ccaf5f32b61936ce730768771e56c6c757fc9acc444f9f4bac0162463150853c

Analysis

max time kernel
101s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 816KB
Sample260727-l626qazygt
SHA256 ccaf5f32b61936ce730768771e56c6c757fc9acc444f9f4bac0162463150853c
MD5 c0235322271273f53ea9f251f1d49e41
SHA1 c8ac86fe11f708f16259ce14a22c0d5b79da9e62
SHA512 854c453d9ee09bd99471f2e38c8e8ddfb40222a82adf1bca9d8d6d0a3b93a13d474a78d9b4ed907707a36c5c0f777c0fe3c81741265e162b426a5ab72d7c4b4f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2u:t/sCv7rTiw2RYwZCUsq2u
TLSH
T10605191767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c553-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4928-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1892-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c89-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-501.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-667.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-845.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-937.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1012.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1154.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c553-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c89-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-475.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-501.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-667.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-796.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-845.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-937.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-956.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1012.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1055.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1092.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1141.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1154.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1187.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1347.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1892	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
1892	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_c0235322271273f53ea9f251f1d49e41_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4928

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 816KB
SHA256 ccaf5f32b61936ce730768771e56c6c757fc9acc444f9f4bac0162463150853c
MD5 c0235322271273f53ea9f251f1d49e41
SHA1 c8ac86fe11f708f16259ce14a22c0d5b79da9e62
SHA512 854c453d9ee09bd99471f2e38c8e8ddfb40222a82adf1bca9d8d6d0a3b93a13d474a78d9b4ed907707a36c5c0f777c0fe3c81741265e162b426a5ab72d7c4b4f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2u:t/sCv7rTiw2RYwZCUsq2u
TLSH
T10605191767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 d0743547267b8f129ecd694cd2a40c88e99891e3b3ea708f989d50473e6e3944
MD5 ee7c79e01962b7e962730161d1169d93
SHA1 7558b8c6f37cc65b79753b070fcada184122b863
SHA512 65c9ab2edd97786e25286642dfcaacd6e383be466844ca9ced78c757986270d9455ef8cad80ef0db6c38aff1093e4644b47d7843475909a51655e9cf1a24f5b3
SSDEEP 24576:t/sCv7rTiw2RYwZCUsq2e0Le5ji0hmxNrM:x7iw2bPji0Aj
TLSH
T14E553917B6A84661D073E174C5E6864AEA72B4461B3087CF12A9C73C2F23BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 831KB
SHA256 ec025d0522f2c3c142ea1973db8d148b14f41d48427e0efd5b4ad6cf431c7949
MD5 e57003eef5acf7f2bb460e8b2f043fb5
SHA1 8b0f8141ddd74ac063a966c443600ce9777cacd5
SHA512 6b3f01659a4f5dcb65e13d9acc3bdaf67a4828ce42c88da12ad2addedd1023069894e3dd809d6e4ebbe9da9e83c318dd8394ef54d9537db208ae2130bc3cb627
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Ya:t/sCv7rTiw2RYwZCUsq2Ya
TLSH
T14505291767EC4894E5A6A13489B54606EB72F8551B31C3CF12788B2D1E73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 864KB
SHA256 2ea5d055d9eb0989cc3574d22939b815ccb7e362bbd4a56e97eec25f73d9f62e
MD5 b3a832ec69a83d4c9c8a83ba29201cc3
SHA1 dafd5ef212d213f7e59962334f5bdde9d33cdf78
SHA512 a190108a3e8d5c54a26a1df47f8c7652436754f577189ca8b179077c95f1de77df4b956389908efcb8b3873cada25ab251fc86a521b770cc7e95a9f719fb2e6f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Tb:t/sCv7rTiw2RYwZCUsq2Tb
TLSH
T1DD152A1767EC4895E4A7613489B58606EB72F8551B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 840KB
SHA256 33bb9edcbbc05b1b374db17731d53116bb440c6d9c05992e7e82f058d56d11bf
MD5 4282a493fafa058d71eecfd55810e517
SHA1 9619c27f75a3d28136d3c72cb7b8c8eed692b54e
SHA512 cf845131998a9cee3bac23836d9f26fd807d992e090c5a1585a4947fa981361f42cad2937f09255d452f42dc2b7d64a49380406ef44af62a58515cc7fccbc2ed
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2x6:t/sCv7rTiw2RYwZCUsq2x6
TLSH
T18105291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 840KB
SHA256 a4eba4d403dd86c6f601e8fc8da90bf67639b14602f22484ed4ec4863078d719
MD5 bd51c13284e69b904d4f6c44ffba7e4f
SHA1 5b100d8cf6fb9c0a71f3009d0a58fc63da2bc69b
SHA512 ed2471a585c174a73202b9ab75e3ab56c58f4c7f67859df8a2bd751d57d27a491dbf456510a914f56a331abefd1398bcd939ac2ba26749d64bfa9f5c6c310a5a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2vN:t/sCv7rTiw2RYwZCUsq2vN
TLSH
T1C805291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 840KB
SHA256 3e3e530525aac510b64e7440adb8c6331c0173ae3d3e031d2e2747c023de0d20
MD5 fddbaad7c767e6e63ebb516a7078810e
SHA1 39cf0fcdc0035d8d4341bb5d53f55a301075781f
SHA512 be15869d65a8c677b17ed2990afb8b6fda805a2c35deb82baa74eb71effc8776ddb5c34f1ef8bfb50ffb78b40ade1492c1037f59c8fde8ae73a9c980d4a93278
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Vf:t/sCv7rTiw2RYwZCUsq2Vf
TLSH
T11605291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 840KB
SHA256 7a6cc784c2bd0ca1739ba29ba6e0f1b0cff44081786d601358c1a7705334a91d
MD5 9971045723a640d91afb8c51ec081f89
SHA1 32b1ec35d52b6c44dec8790e5694fa417b280e0e
SHA512 787eb7498484fa22a6f90ad9226bfadbee10ef02b35af996dafda6e706b71c68f3ac94c030091b09ebd71f449ab248db3dbb93f444f548c8cbc79d2a8714945c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Xo:t/sCv7rTiw2RYwZCUsq2Xo
TLSH
T16B05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 840KB
SHA256 2b9a63b1f4fd695729e92569594ad717a180ec5e514016d13cb724f349fddacd
MD5 35720e8ba1de78d8ea5d699c1e37752e
SHA1 fb4486ccc4896487dce44b6881d19b893e282219
SHA512 ac2c9bd538e7c5206f53fae94cdcfc4f3d39d49df7f0ca3633f8a790b839d0ff4c24c412fadabfba08fa132d5d7f44905622e7c6666ec15aed1f4da56f51ce9e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2bu:t/sCv7rTiw2RYwZCUsq2bu
TLSH
T17905291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 840KB
SHA256 8d8f1298649cf40ca05c490c482484b52721ffdf047f81cf732fafa848f13fbe
MD5 e218af1993a8f2169ae27bf6aea0eb85
SHA1 41707c31731a55b875e333d47220d6353f54586f
SHA512 65699a5857a123703064144beb3622ca65445d8c8f2832d21296389b6dcc977e729ba139e8c2d14161375acd34a12ecd4577d7bd62210d16ca1fdd463140032f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2J9:t/sCv7rTiw2RYwZCUsq2J9
TLSH
T1A305291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 840KB
SHA256 4c7bfc4319e6e1be9426262a083ab63d901c2080d6f2a6ac3a7b57575c44887c
MD5 94a540aa7d296a0f61d7f3e93abc9771
SHA1 2d9aa37928d20fc25f950d412b7680a9aa56e830
SHA512 e9627ec711fb3c51eb3fef70ea222be45ddc3ba30f0d32077650faa6b994ff78789ea8f5be1e9a668070b7b51c2aa11445e4249b11df1537b39492b4ed5859ec
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2lc:t/sCv7rTiw2RYwZCUsq2lc
TLSH
T126052A1767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 840KB
SHA256 d0c18a4ccd029f4a09be0b99a1e83f20085543db35b390cac352199151dc6385
MD5 21f1edc1156c493381927a73a7b61c0e
SHA1 59f264a149313549c79ec24d0bf5395b8e5d2436
SHA512 a9062c9de9d033ecf271b6eb2831bef58d56b4b1ea9fdd28d970715494be83fd76e294add49bdd524b8824456a456b4579dec897970ed3c2204f820504d7124c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2ep:t/sCv7rTiw2RYwZCUsq2ep
TLSH
T1B905291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 840KB
SHA256 9c65bd1c629d0239300b91b44f0088d7c281e0f8228cc2f03e4446b2812d037d
MD5 220badc7776465f6ab36e9b1fa456861
SHA1 ca82432c99fb838bc33854a2735ccc5b400e7262
SHA512 b004edd63406a9c9448473da67bf7c2c6634ba2ded48f029729483584b632739b3109130b294cd7536c7a46b8cb6fa4e68cc2c100c431ec962a44d9f912e707b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2R0a:t/sCv7rTiw2RYwZCUsq2RN
TLSH
T10605291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 840KB
SHA256 b4295b4b92d78abd876d9c5599005e2ea6cd1758b9e3466b01925221cf0617af
MD5 60951cac1737f3c49c24bcf727481833
SHA1 31c4c48b55666b8a68c31c522a256712f1424dd7
SHA512 d1995c250cac0b4a0fd80f42c7b88e206dc2b2dc82a25b4fcdfd6a381d0413ae315afadc8ef138b1a6b968be8d84ae374c9b711e463f1e742af445395059d837
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2zF:t/sCv7rTiw2RYwZCUsq2zF
TLSH
T18D05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 840KB
SHA256 310807f7e8246533692caa32e55af034fa7fb389d7a60bb8210f8cdd8e571d54
MD5 920cef984f1eeafb67276bdc3038b253
SHA1 0a2974e41038b6f854469c31fb9f3ee28a99875b
SHA512 4ec08c18745672fc7b180ea24134cd923918696176267a034db59377ea5637f9b8eea5981186cbea65864fbe772958d9bf795e3a551221013daf3f171b858340
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2cC:t/sCv7rTiw2RYwZCUsq2cC
TLSH
T10805291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 840KB
SHA256 9401baa544656b051a6c8744a0c2ec35b22565390d6132338909c09421917770
MD5 7523fc9273e171d1bf5b271732d46f97
SHA1 78d9d5e6101e33ba970b97a09b36887aafa8cda2
SHA512 7fb0ceaeaa6bea07045fd3100f70caa9f1a21be1eb5913b68e0a8a6c6c8cd8f63bdfc1560815e643696567cc8a4654778983a7dbd441ffd9e55fb645f3999488
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq23w:t/sCv7rTiw2RYwZCUsq23w
TLSH
T14C05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 840KB
SHA256 edb762801879ef1294c3840e5761d20b8198f14878d9251110e723ca4a4ffff0
MD5 341abf737a9c89cfec54a7cf3d921bac
SHA1 e71b5140918be5c4d8b7756cbc77d1fb2f3da080
SHA512 17e0d85a427ec6dbe0bb682c59ef43676ee87f21ddb5e649eca30ebe98b8db319af060b9ea95cc1626d0467c85bbf478e1dfe95da55980b97b95308c418ad66d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2mT:t/sCv7rTiw2RYwZCUsq2mT
TLSH
T11B05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 840KB
SHA256 b46a2a97d3889e2d92bfac7fa5939c216c65168c2487ae49f6aff10720ea485b
MD5 d24dd4fe05f9b09277ee54ebc22ff03d
SHA1 ab0705c2af7150797280651cf6de1c7104de89b6
SHA512 897d3fa5ecc382cdb29f8ff005e46357008a29aaa4fd85693d1242d5400a476f3352ab95cc55314e80ba563448e2bc57f9498d85c9b8e55e709b05407a8e96a3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2eu:t/sCv7rTiw2RYwZCUsq2eu
TLSH
T14705291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 840KB
SHA256 56b1b3b7e38f3ec03397943c911b5ae370bf7dbe9870304f996d1c50e16b0710
MD5 91dc02928b98627c7c47068ee9d78e90
SHA1 afe30c1fd40e5e046fd9b44b777495e3e904490f
SHA512 fef8d38ea322a216af0227fed8d966eaa0ace4fca4354d6aed77a8b89344ecccfab56dfb084d1234f378a1a51fc9dae66dc28dcb96aba1dff32f3914bc869cff
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Yb:t/sCv7rTiw2RYwZCUsq2Yb
TLSH
T11E05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 840KB
SHA256 0d48e5c11b42811a5ea9e29145319a2398a38724c5979b521ce5f82fc0cd47f1
MD5 ede8621a1272ec15f17e153c4f47be7f
SHA1 1293a3127ba218947b8cb3741bd3e2834bab77fa
SHA512 096045a69b4f1940a32d6987ec475530b63c0bb06ff883525ca40974422902d30afe9e4c3a1bd45051b1f86155a021fceceb48019ae775208a4f541cd63d7698
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Gf:t/sCv7rTiw2RYwZCUsq2Gf
TLSH
T1EE05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 840KB
SHA256 9430ed370e2c07f3b254e43a3f17effd50369a012f14f155ccddcdee430fbf1c
MD5 d870b7366d93af9273a0c40c8b77b230
SHA1 3eeb6aafd993a62ce02970164eb217ff975e818e
SHA512 609de01675fb12f4f7381cc50572c34ecd646263ddfa3af9127410a0322dd680b46fd5800dbee3364895bf14a68f9db47670ce8c74ccb772d3fd9e4772fabb02
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2DK:t/sCv7rTiw2RYwZCUsq2DK
TLSH
T15F05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 840KB
SHA256 b70de8e42d7115d3eae53fdefc4cb9416cff72695aea60eafde8baf531d09230
MD5 f780fa609d8dbe53f5ea7e906ae7c0a2
SHA1 a33599ea05de62b10796d358d0d408a9565a3636
SHA512 caef45074070b2365b40a2809ddd082a99c70d1aa33cebc923e89998b4d0707534d9c0a0a66e56e460e3776efec5d0c511232bf9fa645a63946698a5fd6c5647
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2kk:t/sCv7rTiw2RYwZCUsq2kk
TLSH
T18405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 840KB
SHA256 9f642b719d3df4191906b4911722d80b50a828641a7f927a64683c9e5fad1b31
MD5 0b0837a9a685e050addad60e3d7708c3
SHA1 db661c1668375931b506a052f4c0946d257647a5
SHA512 abd687fa8b225cc4e6105e16e331be72afe775ac23822de49b13635a769e82a8d895fb726a0078f903c3fbd87072fa77b9a99a3a8b7e0793dc5a5da0e3511e81
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2t0:t/sCv7rTiw2RYwZCUsq2t0
TLSH
T12005291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 840KB
SHA256 f6622aacefa63d85ce0e1b3a0b3f6757a5d11d8a69a0c1e463a113f146083be1
MD5 da97b80e3500bc6daf0caf0e67d85405
SHA1 f242f9494672fbfdb63c687697d0d3089cd7977f
SHA512 3fc40d660fc76fe0e021d6e93098d7cad0bc0a04d5c3d2b6aca0dfebabe5e8874beec68e0e902795dd90f1ab7f8000511c440915177865613b7a9ad032ef0d8a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2w70:t/sCv7rTiw2RYwZCUsq2wg
TLSH
T15005291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 840KB
SHA256 c08bf24360ad2b6bc080de8b43c8cdaf0218170ca0675b180c3baec0469a5580
MD5 7da531d6dac4d3fa3afff17120b50a7c
SHA1 189b14339fe417b34a704337d2b600984e1908c6
SHA512 4d7385b2b2a31cb0bb8f975f8c694d92dbae188d280d419e7d5b6b2199f5506c90bbb0afebee129b7c0618e1c2c7e877b7342fa00af5e1367f7f5e7e58a8a833
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Fr:t/sCv7rTiw2RYwZCUsq2Fr
TLSH
T11F05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 840KB
SHA256 3bb39dee59e5b3fd11d11daede2a8ac59fd2bdf2a2ad85138bdc95ceb56a2d2e
MD5 f5eb54ebd341014b5cbb4b46552acc9f
SHA1 4cea0b16bc0b307e127a1b3ac2b68084a9854cb7
SHA512 14dd183ed2cac4ff235471348f7eabcbf3f2f6e7cf8a1a7e48eb4384891caa7f84b468cf93d1d808ff2cc8fb7c098db1c89b7560d85dea0d67f02809f22ac316
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Pn:t/sCv7rTiw2RYwZCUsq2Pn
TLSH
T1B605291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 840KB
SHA256 eb45b6e7a5f7b38b25884860fe8156297d90f7ba74df457947f8fb69632769bd
MD5 6c9c5f3325e055345f69eb55446b1a00
SHA1 0268a11636254f57a07f4373fe10e8dc76de8411
SHA512 ee2176f0336db413d98933a49ddc18b60b73b1565405a7ed0d7dbdf008eae075392320bc522eb02bd2d9600d82a0b0f4e106efd0ac9a4de17e59486a2c6bfc59
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq27x:t/sCv7rTiw2RYwZCUsq27x
TLSH
T18205291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 840KB
SHA256 f4d736e3061ef993460778b82ed2a4f75058083817a43162d81f1f2e4d4742e9
MD5 5dff1546cae3727556f624001ddc75be
SHA1 02da56a088d42aa297622dc731624b409290ab91
SHA512 07aab071340f4d9a3764f0215254c8340544f398b23c3469768be362040271e4fe894937242e33b6f3f66794acdcd5fb5f54342c65891fb2f9b019122695988f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2pA:t/sCv7rTiw2RYwZCUsq2pA
TLSH
T1AA05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 840KB
SHA256 49bbad44b0e1b6bf9a4092b9111ed9165aad2cffee645fd75c108343728f02d3
MD5 12bffbe835d03855af242bd1b2750a1e
SHA1 c004cdf064527b72e573fa8b55ea02ac23c0bd20
SHA512 b6f176206ad33db6b17113f6b64a14af53bb089e22685ee7d5b6f4a4dc916b887fea159e0c8fd1691f2ba7b624b6564c80c32090c46afa6aea4fbd06f9ddbe6a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2i9Q:t/sCv7rTiw2RYwZCUsq2i9Q
TLSH
T15E05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 840KB
SHA256 9e33283def4ccba231b745c4d1c5a17dff89f861c15d1e46bc3a7904ebe69d07
MD5 14bf5441723f29545ba031f3715ef032
SHA1 737b292c033c12cc74e549aeb8c4bc0417ceb40b
SHA512 205c2e19554319078bb6c5ed14a02dcbe9d3195769e3eee07710dc8cb584b0bcb16e1ead2a17bb45391cd27b49f5da1ea9146fec929ce3881ebbf17230ec5c36
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2H4:t/sCv7rTiw2RYwZCUsq2H4
TLSH
T12F05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 840KB
SHA256 f32d69b66dc31ffe3dabe8c44a108522a72c068ea74b91a4fba11caffcb1872d
MD5 f5c7ce6e8480b958d9faeca29f173de8
SHA1 e2b1fff8a5fb70a59e5c8708e9ba7ca9e9cf8112
SHA512 29db3c0b6d5f7c5107e61301226aa417d27d423de00feade67cec628d3d5f40b2d6b9ab614e54155f3c5f329eb4860eecae1627b76f7d578bfcf9a3aeaaeae01
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2mu:t/sCv7rTiw2RYwZCUsq2mu
TLSH
T17805291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 840KB
SHA256 fcb25ebb7eebca492ce6e1dd59c1b4cfc030b6a85a8d95a09bb2b2f4e97329f5
MD5 e54196cc7086d5ed60691bd31eff25d3
SHA1 c24405c5cf8b1dab878345f490cbf368205439b9
SHA512 b11782b8bb248aa45f221a13832ffd2a74bf15b901cdfb034fdcb6544bd9ccacb7f590e81a404695516dd93f3ce38e9dc7a155104e2a822ff75ee5d67c3c951d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Xj:t/sCv7rTiw2RYwZCUsq2Xj
TLSH
T1A405291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 840KB
SHA256 4c244ae111b639c0f76288c25a395e1678abff109b997a2b30a95ed54e592915
MD5 b4272f3b82bd2d8142f1246b3f846e83
SHA1 56a80a81a3063e5a50a8b28576341a2a394b4831
SHA512 13bf024927128b54dd32074b62459a9dc12b6c8e1cc9f41f2c71cf1b6228184d80ff41bde8aeda2ac2edec4bbe2ced62d96d389d305faa697902e5d9401e2560
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2Cg:t/sCv7rTiw2RYwZCUsq2Cg
TLSH
T1A505291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 840KB
SHA256 ca31259fb37a7bef7c979fd976c5f8da6a10302cb3a02dd6b780b09266329424
MD5 ac9fddad5d74fe54e256df3049c5105d
SHA1 35b010599f763db3e9559d8b714fd2808845f50b
SHA512 7b7d01d2551d140ee5fc357289901d9a24603d0a5289d92e67e32d43f391e9b117f8b3bdcd77af519a7acc8099c011d3c081aecba05e79c382666f5d79561ea7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq29I:t/sCv7rTiw2RYwZCUsq29I
TLSH
T12E05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 840KB
SHA256 27eaffe12f02608bbc05fc26bc5c9131b1e162d26f6d1583d1916f94ada9e164
MD5 6a4a713e28f90f999c312a3f29e708a2
SHA1 e2146c14a345067ca09275428149b2d509f6c022
SHA512 978ef9a146b9ad384932ff6fec9efef40b2d289ff130799fc4a4da8e4a21a334e1a056f7c42db399f3d05d31b85a294ab3b9e6436cacac753ffeb7217547dc4b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2vo:t/sCv7rTiw2RYwZCUsq2vo
TLSH
T1B705291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 840KB
SHA256 0a46a80bf57b3e397970c8c072084301ac3e4c85e419c43e2ed0d8ec47321efd
MD5 c2533c0eed4112c8fd300c147577798b
SHA1 f5e179c00a31a4377baabdcc6acdb71171b1c35e
SHA512 1b806c72ebb7d35c6fa1278b08dd590845ef464993f819356f97a31f414f7a3c8ac6e9335982ee27e9a5813df04601ec6b86073f896f0c6000076cc3c2bc51ba
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq20+:t/sCv7rTiw2RYwZCUsq20+
TLSH
T14805291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 840KB
SHA256 6bb58b845d1922f44d3613ca040c976ab5efca4b88fb96e7009cfce2e4aee0a0
MD5 12752010f564997f02d2e116d643858c
SHA1 0ba7c976222e52c9f709ee219d622a4ac7858228
SHA512 740b7b35a808a7d1191e15ea3fd9c270a42b7173f16a3e81380acc21ffd10834cdf73bf919a050ee874072e99c93fbe899a2f0319ff9b4eff24978badec6d600
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq28Q:t/sCv7rTiw2RYwZCUsq28Q
TLSH
T1CD05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 840KB
SHA256 52c074d1180952cc2693e18c418c3b012ca6053ca2f0face32579a5e417f653f
MD5 921a078325d91fe2ee386c1d4f30d0fe
SHA1 e367645f35cabef25368a875dc81d2cda1080e9a
SHA512 4967ad236098146edc502e209304d8ceeeb95719326da16859560d17ea4b3738266c60953467d60ce60fef65b76cc125fac27cf811bfa577349648c65f4e183b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2lX:t/sCv7rTiw2RYwZCUsq2lX
TLSH
T12C05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 840KB
SHA256 276a9840840539492dbf55c33b4aef07a59e849ed0edfd2ac07666177d7168ab
MD5 07642b9c7af3d3ab13272fa28a333b19
SHA1 d647c42afaf9103d7afd4e0beb28ed7aae435c3c
SHA512 966d5443c2865ed5e3c6ed62447e92a5d1becaed0ae79bb560d7e25eb0d065e865b1dd78095dd5168868b96e83fd9d03aa472ea1004dd62cea8163b5f7ea4b10
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2HL:t/sCv7rTiw2RYwZCUsq2HL
TLSH
T10705291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 840KB
SHA256 38ad6eb0d56885420d0573c91749753f6cc8e9a6cc9ca68657729c818d5971c9
MD5 d3a77750d5cba78b76df7d2ef498ca72
SHA1 d66765b92454bdea6f6e6dab3b56a52f9f3b4a3a
SHA512 bef61f97431dc1a7df52b36414c49653b10443bf2d0261c8a44fb3497794df571d22e11e4fd57bc2f34db5078ba1b6350d8c441f9ab5cb955389a5811f9d02eb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq29FC:t/sCv7rTiw2RYwZCUsq29M
TLSH
T1BF05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 840KB
SHA256 78b5f829d65afd40c164fb9a20d4145078ec838cbc7382d2b7e469f7046adc33
MD5 7f1cb6b1854f9dbadfc8001ae18fb788
SHA1 6e40d388ad7e19b225eb008c99e7d7e99469d190
SHA512 dbe1caef057aaeba95d2b151e9d4e3783060e3779426ae0451bb657ba6ad2cd9b87670adf1b4e9fd8eb5162fd7a2671f4537267098342b3f9f0f23600eef76e7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljq2uh:t/sCv7rTiw2RYwZCUsq2uh
TLSH
T1C305291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1892-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4928-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4928-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads