a94c09751cfcbe5bae6017841abc942765d0bfa24810590f0f6615e5a607eb94

Analysis

max time kernel
97s
max time network
89s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260715-cbl2ksb131
SHA256 a94c09751cfcbe5bae6017841abc942765d0bfa24810590f0f6615e5a607eb94
MD5 e180b87456db91fcefa278d05e0c9792
SHA1 eb4bb396d3274472e7141dd3e744f6594d1ccc86
SHA512 1d8e69d4070215deaa4175c96976d4f1065d5673b620034411e5a0d651409b09a9250006415b159ac7437d000fcedb1c566e05cea93aa25b64a221109b2c8e9a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQT:A3k03kB56rv
TLSH
T1BC157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/2972-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b6f5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2972-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4600-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-575.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-643.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-765.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b6f5-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-490.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-575.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-643.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-765.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1004.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1060.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1122.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1147.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1172.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1216.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1325.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1344.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1369.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1378.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4600	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2972	2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
4600	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_e180b87456db91fcefa278d05e0c9792_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2972

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 a94c09751cfcbe5bae6017841abc942765d0bfa24810590f0f6615e5a607eb94
MD5 e180b87456db91fcefa278d05e0c9792
SHA1 eb4bb396d3274472e7141dd3e744f6594d1ccc86
SHA512 1d8e69d4070215deaa4175c96976d4f1065d5673b620034411e5a0d651409b09a9250006415b159ac7437d000fcedb1c566e05cea93aa25b64a221109b2c8e9a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQT:A3k03kB56rv
TLSH
T1BC157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0ae8092c24da247795eea4e4a564b4503139e4c7a3b8134ba123e2c4418a27fc
MD5 1f585467d5ef1607f89ea4b21de3b5ac
SHA1 83316643cbf7a6e40a26b2bde88406229a40f62c
SHA512 bfdc54e6d9a057a68d2d754fded1309082b4c2bc7eb2a3acb103344d8503b332cf82ac7f2f28bd78b29a0d529e526dec8248c3ec1f56e35937bdeda738f3c3d3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQP0Le5ji0hmxNrM:A3k03kB56rbPji0Aj
TLSH
T181656B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 d4248cabb6399482c025e1ec66ae5af7de56ac6f430797f8b93aba47dc84ac6c
MD5 72033cf7920f46b1e9066b58d194d17a
SHA1 6544ecc7432f74c591f0128adc73645ab4eaf4d2
SHA512 b3d20e9c469e89d74c3c6f5ba529cf37e8c89c85a0f2dc40440a5400c2065c85c3fff42523ee12ea12fce8e82823a6d743e5d1925835c94ef3a6d7289662aa46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQo6:A3k03kB56rj
TLSH
T168258B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 e0a67cf88af6f9fbac904b7f44e5d7a6f3cae364ae1cc912aad9d7fc04575af3
MD5 bb3d9d42e00ddab12494ac0503e2fc85
SHA1 94dbb9d5741d2c45226730ca7c556f5fbc302ce1
SHA512 eb5530ed5c40043dcc80827eb9e7ff8e660578f518ccdb2cf0e36b0073fdb21bd2b3904cfa43225638d67da9a8500fc10d698b1c89f176f9851724aea329bd75
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQsN:A3k03kB56re
TLSH
T115257B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 163484f8024bebc911cd173841d0507f55871382b8156a8f9e62dd3d57bb1a26
MD5 bf842f85b4fd437699186925102c609d
SHA1 cb4f8bde4e7a65cef3af63f6e12f9d8cb18bd4c3
SHA512 c5081d20ee104971a6fda834a587e11051709d76229a41b5312d159de191b92a78b4954a681bab82538f47d8fad66f8b800b3ba4efb8abd68576e57d10435406
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQif:A3k03kB56ry
TLSH
T13E258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 cb7c1bbde296bdba3e954751ecbe67f7bd6e28f11c042d58c6f543351f1e6fdb
MD5 4e17b1c8dd49e67d6f3de302c8eabb9f
SHA1 1820a6197cc3a7afbab79923158d62e591d35fd2
SHA512 1ebfcde462d82454a9a02178fc5a1915310d47df7967dcd321bed5c260d34a5e16c5804fcd5de3599518323e298f22c8131396c954bc71fa5e96ba1d1a170d7e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQ8o:A3k03kB56r7
TLSH
T156258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 b37e48563c58e6e6408487b9b709ee009112353759d668197e10dab825d992d0
MD5 44d91b53fb903e7312653458a36a04eb
SHA1 ec70e8b0ca981013d216d329627e4d5589404820
SHA512 118569c3959ea07e7c8f693f1efabfb4ce2b78f23f37357a2c09617093e3428dfb4bb3502d736a915345ff40f4d41fc6919d182698fe5fada7e56404dd7b88ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQcu:A3k03kB56r9
TLSH
T1FE258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 9c14ee837e2ce6abe073298a93eb715b6f23d679f30f83d5fc162d8ecac88463
MD5 875df8dd4be5bcd6898449c6e738107d
SHA1 fa877730e3684c8ac2958685204c2bd3d391cbe6
SHA512 3750a7f5b23a1cd49c7ef9da53adddf9054377ce490e200fc8f94a948a2d3dc00a2e28648635c3199b470f56776b7db6842f110b1e2e9d390e8f2f02e67c4822
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQg9:A3k03kB56rI
TLSH
T1B3257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 1886d507166804b7c44e4d72fb399de9e6c4d686008518989c4662602450a6fd
MD5 78a75eb36d216aa32188e45b8c7b59fc
SHA1 be7cc0ad97458128d226a9b5ace9f027ef6034d2
SHA512 d7715f0b9a48cf47bcc6106de73c0d7f656ea53e466160093dbe32a217676b8a4fb61284562a0e00faad1525b9b21333da8f8d211ddedb382bbe2bf38f728519
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQoc:A3k03kB56rJ
TLSH
T107257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 bc206592860a103905c0547dde10dd8a569d50383ff91e998b25a2b2ccdeebc1
MD5 06a7958ab98d0202ca56d50e288c6af3
SHA1 320808a29a69fbc448a4fab37a3bd8e7c127beaa
SHA512 82f02d2d9520411e717db248855d2f9688f2ee0f42d13faf9decbe9ec5f8d545fdeb93275eda0134ca41abf2c1e1de1aee2dd98321629fa8cb9619a086290005
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQBp:A3k03kB56rn
TLSH
T1D0257B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 a4bca28835441c84e8391e26ace0cbe25ea407c7ac1f52a1c1ac89231cb5ebfa
MD5 04f2c2529769d0e54df6e70d6b4dedf9
SHA1 46eedcda12d665295a2ae912bcb0f055cf465bd3
SHA512 e911bf0732b40fa0af6ff60eb790f96f76582589a6d53371402c0cc6a707fbf7116db7266399654ac951f0377f2d8baa77563397d34449892c710a96d29c1fa5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQWN:A3k03kB56rs
TLSH
T132258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 609887c44c886f869fbad3d872947b97901e94ec9b2263207ca1ee3a524e519e
MD5 d224bb1eafc1b5c99fcdfcf3139466ce
SHA1 ce3704b841334ad6ac08d22c7dae4e001a357e05
SHA512 87efaf09a124a5c9e4719dba5381d8955b3f9ee05a21c04b7c96a4e415e795be94d0dd15fa8ee657dc1e0c27cfe230ecb26a311eb5b8a642fa7a75805eeed879
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQaF:A3k03kB56r6
TLSH
T1E8257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 e03844a45eafce58ef8973b0c7fea9756cfa49cb183853bd5ae76deae51e948d
MD5 f912213f1435a32df4d413671fa909fa
SHA1 813067a3def6bd66a62df756e581c10f2af2fa68
SHA512 628f74092c8444a5ff60fa7f746a700f6a3a2f9893f073d01e0854a9a36062dbd7b6a904936bc59b90af757c7ce1733fe912130e1734db55057a4bade7c0b74d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQvC:A3k03kB56rO
TLSH
T124257B03E6850FA4D00FC1749A964662EA777C465F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 ea82abcc706e0eccd1514e40ddd543d393448066ad38fb062619dd0b54f1d5cf
MD5 bd093ecdeed2e38413ed5def1e761080
SHA1 bfca60bb6df1c14501785cf109582442915b39e5
SHA512 8f926fae8791dfb7cd9dc11aac99f0e470530a6152d5ee2769092da63168614298933247d7a7f87d2b7b0877bb13cdf573756baa4cfdf85f7c4afadd1789e5d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQQw:A3k03kB56rb
TLSH
T1DC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 84f62fe641cfb7d1d4b8cd08baa00cb792cd454bdcee6545345be1d6b0f61c25
MD5 7b065a16da9c7359173701be21620e8f
SHA1 201902913fc77633c7f6a58374593a88ace665c6
SHA512 9b092ef997bfbf95c67242a200d3f8e1dba05ffa45cb67425c1961e6ad327d3836f4fccaa4708227679fbc9c5e9278089b63632c6ec3dd2f7b872646390adf3a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQvT:A3k03kB56rH
TLSH
T121257B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 5191382ff670c9b83f81c8251c6f309496bd2b1fdabd468173c58394643668c2
MD5 3f7ccf8c1c0fb904a9472eb8ebf4bf4b
SHA1 e450940e04fa5c5f52d09f4b0d198ddbb163bf3e
SHA512 3b72796f7ea7f477ad36ea472cf487c65809699b8b4af2fa2f51028227cef693d94e363a756f10e600223b99b3311add6fd719a8f068cb34131454750f9ceb44
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQpu:A3k03kB56rI
TLSH
T159257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 07d1525153a03bea7b6c37cd8b2e1bcc79143c85f2aecab2663bc3a2b759b084
MD5 083bfe465ecf987cf11caa683bce63ba
SHA1 37218e8b401773d5388cb4abd3329437bcd76337
SHA512 a1d27a081bc0d2e69dc9b293de6b42995e8fefe4b63df20da18ee11f06ef15ee078244e9e98736584a9e5c2a990515bd960ae7ba98a3a61275b58bb3d2ef0db9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQhb:A3k03kB56rx
TLSH
T1A1257B03E6850FA5D00FC1749A954662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 54d4c29dbfa4cc1e29a23be222ad4ab5c438884cf317bb033f6a92d69c0a1ba3
MD5 0db9e3e21c702d8fc90aa8f56205abe8
SHA1 532fed02c92ec2cbc4c981e81c3efbe284d30124
SHA512 64e0e721b334a6214cdb978c743d3f994c2dd13a254ddc9105d3a5ab2018811a57aa539c95d2c678c15cd600e4c8b82da930d956df824bb9387b2b29d31c8ed9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQpf:A3k03kB56rx
TLSH
T157257B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 86b4810d4645e60c8f6e8f613aaa34f9d4f9529e3719368cec10769aacc0bc27
MD5 9c9977a3c54cbf0ba73317e2bf5bdd3e
SHA1 0a0c898ac5c8712b935064afcc02594c2f7a982a
SHA512 eb2c06a61004e6c0091fe488e1e6fb8dbf98fc0ee622cd00dd294cd317c0dea0c3d3c37d6993461e4278a5003dc4d2775ca3d75e5b0897d48b9ce63ac5e17642
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQSK:A3k03kB56rJ
TLSH
T1B2257B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 882306b85940eb1ace1806957a03ae354452d3fd4cba8f45d0a9008b2d6e21dc
MD5 bfdaa1c72f68335997d823244abfe216
SHA1 edd1a12d1a00e880a27bb70a747be6fb9ebeb21d
SHA512 faddff6cdef9590f3728d139de9ea0bc9804d090924d40f00bc0511d6af192ac83661cb9bd3d9c8f578ae717c598c860fa4df343d8f24e6ae06b6c76aa35b8eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQ3k:A3k03kB56rA
TLSH
T11E257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 be3f32afff1f3b589445a44d714dfdebfba9f5d360634edd127f850294afa9e2
MD5 24e887015b9e071173b181bcb8961086
SHA1 baa837ab11edb02b239726c513447da84caf3911
SHA512 8ebf0e479c8c4ea8f75926d0d93392f2047575dc05d3d81e2317896aba29ec5f985ae4a83d397cf2b89a07f7921467b0eedb0067cc2ea507974d683ba17ae582
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQA0:A3k03kB56rJ
TLSH
T1A6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 db80e5bfdfce6f9a479c7a21aeb042f88749896b394002995764dc57ad9a18fd
MD5 efe56bec078395fee818795ce70a2fc1
SHA1 2947ff437c0cc5b250a349145f00f4ecd9f676a4
SHA512 0095eeb99fd2fcfc8b52f2bab6e07c05df2673f12e2b1636695ac6f3dfc8b0761bcf3d8adc3fd4142ebf19361c574963b5e354251df13c0617f9a51f023a80bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQbg:A3k03kB56rY
TLSH
T152257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 71118251f8dd31bb80aa9a79d72d8d40554a9333e2d0385f7abc063dcf26ee2b
MD5 3f6b2f7b134c17958b9785acbfd9bdf1
SHA1 eb7f13c4d5bba84789480e6c63b0187ae02dba8a
SHA512 f0702e745a95d2b352bc9cb500d893606bbd5ba51d82d252fbe220e813d2127f21928de9308726b326a9375a6f0d01c16ec80928ffd4f30f7770c0287e39d5dc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQWr:A3k03kB56rC
TLSH
T115258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 7a438c5a8cce5938beef4edbcc978e0796d5cd987b269200812098ac8fa11ff6
MD5 92c4efa3b827e3c533c2d7eba89a7b6b
SHA1 1b8f5d6943b27bdf3ee4c28c8e8c385984a40dc4
SHA512 29aef3ca8ddc75930a108816841b40dae0c7706c52a865308b05b26ff245d49e9853fcb54a2b54c4620c84566defa8b7fba914c2a31fbfc576d3cf2d48cdac28
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQ8n:A3k03kB56rU
TLSH
T11F258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 576572a450dbd82ca0ae924de277357aa6d0fafa703bce9d69fc12facc67301c
MD5 d450710d990df9c0c677a892eae6e48f
SHA1 6d45ac00fe67829544e92024ebf2099192187449
SHA512 c302b95e89a70b0ae6ce756f56b80be9454861a07f6ca48dc6f12b4ceac3088fc60ae22e9f45057703eeffa6eca1681dea000495d6b84a69bfb8851b59ace111
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQ6x:A3k03kB56rS
TLSH
T12A258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 4ace5ce2fe5ed37e786a2baa4a32fcc5cd3ee621f3bee54941832ddf1c3c61d4
MD5 229d24de59ba1b5a94bb735cf53670ed
SHA1 f9e75eb9177fb02f4ee48185c14bb1f52ca4482d
SHA512 c3e4766559353c7eb0f65eebbe6db9e6c6dc759b2f67a0122a8f280762fbfb729fa1a68e5746b94b0b908ca1fcfe84428df8a6550649db5616362a8688da80c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQ8A:A3k03kB56rx
TLSH
T115257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 edef76da6dcb833fe84c6091f0b12c93f8362c81db54fbd73c4457eed183805a
MD5 d4b8c6436dfdcbd6cf085b8957e330cc
SHA1 6fa2983ef08398a1f82e35fd261eb992899ee609
SHA512 c687ed0619d3a961960da2bfed004481723f1ab20bfd62c7717e91b85dd074c8215dedaa703abe3fb53633db3487e45070070b5ae2cd6bc15f154deb588bfc05
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQl9Q:A3k03kB56rI
TLSH
T101257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 cf6d056b95a30523f3a10e02bd2014e4d29f656f88649f95c5d26c11af169dac
MD5 87e542c84c6a16d3910eee954f992a00
SHA1 eee96868be1f8887d3fab7a9559540bb43971379
SHA512 76b921598cd0708bf881ac9d8c36c9ba54d66810bfd7fefdcdf55333aa14364db9f3a536637372d4c814b88d2cb1202bdc36941485774adbd45f1b7aea55a5c6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQQ4:A3k03kB56rz
TLSH
T136257B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 cd732fb55a6fc970bbdb4733af8c760303f273f1a86ee974f51e16ba2fafa81d
MD5 0c993d1af83902483d27bf7f8b2276e3
SHA1 172a0a452142139307e8f4ab45e9bb2f84d4b9c8
SHA512 0ab3ec7611408091a5296859ca749589bd81c5a74cca1125b77171a56a23b2c6c3ead14867efda731245ef0cd1dff76a5e5043c4c129dddcf8eef5398dc6245b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQTu:A3k03kB56rW
TLSH
T18A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 484a4f7a0419ccd47f7e22c59cd4ee8ea52091c827d005a703c8a63e3c26abfc
MD5 113ae9df07b5f10424adb95e9867a573
SHA1 45393024e9692d1839348ef86fb7eab959086add
SHA512 fb7886baf34b033098afca0f50c425140ba8056472b4b3e17449398d2bb1fdb816f18eb8c8481b8ee9e56a61ffbfdbecefe74e75ffd9ae482fa7a98d6f1c6cd0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQOj:A3k03kB56ro
TLSH
T162258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 9b9ec14a2cb94d33252c2f169b5bb0098ce58f65d8d4e959d38437c3302b5db2
MD5 af7e7ce6cfeb9acf65bd3503c982bef5
SHA1 d9ff276db1c5e1488fe1d40c5304fe03ee8bbbf9
SHA512 7be97d12ce987cfed8e7d1e396d303ebb32673aa5c107d795ab8404c988f0f4da7ab648be812da193018970a39ccb247a04f4840d3d7beab91ee952fc0e95053
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQ7g:A3k03kB56rw
TLSH
T1C3257B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 b57a4e53225c03cc540761371d0012c78e01aa9d9368b223fc6f23c1fb132429
MD5 e4697d1da08a016702fd4770fb5f9f97
SHA1 f2859f1c7a081217684ff5e6d2695d034925a3c2
SHA512 5ddaeda7350979685ec88155374a042649a67ddd61cb025847733814c088d39f3ff18a14c3767062f4c84e090565d7b811ee4bc5ab76502536a7c6bd03a359c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQmI:A3k03kB56rR
TLSH
T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 1da076f055ad46f56b520f9a32a76bc3f503865ef87dd9fb302deec0e445415a
MD5 ddbee3abbf2fb092cb11d898727b2a5c
SHA1 fdfdccf35479f1da75b19d7d4cbfd84feef4f56e
SHA512 05b456ebf767dc5b1e973dd4ffdb11502f1d3117eb0b63a2b8a2c275b1be4e71da2d22e915e0c63d74a51f3e9a4db3c7694bd73abe3537edbf58a9eac136e38a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQUo:A3k03kB56rv
TLSH
T1D0257B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 dbecdc784b73fefce584648df291de40614abb53553ef20fe2ab50fe1107e8fb
MD5 40bd19e5877bd4f227bd15c7625a280d
SHA1 6d605f67e543e9bb8a9475a85ff78a19a8a1076e
SHA512 e82091311a4ecf1cba6989ce112dccbc09566ae0d1f294ce226f58b9abbe160957bc2f7dec2f24acd82431230ca1c4317fbbae2ff61b51daaafb1114f3dbcdb6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQ3+:A3k03kB56ra
TLSH
T15B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 71e82277652341f31e7fc0953983a574bb98d8040a6583237ee92fcf38e5cbe9
MD5 3241a1730cc04b1381098b50964491f2
SHA1 98c3efc2876e97ddbf945bcfc800e46dddcdbc98
SHA512 161614532564bcdd3f88bd38e6d44ab2980edd3d32a08d205cac01669cae749d2bde028c752c1b438d8e9acf6a20577f64869027304856a2c53c1be311f0172d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQNQ:A3k03kB56re
TLSH
T113257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 004b5269e4cd604a4f3420b4e1c3e56dcc638497b71815007386a43867c07d95
MD5 5feb5118372b36e7f9e24f75cecfbb47
SHA1 4f0a3198237908e4e292fe73e45c49cd3af00a6f
SHA512 bb1dfbf6470851f5a9f580fedadb8cf12a8613c942128058525c337e5d60ebe48864bdf794f4a413d8a933dc355f668b9cc6bf6fc73dfc850c8e05cdafc2227b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQCX:A3k03kB56r+
TLSH
T180257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 bf8728b7220a41812edc6b9fb02235e1aebb1e6776861d35e578f9f1beba4f35
MD5 b896b7d8a6f318251a60eb135511a46b
SHA1 b79b5142c53241336e304f363b9df4e418f184e5
SHA512 391548678da02bce473d6d6cb015ad0c2af26db461c2135d0cc641bc678ae09d8a7c688e1581314d25552d6698012cecdb41cf056acbc1d1b7ab42066e81d6a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQkL:A3k03kB56rQ
TLSH
T104258B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 7c397abfdd96f10306b9d36589ca53de894aa67a117829a905fb3edbeec6ee9a
MD5 da2e61808a236aead0547e236a48c698
SHA1 39c7d2a3fcb75aa0288ab1c47d7511d9b50f2575
SHA512 e68e6bdd6bcda9c138ee01c0fb30b3e0c6b14c53edf0f8e8e732653731be765593450da1def7822cfd1c2fcd3cbaa178df0b54b0a7c273701bd6f6c8e8a9e3d9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQAM:A3k03kB56rB
TLSH
T107257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 5b7bec8ed852657e71a33ac70d393649089259e759759475512d7e816c8f4860
MD5 e9cfcc99ef7738899dd0cfd3540a1984
SHA1 f4ed73516f45599f1d431f65cb11c6f9924d5e5f
SHA512 3d95089da04c4f2439bb710eace6dc33bd0f0a5269a55efe14087821a4853bc632f60734629b05e15f85a9242d6f8d991858913b63ecfe9d3763fb938db10b02
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyQhh:A3k03kB56rT
TLSH
T133258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2972-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2972-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4600-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads