43c1ba6ec0e7c822438c5508423c6a63134fa007fe0e05f0b1e7741270dfcda6

Analysis

max time kernel
104s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 920KB
Sample260715-c92vpac131
SHA256 43c1ba6ec0e7c822438c5508423c6a63134fa007fe0e05f0b1e7741270dfcda6
MD5 61efd4221c10b846df359ade21c29a9e
SHA1 0241b92c7b9311132ffb1b1ed0140995d109c0db
SHA512 7f92ca73c3dd279b185d5a0028d7ed1335013abc3e223455f98843d3ea6dd9485a3374c0a989a6719c9fb3be8fade591d85863c8a8467e1e8ac7da4dfbd19ba8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Z:t/sCv7rTiw2RYwZCUsjwULi6Z
TLSH
T14F153A1767EC4895E462A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2892-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c618-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2892-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3472-167-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a4b-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c63a-2141.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c618-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-440.dat	aspack_v212_v242
behavioral2/files/0x0006000000018a4b-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-556.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-999.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1400.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c63a-2141.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3472	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
3472	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_61efd4221c10b846df359ade21c29a9e_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2892

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 920KB
SHA256 43c1ba6ec0e7c822438c5508423c6a63134fa007fe0e05f0b1e7741270dfcda6
MD5 61efd4221c10b846df359ade21c29a9e
SHA1 0241b92c7b9311132ffb1b1ed0140995d109c0db
SHA512 7f92ca73c3dd279b185d5a0028d7ed1335013abc3e223455f98843d3ea6dd9485a3374c0a989a6719c9fb3be8fade591d85863c8a8467e1e8ac7da4dfbd19ba8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Z:t/sCv7rTiw2RYwZCUsjwULi6Z
TLSH
T14F153A1767EC4895E462A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ae0bcaf2483199a24b07c7d3119393d662d0cc67bc075ca45710575d6fdb8e8d
MD5 e5057bdbe27b662cf18ac78f63840f88
SHA1 fe27f4397ea6f3be4ec929bb6dbf1b715b86bbf9
SHA512 18691642cbfcae335fc8cd92d2d960ebfa827e0721a0f901f31c28c1ceb30d486c735447aaa90b287b1dea87d18f9f2e9ec9b40081e7e43be8d62afbdb9bbd59
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwULi6F0Le5ji0hmxNrM:x7iw2T4Pji0Aj
TLSH
T121654A17B6A84661D073D174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AE39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 935KB
SHA256 6f6231bdd9628544ad76ef576302af6a4f9e371900f06f698aac3dd24d0c6659
MD5 cc2b65db7119d1882cd80407a5718cae
SHA1 1541e7ef22a0b5ad0854c2e584104162970a0720
SHA512 cdaa8937df96645983d4f168f0622d37ae46eda8cd81db734773e1829c0e223fda86b12b2c2cac3129b44c97cc5a6fa09ace79c0be2e0fd583b2cb757f9fc54f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Ha:t/sCv7rTiw2RYwZCUsjwULi6Ha
TLSH
T135153A1767EC4895E566613089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 944KB
SHA256 a4c5d31169afff9a846e488c0d0f48fb4c3bf8f806666062744d90ef7fc71fc6
MD5 4ef0dd6ba9505e449ee6ac1afe390df1
SHA1 f8a0b28c9e4d75da874f155163a241006ed50d83
SHA512 5fe9c42be85c8a2a539745e2b3dc80356989e12b8f948bdca8502b9bce3e104e4ce280b8d07a8631f5d744fa37c169a1ae709b8a3641fd27a2abbf353a857ac2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6m6:t/sCv7rTiw2RYwZCUsjwULi6m6
TLSH
T1F1253A1766EC4895E463A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 944KB
SHA256 15b2c55d6f74cc6a5a201e7a51516e23f152e5e1b7795dc1586dceadfe72933b
MD5 434434a35bd478bc63a782cf3cf5885d
SHA1 d5cac78f935145af4f3a8a7026e6434a16bdb109
SHA512 fa4ae2185d18d26c9d3f88dad6a54d3cb0c156f0bc26b3087b2ed702fd384ac2d76fad3025614b177fed29c3565c1613d83fd2402b58285ba7f064ada1f92f51
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi62N:t/sCv7rTiw2RYwZCUsjwULi62N
TLSH
T141253A1766EC4895E463A13089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 944KB
SHA256 221399399c48c5d799432ac35db4a960d22b18faa0f7692573d66030ea0318a2
MD5 c0f0339f1b45fe62e5dd4c860e2a1f1e
SHA1 9e4aa2eba0c40603f097079cb73abf3c25f65eed
SHA512 1923421cf5619b252cb622c3ff438674ae93c60d46859e1d9cbd356eb28a34cc3483078dd481601362cd7efd5a9e6caf67ff4c24d78a2779a3e2c6f08a1f820a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi60f:t/sCv7rTiw2RYwZCUsjwULi60f
TLSH
T1CD253A1766EC4895E462A13089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 944KB
SHA256 2b8e2732d155a251d4dcf8385444c3f9e974104a27168579e6de5faa7705742a
MD5 bf97ba9f00a1b0cad091303c43451f0d
SHA1 2f9264bb753b299c1af5f4bf182b655c2047fb2b
SHA512 4c77ad330161c0c68afc226f44f8dc01aa7df42536ebd097e680116e5ec07d51585a927c747797f80051867b759f1073488b057eed4f6f22478959e65fef6701
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6eo:t/sCv7rTiw2RYwZCUsjwULi6eo
TLSH
T136253A1766EC4895E467A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 944KB
SHA256 d97d2ed9fcbf4a9692c415e26701687a9144f2f6aeaec0e811b0e6a9139d47df
MD5 1488bd386319bcb3fee2e07d6d3e96a6
SHA1 1aafdee541ceb4cca3c18ece276b7ea7cecb2774
SHA512 991ddec50b1af77f77c66d29c4f24bd0c871ec96168c1f9757b10ab41bd64fbe173307a72c56788bcdd03969d41af8847d50ef5e4c8bfc714d2f0c998302ba65
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6yu:t/sCv7rTiw2RYwZCUsjwULi6yu
TLSH
T129253A1766EC4895E463A53089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 944KB
SHA256 033ed4da80ec29343d6cb949bfca79472b9123251e2163f66bb70ee02a198927
MD5 04913dc28e838f5b181ede40350b8761
SHA1 9c4f4345bbaa2db36e7f79c7c85285a2a08ab140
SHA512 3a21907cfe46c08d0c9669c30108b09a2c4eeee0012d1488c99b6a53fa38e63f8243f936dcd2a789dbd5c6ae0476182ec5ca57a404bb3955153cda1c3b3e6bc2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6G9:t/sCv7rTiw2RYwZCUsjwULi6G9
TLSH
T142253A1766EC4895E462A53089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 944KB
SHA256 6f4657e66373486c3a4f856aecd69ec9b2d16273e22e06fae641485b482db8bd
MD5 ce5bb306eb574bdc4e8db7cff9ddae1d
SHA1 46488feddba8995dc0fd4aae51d1b6f115a014e2
SHA512 400595230885b3125c10b3c136dbd6a6d8e8c05f19540e0d43b65de56326b1975c07c4d0480c2cd9c3fbb3a4211aa24e804f805087a033e109515ba1e0aa83c2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Gc:t/sCv7rTiw2RYwZCUsjwULi6Gc
TLSH
T101253A1766EC4895E466A13089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 944KB
SHA256 0a8623c9bfe151eaf63030588bbed75bf175bbcd11069facceabd49060520a28
MD5 b114a0c3b7d16eb970e0012342a66b5c
SHA1 2621f81eee22b165d759b34580f2426e0a90dbba
SHA512 3616dde2de0ccf5de68d94c21231c253ea94731bff6d9025a2106e2cb3510882905bd58bb55369a2706367ec44d99b7745eb4d1d0d145814a9e1563325c1bf60
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6/p:t/sCv7rTiw2RYwZCUsjwULi6/p
TLSH
T153253A1766EC4895E466A13089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 944KB
SHA256 dc61fcc75308a5bb59c6e4c0862d0ff3c323d9cf79293db01465cd0d74bee027
MD5 41d1da7b8f201b5ce64579ab2c03d107
SHA1 0a20cec2bc4d11bd618e4e6c392b25f7c3897bc8
SHA512 1d90f48d5e1ffd7c4ca660699165c317c05f1e88c48ddbcd7eee4e742b94e15f04d1604b346e40e463cc4957745427005dc84404e08cb25514c852696292bfbe
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6g0a:t/sCv7rTiw2RYwZCUsjwULi6gN
TLSH
T158253A1766EC4895E462A13089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 944KB
SHA256 3b4dc593e9f6f9e76d15ab94aef6b2d18787091f1abb63800b740425dd3304b1
MD5 fe82c4bab10afd53845ddfc2a9d91848
SHA1 9e01e7254bbe20f006d018d2cf25508cad271630
SHA512 fbbb09f11ea24a45473f254150638acd847aabcf6b544b93e7f728ef0595a8c3223efb506fcddf1ecc2d41fb60df6aa3dcc3c946e09ec2a8b9186fd4f1737da1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6oF:t/sCv7rTiw2RYwZCUsjwULi6oF
TLSH
T1D4253A1766EC4895E467A13089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 944KB
SHA256 fc4b76e4ccfa27b17fc89bb6c10fe74390926f87644f9096ff1998edf82864fd
MD5 ca1ce0953333d536ce79b5108edfddde
SHA1 ee63eb78783d0223d73963bf4c0ea6bf01119915
SHA512 6f75165142bffe8730dcc7a8e4d67adee44d881b125493fccab9ecfc004538b92c9cae1f92145919e42223b4e48205281ec17dae10bf48c549f0e34ff7f2fe44
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6dC:t/sCv7rTiw2RYwZCUsjwULi6dC
TLSH
T125253A1766EC4895E462A13089F58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 944KB
SHA256 cbca9df645e9f2a08f8a1747952a02e7005f6d944fe5ed6b57e400dc8749d784
MD5 9d05597951ff5efa35d867d23587c63a
SHA1 47fef44468b79ee064c003a9adf86781baac4d2c
SHA512 75bc55d503b1a7766b4b88d2149121ec828bf46512219d565ea3a0f55dbcde4711edb48632e77a2439c6249b85723c1128191915d698508fbc46c8402fe4fa39
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6mw:t/sCv7rTiw2RYwZCUsjwULi6mw
TLSH
T136253A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 944KB
SHA256 e137d5a99bc6e0c47ac4266816161c95d37b8409380b238a2bb804fbc33bee66
MD5 29462da95397119486acc92f67286e51
SHA1 5b6acb001144ff0aa1fd1ea24bd77abe92a732dc
SHA512 49f9cd16b082e102a6c1cc0e0abcee717d5c196a53f5f36519d852e5cdc8233010bfacb2bf0321bf1b947bbe674e695ebf8066e75cc2f43b254e818db1d640d9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6VT:t/sCv7rTiw2RYwZCUsjwULi6VT
TLSH
T102253A1766EC4895E462A13089F58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 944KB
SHA256 783b7d4884bc1538ea4a0d27af48096b83ed0a32b0767f6e54ec0894c84f0833
MD5 cc0bcf584daa5db0b1b6e07420086334
SHA1 cf6838316c6be80368bc4d5b85a066ee653fd569
SHA512 bf83c0b977a247e8c0cbfcea079b837eddc2cad18c42c8428640806b3c9f58063ff2818679bbd0946511e8c048e4f52774c520f3aefbdf40863c504338ff1380
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6ru:t/sCv7rTiw2RYwZCUsjwULi6ru
TLSH
T1DD253A1766EC4895E467A13089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 944KB
SHA256 63f66a4b889d1c2f7072136737a5cac51b8b3573888284a2102d933766846eaf
MD5 ffd4b55189e65154ddead4c3d51cc1e6
SHA1 3e7e0ce83e1256051d1637660fea69ec8e2789e8
SHA512 fea34c92ceadd2358f09437ab71ebb815b9f0f0e6d9eb1ce04d92b1576f98ba2b50ece96ca6fe1b5b2eb24fd1792b9a93a55edfb9cdfbb66b335ba5abe08f190
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Pb:t/sCv7rTiw2RYwZCUsjwULi6Pb
TLSH
T1A8253A1766EC4895E462A53089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 944KB
SHA256 049a32fe3be641be130abfc682a06fc14210418e3eb4b36ec2102c128d9ada11
MD5 f547014a0d296d46aac948b130bdc7de
SHA1 907fd21704b302c6eedb224d3aa2f5f520cf0380
SHA512 6c398159cdac759b0e2adac8d7020de8c1e7102365ae6c63c656c05a53a27ff3bf9b2e182afca6d86bdbe5546a75630208d55e4a242dfb0f5a69a7ddcfadb16c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Lf:t/sCv7rTiw2RYwZCUsjwULi6Lf
TLSH
T19D253A1766EC4895E462A53089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 944KB
SHA256 885af1abbdeca727101ca2d0115bbbac23adbf555c107c3b9a065046264616df
MD5 48bcabfd4363f1f74b516608cca21e78
SHA1 9d50941a2ef2d67b0cfb4c16d64a6639f73c115b
SHA512 459870a8f28b2ac70a9ac8259f81ceeb5190f674fc081d4b42e60d1356a71c4fc2db80671264e06256bfa5a75bced7825f45ad89660208292a140efceac37842
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6EK:t/sCv7rTiw2RYwZCUsjwULi6EK
TLSH
T103253A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 944KB
SHA256 a7443894921a0041fe44ab29589d21291adf01d399b661b4993cc81c2146f3ee
MD5 cfcdd5d6bcf9a4cd5ff488c445d9b473
SHA1 2d617525c6ad7f2fc677af328bd3560b61373dbc
SHA512 467ccacd38330f6a8a6137f9994db4a38df750e1623ffe65abb308b4b211c56e728ac603f13c678c1c97f30caffe610d3bb8b3b0422695361ae36b60151e7739
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi65k:t/sCv7rTiw2RYwZCUsjwULi65k
TLSH
T17A253A1766EC4895E462A13089F54616EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 944KB
SHA256 d9b8c2af5f7fa84d9e63e3c4a08c51bf738d3c7d9599c76361f5081ebfb27efd
MD5 48a060df50ae553324163ca89ec3b3d4
SHA1 ce1ed1e2ec407a53ad34ab53c7d1b952ca92b3fd
SHA512 8b384f6c910b8d1cda79858d0143c3ed766505a0850ddbb84a405bbe15fdb8e269f6b6540b7978eedbbe8559d14c9daf777d7ce0fd181711be3c9ba633e830ab
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi620:t/sCv7rTiw2RYwZCUsjwULi620
TLSH
T179253A1766EC4895E467A13089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 944KB
SHA256 c534771aef35faae99ad0fb2ea58c56432219ea581643e2ec3ca09879c784213
MD5 9cafafd131664e5b412badae58a89acc
SHA1 965fd1cf97267a05cf20528ae41d738a37f3cdb4
SHA512 3669910e1de6b9c0c34833508ce09db27b97b04d3d0e4421f0c13bb327079bbc7fa9d797bded7df8e0dbc5001a2f2ca59128d9a8d39521e15e46cb7435b0c3d8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6F70:t/sCv7rTiw2RYwZCUsjwULi6Fg
TLSH
T1AA253A1766EC4895E467A13089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 944KB
SHA256 bad44c1ca30e43b6bf4d1398a7cc8e1caed60b1e449659fcfe6342439fa7e42c
MD5 9f27746534db99a130aef235467f6cde
SHA1 f7604b8c381b5e949d876c26238dfe1afb9722d5
SHA512 11a713dd00d39d6fc166c09bf29e2181b6c314f39d78febd3f5422284c9b204c69e214108a6c1c61204b12b1b43af4c734d9f8b603437e7d878da1fdf2957bd6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Ur:t/sCv7rTiw2RYwZCUsjwULi6Ur
TLSH
T147253A1766EC4895E462A53089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 944KB
SHA256 9e8ff6709854b00cde8ce978d1a81ecd8b24e3a4be1b9eba58b28add515ceda7
MD5 1811cf552883c1721cfbeb2876908c42
SHA1 bd01f0ce47067f8e46d275d04954ed8ccf2dbd44
SHA512 0c4393eb7559195046e4879608c95c5dd55740a9e0c4b5ce272cdb10db877c0ecf87692cbd3221a75e7555180fe33b29e23ec3c158fe120f0eabb97bd93b63fe
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6qn:t/sCv7rTiw2RYwZCUsjwULi6qn
TLSH
T1FE253A1766EC4895E463A53089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 944KB
SHA256 a78419a5ff35235c4d4f5c4a6514e8be7a99da47aeff3c33d60a9336954ecc8c
MD5 6dea5097017f5619f29e3c337f6d808c
SHA1 22449826817fccbbfce90760ca317492e52d948e
SHA512 5410680743480beb86e73d9ec5a774f95533d1acaec30a125eba3f981b38f2dbb05ff644908451817313dae9437737a764db7d7cbc9f8a8c53372de6985c5559
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6gx:t/sCv7rTiw2RYwZCUsjwULi6gx
TLSH
T1B4253A1766EC4895E467A13089B54606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 944KB
SHA256 7c4517c7564a239c1cabbc81dee97983e4b5be5961dd5420e99131b72c4322d2
MD5 912532bbdc74b45feb5d4f98dfedacee
SHA1 20e761f9a487db620eecb8ba4a146758abf81ea0
SHA512 4635899247f5a8ccf13de44645b0300252472245a7c9a246192e4b86ae31cf391ce2d9b06eec6c5a648eb14bc0914d84cd2d0ebcfd714c37af65e6b2d406a9b3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6iA:t/sCv7rTiw2RYwZCUsjwULi6iA
TLSH
T10A253A1766EC4895E462A53089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 944KB
SHA256 b06874cafb3660975e53f234f15b7f04c11edd7dec0b85473a8b5837be476c60
MD5 cd009b418766dc205ab587795c442135
SHA1 1e386aa782bae105bc551b97f718a997a1b2144f
SHA512 663b08660e39ba4b982cdffbf19041b06c566ad9f1d73ba204c3743cfbe6b6726b8f624c2c82e002d163d4e4afec374167059b8e44ffab46eca958532a80f3c0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6b9Q:t/sCv7rTiw2RYwZCUsjwULi6b9Q
TLSH
T182253A1766EC4895E462A53089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 944KB
SHA256 d40fd17e2830ef8f8231a6ccb376482a603c2cb2123bdc8c4f2b0e19294371a2
MD5 436693cca4291995cdadacde48dd02af
SHA1 a06935bb73a2e1194eb1ae53aeb6dbbd27eed9eb
SHA512 63bc103f67016eb43fba623dedb0ca93429e277da5d2d818e791c83d245d8f04fdc4833e491562fac52a63d0c1807cb2e186415c07db1c2882be61800476e7bb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6q4:t/sCv7rTiw2RYwZCUsjwULi6q4
TLSH
T17C253A1766EC4895E466A13089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 944KB
SHA256 7e82ecf743c740c14831a7a3e3340a4068f2305dc27b64f0df10fdbb82738a8f
MD5 3e1aeeee75ba0a491564ec462b1d5cb1
SHA1 de3e9c820900b21ed0304344f49c959e02b0eafe
SHA512 1740097b9c5b1efdc3717ffebd8dcec6a773c3410f3c0de843e4af3f165621a2cb41adf5172ff9e8ec35592b643c1684636be3028712fb56400e1a226397a2f1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6xu:t/sCv7rTiw2RYwZCUsjwULi6xu
TLSH
T19F253A1766EC4895E463A53089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 944KB
SHA256 4e479a1bc2b60dd110b0a420ee89fac5608b60a8a01a79d78f023792b8dc13b6
MD5 c1c61afda394b9aa69aa0056f09bc82d
SHA1 db9a85363aa2648b60081076b7c3d02efeec1d14
SHA512 82d3a279eb073ced147df2ad5d90e6f2b660d2adea9d090bf9e570f59153b07df3397c81e6b5ead5e33d1b9ce4cade1ce287889442ae2acbcf96049b1217940c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6Ej:t/sCv7rTiw2RYwZCUsjwULi6Ej
TLSH
T180253A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 944KB
SHA256 42e2cdcef65d1ec5cc4360c98f9517d128f46e413554883caffb5bea95f35cd1
MD5 80eb004e60ce8c4ef14fb51c5bfa6ced
SHA1 c51ccbed999bcb479bbc2d6178496cac34c62f6a
SHA512 e5f208aef5a0ecf14376136f41760a54de4f9b41b3d82cf7cf579ac5fa66c69b5e9d855aa880467697cb0235666f862bd8d77723771577760a650639e4367e23
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6lg:t/sCv7rTiw2RYwZCUsjwULi6lg
TLSH
T1B0253A1766EC4895E462A13089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 944KB
SHA256 ae6474bb742bc7dad8856fe7234b46bc61d5bd1fe78703cdcee31242ae1e1af7
MD5 9c146d706b73bd85908c3b99647088d2
SHA1 035c8068ea32800cfb02b08975f8cc619f6564e1
SHA512 18007de47b3f1ead42f741af7565308d3798bfc692ef37e3590d4dd930322932f4c15ea829bc2735eda25cdda3b495e6ed739c20de25687b5cadcc0f7d6339e0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6EI:t/sCv7rTiw2RYwZCUsjwULi6EI
TLSH
T14F253A1767EC4895E462A53089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 944KB
SHA256 f2da2c3d8e1151616b3afe16301b7e9db95ce046259e7e20f240f269c44e523a
MD5 0f0031c9eb840b939d452566bc6cae8a
SHA1 141633b1c59ae7e933f6626589a1e7da3e7d0ae1
SHA512 8e7f246d5df9fcfc2bc3d10a83b991ada28edcc481fddc5137997aa1a33ffda52757caf1bbb9f2b651d8080405a2c57e3468211adebaf6894ae94802c8ae82ef
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi62o:t/sCv7rTiw2RYwZCUsjwULi62o
TLSH
T17C253A1766EC4895E463A53089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 944KB
SHA256 fe5a56eb20f23b4a88082937423346421ab05b81236adbcb0b81770d1bd9f791
MD5 c75132699996bdfc1d90e084201f9ed9
SHA1 62c022afc3e381f65142c0a3a06f6b1040680ed1
SHA512 cb2e5221d0f31690f2836fff4004af82142c9b421de3adedb45863e90bd6de98c24433124de2d07219381bf8d8ac232ce3b9b5160489abbb365dab05b4254339
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6d+:t/sCv7rTiw2RYwZCUsjwULi6d+
TLSH
T13F253A1766EC4895E466A13089F58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 944KB
SHA256 308a00ff3d37ad205fdc83f7e2cde9738d528023edac8681cf17fc6393b80826
MD5 fb3ca1575610010aaace1f0915540673
SHA1 13a2e664062c48120b7558d8c78179cc28e95f3a
SHA512 a307749fdcff5dad4f20a7fbebe398e1d1a31526e0d36b4be60e71d260bb0f165734c56beaadc281c5140cd4097b48d16491ed4f25b98abdda38d13183beadec
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6LQ:t/sCv7rTiw2RYwZCUsjwULi6LQ
TLSH
T117253A1767EC4895E462A53089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 944KB
SHA256 53e847efe583d46a314f7f5525439f064b8f3c0dc1bea8caf2140a346bdfa8bb
MD5 1c379760a5720e731b3d84ccb75ff1c8
SHA1 1ba81f151d5320343f743bccf22c7bc7d86690c8
SHA512 ff55a8440bc870353e6d974cc3091f90cea73812c4b1fb7a42d4c20e7aef4bd475d0315375dc588ffb42411cf9a78c5f3c561f250148d817b3a784000509a84c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6AX:t/sCv7rTiw2RYwZCUsjwULi6AX
TLSH
T161253A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 944KB
SHA256 e5c5c032d51211ef8f60260113a1a3df52e83070768b27c13db10d7d7a065885
MD5 11e3ec8309a21a38dc6506c7359b4c65
SHA1 3999983848e4ecb68e05c1a4b09d15fa3c9f9e5c
SHA512 e56c0606dc0d072561a7db5e665357eded772472ebd56d3b0d002c476d71b53b2202e9965b10f615680e1cd8630d0df2df8f56948366febed08ff00eb83fed6a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi62L:t/sCv7rTiw2RYwZCUsjwULi62L
TLSH
T1AB253A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 944KB
SHA256 01c71fd9b28f51c62f1d3da7de8be587aac6aee480605d57157c44a33c568aed
MD5 f8efebe45b4063217aaf28ab4207b16d
SHA1 d11bb02e7090a7daf6e082bff9559e951f0a8972
SHA512 d83128bc796cce1a2ec39300599fa265e8cfec25eb5de3fdb62a191e823bd9d368443436e31a9c1ed1a20d1a98498502d093680bfa9ea36b93e355fa8eb50309
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6KFC:t/sCv7rTiw2RYwZCUsjwULi6KM
TLSH
T162253A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 944KB
SHA256 7c718e3c350101fe42346a534dd8a6acf5dfbd0cfe19aa4cdc11090121b21dd5
MD5 73445f4cc29a5cc9a6598f8c8ce03a2b
SHA1 c4fd63557c3a6a90bee15c0fa9c9c7a1eb637716
SHA512 ea3d6744767d9649abeae298576e3012b7720d7bd263a2d580fa13b1d0979fe1794d7fd03a07caa5f8b375c99b69e2e124ec4f8be7582399dac778bd3b4c114f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6bh:t/sCv7rTiw2RYwZCUsjwULi6bh
TLSH
T19B253A1766EC4895E463A53089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfsvc.exe

Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
Size 925KB
SHA256 da7f54a9e336cd3eaac1e43ab9fd5d252f5d702278a6ef9799b1eea8f2d9ceba
MD5 8f5e707dd92bdc95a6435973c39c1b14
SHA1 a4856c7d738eee68234a99636124568abd0e0871
SHA512 46b8b847179464a5d98c6a34d879f3b8b79322268f8de103264bb6b87c89f08adf4dddeb2993d8484cacb2a45aaef5187a1a8d2d16953968637ba99024007231
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwULi6W+l:t/sCv7rTiw2RYwZCUsjwULi6W+l
TLSH
T179153A1767EC4895E466A13089B58606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2892-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2892-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3472-167-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads