942bf2a8840a5a10262d3200a031832
SHA1 b58b4821788a85de6b3d8239cef4814be940fb64
SHA512 157ef447d55c79e8e322d14608191c38ac79a9de3aa5579b7000b8b5c13ad4cfe0afa5942ebadd2dc5778a031a226e178bacc6cbd76ba6e0959d23fde2313118
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7AC:A3k03kB56ri
TLSH
T1D3257B03E6850FA4D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 ef7bd5e5ba4c6677ca11ced816a3cf79f232d637ae6dd02f4afd400b56cccb10
MD5 5bdba74ae7dbb73d1116d7c6b41d2e65
SHA1 c193e25d95c6cc605b73a19e1136c4e3f1240c4f
SHA512 a568749c691d0c3a0f637216ad4c5743a294715d25ab92bb53ba5addece872ee61d82739973128446e77596e03f32eaabab3bf9b299f3ebabd43c7f7db3999d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Tw:A3k03kB56r3
TLSH
T17F258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 f3170f0c35623b7faca72706b9146b1528eedf3dc515bafb7939eec0b24e2b44
MD5 dd148d318b1cf2307cb1890e44339ae6
SHA1 ad342bfb4965d2abf783ba8f5ed7b1a67bec69e0
SHA512 9413c3e71b4b84c66788016307001559829bb1caaf6739af4261900738591c1b1d28f53f631ca57e6a1e414f87ab5b2d8e0134637cf74af2890d7961a1bd19fb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7aT:A3k03kB56rz
TLSH
T185258B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 373d4f1a1b393f1b0f239ce0893ebc71d9f78fa42a911f66e3c127c75a61bc0b
MD5 fcb3f4768f6212d2eea61c67bdf4df0f
SHA1 26357635eed439290927f7bdfcace25971a65d89
SHA512 3a72762fd929b1ceddbc632284b2935db6bcba1b26aaf4027f6d1956e6af9901ca813080bc3d9104ec4c43f6dbb641a89e9c43cc9949f896e9abae640e463a1c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy76u:A3k03kB56rk
TLSH
T1BC258B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 93edcbf8494ed91f9f7ab0e5b690d5ab0c90a62ac826b137c245ee5f588db423
MD5 8056573f50b6658ef01241177a76d08b
SHA1 c92fc8594a19fdee94f034b4e277d83e96d04337
SHA512 22334d1596f8f2d5254579796423027ba5d82502451813f0e1cda2fc808cb5146838bf02a7162e027109ca6e786a89fc9b40e4bb7605d976760d4a7e0f7b5e22
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Eb:A3k03kB56rN
TLSH
T102257B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 cbaedaf9283c3907917ad985755f976cf88d001009e4816d99289c077dfb6679
MD5 0ad4d571c52ca90fb5aeb897e34f23b2
SHA1 653731f9f44d6a9c3e9da444b652a0b3e6c6dd21
SHA512 6ba91347316f802c2cdea450247552beaf38544a3d643d3b2bc8ad683c31d0d49008acd09df6bca7813130d2825e9fd9d8a3367b2e7ef97f9abc5dbd7eb11182
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Kf:A3k03kB56r9
TLSH
T16D257B03E6840FA5D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 84dd11e0d9408edfd745ebf2fdca0d6e25f478cfab64a85d00b42e3081ce00e7
MD5 ddbdec631f8cfcfdbbba27ec4796c910
SHA1 cf8b4fdfc86b15b3cbc5332fd491f22688ca0d07
SHA512 8a31c384a8684c68d75f9284a405b8fee48170d4a07119a0953e7b6baf4aa6c19bed98e98fa05d385e4568b8a8e19451296a2a0648cc6ddb87791ff2e92c77f0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7XK:A3k03kB56r1
TLSH
T1F1258B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 74bf0524b6cb05d203dd7fb7e6086b52d6a124d30a3baf83c289ac5a063c888a
MD5 44e8651254639438e51f19b29d806fed
SHA1 3c747d2b2b3b4bd27c20d6d74e719c26d4d28fae
SHA512 f3ec8fb5cbe0b97a7561773360195e27df4ea364d4c4ee5762f1d1dac5dc82f5f15077a2a0c345b37e40e8a06f6a74495ee62dfcd5273d8848d3fc2bd82b6575
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7gk:A3k03kB56rc
TLSH
T1AD258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 e8d78ed801e87107f967dedd2702b769dcfa6dc17a69982312c3b7e9b38d5074
MD5 fa1bac49ac79d33849ac82fc5938b9a1
SHA1 cb617dd5962dc8b402182a31e19c1e5b2ee7131a
SHA512 3d5aee9440642fbd3296d68b9e3ad0aec0145f304c2f441de9c04c9e86d6e868c74f211e7a6c2bafdfcdf28355881bfee6158e6e84cc07490aa9525673b78e4b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7R0:A3k03kB56rV
TLSH
T16D257B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 9b85f064ed747034eddcf8ade58ac70a45ffe822f6fbec18e8710b0a27bdb174
MD5 45e800f227a1281dd6ea9b28e408ee1e
SHA1 9f3b87fbba4e6c5d4f863d295534577efa7033bd
SHA512 36efeaccb2f1496b4681e03af559c23abf188a8cac1c9962c6be3e14bd274a5a9248ad22e49a49227de830dabb25db7d801fd90c0d01d54981ae730fb15f21c7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Eg:A3k03kB56rU
TLSH
T106258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 ad70b23fe2695fd1fe5797366862a7216e6b25b4f8e1676894a90f50b3874fe2
MD5 5c3e2ab46dffe8631f9f2caac37e5917
SHA1 082a744e6142b0b5c0178d97eb19993d78eb618a
SHA512 b0c61eae1eb7f01eba07b190776b9c33691975146390b70e01cfec4f95397bc1947c30b708913fa83acc436c5e7b6ddc73d1fb0f2b96e06f4146386777072787
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7hr:A3k03kB56rm
TLSH
T1A8258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 2cff5b061720ace02fe5cd9ad2013af6d2bddfa90f26ab4de3001f2ab89ba1d0
MD5 8b1544667aef988220977cb6acab1152
SHA1 566552918271d182fad40b5b9f94c75c6b90231e
SHA512 34fb1962a295b9652df532f5a068f618488e0343a88c4d58a1ee969b24b21f12beeda237d9ec0465b1bf1413f9c8c150d7e5c1ce532ed3ffe8ca2dc9f28eaa2e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7jn:A3k03kB56rA
TLSH
T15A258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 00ec6c4fccaca609f63c2c4b27b9ca67292525870da7d1dbf184266f067e4beb
MD5 f1ee99cb1185c117a545ca3ff974411b
SHA1 8d652c529d562665eb4e995d2bb7d693d7d1427e
SHA512 2e1e4372c3a4167f6f550b20d22ba5b533fa414bc29f071532cc9d932d260ce92658cae82fff924b61c310001e8c1fcb2a88a724c583319c73a6bc0112e90cd2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7/x:A3k03kB56rG
TLSH
T1C2258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 dbe60e0a753108708a80a281eb332aea8552e2d53d0ecb6c9c2d72e3e1362fd8
MD5 024931328a6eda8f36fdadc324b8b0e6
SHA1 f9c3321247772dd56e347bf6fc0dab9431b901a1
SHA512 c4b7950f79416b0dea03f4ea3833c0bdd9a0f4253114e85c459bb462a601567adba7cc88c5aeaaf3af672db2d9d290ed80a21cc8fe30de505d7b465bfbdd1432
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7lA:A3k03kB56r9
TLSH
T15F257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 63ce8df19f93b5035c1af38eba35384bd7f1066888410b591d2e30e4c08b4018
MD5 8414ec9339393f667b9f24906ef5ea8d
SHA1 cea43794b0e85874ccdc5ed465e7f7d6da45ef71
SHA512 e810462092ff8a42cc7430a6e31bac8c6a1df57ba85712776776f832fc1a4b4d6be87aa97fbb313082454650a2b19fef3d749b6c8860d78bf06bc1cac3c357cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7e9Q:A3k03kB56rs
TLSH
T1E9257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 04c99d637e98c6d37e013eeb8e8f59f6ce8e7d061b406452baef737303b2099b
MD5 2103469cbdca657965ec0ed866ccb5a4
SHA1 cb5d232c8a7b4b980fc2c40eff513f5d822dff0a
SHA512 083f0f4e473f16d66080c8a7137d533ab65f78a23711836f8829640ffa1d29096f95d43d98aa3346c0ba1a1c9777260cb4a7a07d1493e18a003029e19ffecc07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7L4:A3k03kB56rn
TLSH
T189258B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 6eab15a629bfe7fa6097b7d05079e770ae73bf4d7d84672735a273aaa2437daa
MD5 c1ae2ec235273e4d74d1891ff40105ac
SHA1 f84ae063e6f8ef72061484cdeb1c99adc7aae11f
SHA512 297e1c9db798cc1ba5f775ff6166a9cb849e3e3c992b71d90a04dd771067c74087992508f39bac8143baa08cb770114baef2640c62ead1e4e4c9adf5ef4aac81
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Cu:A3k03kB56rq
TLSH
T1DE257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 1ad640000b325776945b032c08f1b64622ac08953eb6bc8dc9deddc21fcd2bf2
MD5 277e38946bac73f34971f88cbb3bde9b
SHA1 7f89407971477db64a6191f0b45792ce44419b10
SHA512 03a9d2ef1e9758994db9ec4e0ea270b2f159c8a28e144ca3187af6de03bd94eea428adbf17fff1cebc6c3a00b3f00c8bd9700ac44c38aeb7c0027b76a3c7429c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Tj:A3k03kB56rk
TLSH
T1A2258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 3a5aa02a93b5fa6efa54601620b9f5f534733c037cf3937455d065b46b557370
MD5 16d3c8fe2501b7e08174478d00b45dab
SHA1 6f59df599f3c619ca5e274d8f314a080cf039cc1
SHA512 b755836a1d6beb089174fa3a257290433fc2b55a90fe219032e5fe9f335083fe64ec7c4e2de914e7527b97bcc47fcffa6b8698e830ac64069692e056fa70ca64
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7eg:A3k03kB56rs
TLSH
T1F9258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 296a96c0b4f4aef51529faacf87bf4d5379cde160aff01dfa0bff6e6ff53086d
MD5 0fc9abfd336cfb55978c2eff859fe3fc
SHA1 2cebfc674c4c9b02bbb6c58b64a1d5443e817918
SHA512 ecf06c60c68e544ad3fe979d50122ede136bc4162d401c2c2535e62059636a9215dc5864ecd006795bfeec3697d6780f8e3457c4a902d875c588ae06d61cfe2b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7RI:A3k03kB56rl
TLSH
T160258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 73da9714e42374d6ae7176b2a70b04857f5030fc0c807a596adbe9925f4dc5e9
MD5 388d1a7bd2e208d0e2a493608d60ff2f
SHA1 46a030e6eb79704e98d471c1a9642290ea190876
SHA512 1e8e89975ed131096aaab7a6f87494254b49af8ae803c7377ad03094fc91998fd56b7086334ed446660eac63dfa54552b1883b8f6700d01e24300a63873c2637
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7To:A3k03kB56rT
TLSH
T133258B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 052b806ac2a17437e469835dbb32f7d756b2b5f584dc214dbb1bce03036040fc
MD5 03d6ac9d88da0fc11ec09647132fdeba
SHA1 2e5d37d3560ae71ce2f567c0c710888b41655f3b
SHA512 b478b5af5f9f06aecd71d39e52a798adcffd201fca33f1e0f9ae4b622f765ba4e0114d74ab72b78a901b7695b83bcca6567c2faa6f85b0bbea552628c3af5420
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7Y+:A3k03kB56r2
TLSH
T162258B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 433ddab721003556cb5804672bbc9aee1ca0190d13fef73280ece93c068ad6d4
MD5 128836bbd0927e88f8f31d11c7219b84
SHA1 ac9003d508b2838e7f8b686660f1295281bf4e7a
SHA512 c4933f4ab2c122bccfb7365b290df2f1691d6ddfbfd76948819a7f77112e7ae07c0bd264ffbd60e2bfc2d9289af959520a567f32d981ce8bede5d8239caf0f18
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7wQ:A3k03kB56ry
TLSH
T1BA257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 2e88cf65442e609e4d7122796f201faf39fd918a880b129c40e1007d4cf09753
MD5 8826a72fc34ed8c95270b8a539904f09
SHA1 bee889e9237a7f42ef830f22cd2d97226e5dd0d2
SHA512 10be4edb6f8e7a1c133a5ff3a48c973a3fe4e5f3e0b7b86451ddea2506654e445529c09c7e54aba3087c7665f73775eb6505d98be3188def554bcd1d0e1c4b71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7ZX:A3k03kB56ri
TLSH
T143258B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 85d6f15eaccadac5d1f6ca67a2472ca45c1e02c274c8e9f14cc47a308fd8d7b2
MD5 e8d9d88daafdc5067088c18e4791ed3d
SHA1 eb99230caadf17e3d108a32918d5990b8137d0fc
SHA512 06df730a439d10abc145a9c4303328fdf1720c0464eda05d3c9cb9344d10bb27bd354f4e42965c12cc0c585e2bfebade8526f0daca973277d2ef2911b736b9c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7zL:A3k03kB56rM
TLSH
T115258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 cdb9ecffa64bc353c621d7e7b16ceccc9e0c84a5a32e20629d97d4b0681da879
MD5 0210d2e2e60682d6a23ebedc9c122f93
SHA1 6053f1202db4bba081d8fa0ee0935e7aa995e3de
SHA512 3e48479891dade826511d54dca5bd858cb24a5125dc9b4fc6e6184944a01a616c083deb55008024be30154b75e32f2666fd052cdae619f6ed24f08080fcbd9b2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7ZM:A3k03kB56r9
TLSH
T16C258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 dcf84067426bbd20d68f622304544356c0ffeb5d86953bd7e103c1425f0d5a47
MD5 bb443a77460a56919fdc8f8181998047
SHA1 596b8a70c6e7a57e735fc0f00676dac3b02ee41c
SHA512 07d92b3f49cd59b313c5270ab13de36fd342bb176261e08fa11c0f1afed0679b6e6e6cd856e41f29842bd9d6f086360cf001b015deccafefc1a3769434ac52b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy7ih:A3k03kB56rX
TLSH
T166258B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-160-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1484-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5772-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads