977a55f36bfacb98cd14352e909c2c369e5be9cca38cb53332f369bed6292756

Analysis

max time kernel
92s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260801-xtgj2athnf
SHA256 977a55f36bfacb98cd14352e909c2c369e5be9cca38cb53332f369bed6292756
MD5 dfeb8490c98946e346b85ae85cab7256
SHA1 dff5927552379cc68e07d0bc8ad8f6be3aebee73
SHA512 8c074324fc8cee6e479e080314fb9a038aff05741a0bebf625fdafc783f6e4f6ebc55e59381bcc07ab89630743bf45e4c80f4ca5a7b30aa680975199f3736cc7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43c:A3k03kB56r4
TLSH
T1DB157B13E6850FA5D00F81749A958662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4452-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c624-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4452-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5480-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c624-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1060.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1121.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1215.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1338.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5480	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4452	2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
5480	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_dfeb8490c98946e346b85ae85cab7256_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4452

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 977a55f36bfacb98cd14352e909c2c369e5be9cca38cb53332f369bed6292756
MD5 dfeb8490c98946e346b85ae85cab7256
SHA1 dff5927552379cc68e07d0bc8ad8f6be3aebee73
SHA512 8c074324fc8cee6e479e080314fb9a038aff05741a0bebf625fdafc783f6e4f6ebc55e59381bcc07ab89630743bf45e4c80f4ca5a7b30aa680975199f3736cc7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43c:A3k03kB56r4
TLSH
T1DB157B13E6850FA5D00F81749A958662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e5b9e8a1e66318934676bab79ee1ea42ccb98cdf66d46286d1e48d34e0cd0e6b
MD5 bf475f0c4453d48947be79eb3956f1af
SHA1 9642b859456b27bfe17b1c0798147ba72fb2a0a4
SHA512 a86a1ea3718fbe76199a74a8f913bf17f45cfce8c0db84e0131fb5d5677ccccc969ebc885f6a6569c4ba36487869eb9002413685a29fe155666bb4d08b5a05aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43k0Le5ji0hmxNrM:A3k03kB56rAPji0Aj
TLSH
T193655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 e24393d2f51752c14cd5a4adcb0a7b7bef40fd1b54a46fe93ddd07bf3f7584a8
MD5 8f9378699fb56c2d80f7e065e3418b61
SHA1 5da578d92cfe82e4c481c9de48de5a920fdc4cda
SHA512 7149f2efe4bade7233b8f866134a0022e2c067e5ea3e02164fb0f8454ce0ff142ca7e1dc2c8ef67be0e59ec1e52924970c5fb2fd420f4bfcf575ba3379ea7ba5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Oa:A3k03kB56r
TLSH
T1F5257B13E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 a8ed1a2e850ea254ecb53c1e2c69fe496c74e1314424a1df7acfab2a1c1cbd46
MD5 e3c342617cf4b87b468d1b21d1623d37
SHA1 dee9182779a03bfb302210242349b3cf63163cc8
SHA512 bb08a8acddc46d88aa80147ab851c576bb5b673714d1da9e61f1bf7fd0f1fa12cf7a837c12274caf7181d38b606be705a1aca199324f4e63ed5ffc44d1a95c6c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43v6:A3k03kB56rO
TLSH
T1D8257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 1a40112b5878a274060d636a45dd4fd4cf2f8e200f83be743ca8ae3aeac69e74
MD5 6f7bb184c64505c58bc9ae235c92f3a7
SHA1 a07bde95eec14bf78eb4d1d62e4548081bb608ec
SHA512 19d04959766f9473ecdf30070c5bb0a1b5f1eb4577552b0c152836ea22e2eaad28277b00c866d0ae12aa0b03805b047823b9ba638753fdbf02d99e3c9049b8be
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43xN:A3k03kB56rP
TLSH
T127257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 64189508b55358fd43b738bfa0c79dfefb4c59a53bddd87b577f64c0586d49ad
MD5 8e6f6c70ed604a4d0d52b80a43a0b619
SHA1 fd196541cf8417cb1c828b8d8ec28a5200abf85e
SHA512 141d0c68082235b18e44b3df478b9e5ecc96d346719ad8334cd6d56b42ebc5a54394fc4ef7f2edaef147349009ddd719004d8f9a85cf33c71cbca8ec8acb36f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43nf:A3k03kB56rL
TLSH
T137257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 0cf50842de4bd864b21db226ded549e0a087c609692e2365468dbb9091c23f09
MD5 8cecda86b28305d8071678743693eb58
SHA1 6519a64f4428fc4da710e5957903ed6b8a1f1def
SHA512 a0dbc4a7e01c0b2f4d90284f62decd0e78057b5ceb6b6459455ded54ccaa2a1dac36d8ee020fd7fc8c072eb96f8192b6e76c70730b728fd159ceabe7f81835f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43po:A3k03kB56ra
TLSH
T18A257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 60f651b7a56d08d4f1b2f4bd92dca9d8f641d64790641a68ab31c7a214b2725f
MD5 89e98d39435d3e164991d6cf114c2d2e
SHA1 2b0c0211bf1a1f7435871545f52a58aeb37a9571
SHA512 3c5f3eb37edfebe4e43e96bb224c16bab1b95cc726f99a6654ae5ff823b974ce12835eca2e277d388f1bcb8f0e0380b3cef91ab7dd7cb386344e3d6420895310
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Zu:A3k03kB56r0
TLSH
T12F257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 defd6a36394b4df23889b75d580ae777ca6b820e847b78dac4c0851d80aa4d2d
MD5 87a270a981b571754dba968e119ac11d
SHA1 d3cdbdf4012737b12d1783d4e7c06431bb489efa
SHA512 e01ff9f41c48ce035b3d2df090521a0a785ec4ca55fb0f9dbb8d556fd7ca1cb1afd88c01b87ad22c99ad3d4dd507dfef6b0ebbc6d79c4b7fcc10c5b7d812da92
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43/9:A3k03kB56rZ
TLSH
T175257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 624334ab1bd0ba1d37cd50de0dad1ba5e8a906c79bc415ffee081ed53d02b800
MD5 7090cb48f2f4cd32de0d2a85aacde803
SHA1 be7ecab9020472700f2e97e15f3bd9859df48b0b
SHA512 a0a80b4a434b8d1cb1f05b671d4c7e4ebff5c4c6035dab621658c174d7a843f576d3cd86b95d76bd84bc9ae9debe8efa834c061134040ac35343aa109db3af3b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43bc:A3k03kB56rc
TLSH
T18F257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 939b849d4eef4eb9071da0694eb5c72fcf62d08017302e6be65c89ed0bea7266
MD5 5f27b57cf743e427c0b99d92c218a8cd
SHA1 93a05677f933e7250a88435eedfdd90d961fb29b
SHA512 be48050144647d2796b5942ecc0725ced8ea388439cad1798e8d77ca10ad061673a87a9ffea6403e206d0ba1736a01104362c151820e4b50fc6cc795722aa2b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Ep:A3k03kB56rq
TLSH
T133257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 cc329d6e0b8b38cb652dc4babd383667ac3b595f33ecc7d65cbb461d12128595
MD5 a678e936e72840c26f7549d6f6b58b75
SHA1 85f230aa128df7b76f784bee5960ee2a0cbef586
SHA512 4901feed3c4d8695a5d6283d61962705622f3fb7be1eb9865390b86bf7913a3ba58b43c1c9f79f0d2551e059e829a7177e502102e201db9c143887ca57d25d00
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43LN:A3k03kB56rd
TLSH
T1F0257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 adb771dc985d8752a6f9d6368ea8086a29a3c90dc3c16a611c18ff008fb74d59
MD5 860d7330717bb298e88829aba7d8fd07
SHA1 ada72cd3b0ffb331040d5863cae2d295ff6a43a7
SHA512 dcd541671698e3c18a5d87450b1310179d118014778f78f26d93680c7dd780653e7c8bfed0b56ce94f74f389bbbb9aa94bdbe66316ffc2d7dffe78ba634a4233
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43ZF:A3k03kB56rH
TLSH
T107257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 1c058a7cf117b394c95b5658be165d0b125f16fb1ac92a48f9180ccf1c1a88f1
MD5 7b4bf584100824b53713eab426cb5afe
SHA1 b5911c0943d417f44b0125dfd591f2e33c06ed57
SHA512 d6682dc9ba74fde5188567d61b21dfcdf983221771134d029825644f12c8a57ba9ef2bfc458eac4fe19a54d4a6edebdd8d5fcd1aeda3ecc499248e288a7c0d79
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43yC:A3k03kB56r7
TLSH
T1E9257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 22462f879f623f72d3f698d07d246ac567cd029de4b8d25e533790405ea6f89c
MD5 e75b03550e05c998f54129072531a98d
SHA1 e81886e5efcf497a45e5ea7137f05426fde45085
SHA512 06c8160b9cad9b7c5e1827d87b0ba285a3b0b0f59d327a4653e614d7f59c77eb7153c77d9d5a0e94e7a5b29b51a7d9ebe6f4b9b317dc10a16d77d6739e88223a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43tw:A3k03kB56r+
TLSH
T19C257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 30ea4486a965ff4da3d56b7985f7d5461820ce580c1f58a1ef281233f829bfdc
MD5 5bd79bb79b84759057fbaee5b2cbb6ad
SHA1 7371a9b60be6d4240edb8190b4e12beefff884cb
SHA512 7f1e4ee035c36275fb255b83dbb897b8292de904f7d00c9382e06727183d93e5a8e010ef408ece02f89fc1e9e4f5d365579fda2f4c06bd8641e38760111ed8ec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43cT:A3k03kB56re
TLSH
T151257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 12076728714f2bb94abfdc8203a10728f480f02913d31dae3a301d75819d4a14
MD5 3ae153221afeafa7d18ad12fcdec795b
SHA1 09b0388f1b731582e44aa63ce9434f4fda9a99e7
SHA512 b03f2006c12a81681ed1ab130101021fc1d17de5049f641fc7d2cdd05e75a53022d0e0e3943bc14bfb0d4fdd51e3a7d6c6bb77869d95a9b033ba0ef40ec5509c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43wu:A3k03kB56rJ
TLSH
T15A257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 691afad58617edb4acfc2fe608c2aa6e51c77d966a6679c3b3cf1d3a2e7b56e8
MD5 272d02c5c2481bc5f77cb82b48b98ed2
SHA1 a492d1ad15faedc7a6f82c085b82bfb8263c5c61
SHA512 231903934f3c070ce9e829c510ed88e919c8c102a9529db66ae79d9569204f11be71eebb7ae47809acd67a0eb1fbea7f43ead598237d3009c04a8d51ebb36ec4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Ob:A3k03kB56r4
TLSH
T177257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 6ed7c640d7474280d97126fc83723caa3ee14002c2007a6129b776fc7899a111
MD5 f85b16e60178c29f0fe1da4eaeef813d
SHA1 f6cae890f674993974189275d48895b5a691828e
SHA512 ab815637e718b215fe4a8476b037f48d9d4bf8e32c89d1d8e35099b9f25a9ee517acdeaedc723fb1db7c0d78dd1c5c6ea8e74e31b971cecef8dd6d703ab82c30
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i434f:A3k03kB56r4
TLSH
T1FC257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 b9f03bc4c75e9a0486bb5c0b92a0b86dfce62e716f364c65b922d492688d5a9a
MD5 db29e28fe5ead39e55324e35bce665dd
SHA1 e8de3af0750856d346ccee185a252f3a51aa589e
SHA512 b1fdc37359d6a6deba123b4ca68486d35e94edb5b64495b33a22c202ca1039f84d040e808e28ed7ae56ec8d0ee71c11209eb996761ff0a48574e2b437a33874b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i431K:A3k03kB56r4
TLSH
T1F2257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 725e5edf35f1ed260bdbcf3005af5b1b9444f2d6fa64bedd050f5f368b79b084
MD5 e8685b3b5a4fbcdf61d5e4efcd27229d
SHA1 ecb098a7726062b1afe1a7ae93e346419caf8398
SHA512 5b50f70d91f4ad2273daccca18bd06dfcecc606a6b5d3f260555654ca28077d6b2a15c6a0bd75105bf8288d16fa348dbcc4c348b8b466d3545fd9df88aa2a387
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i432k:A3k03kB56rR
TLSH
T158257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 b19e8b1e6787bbb11a5a812d7387a6d06360a660fcdaf20d61f005cc08a74f74
MD5 67321f13fbd70c839286183671854073
SHA1 bfc9c873e88fa8994b2797bec7d18c0bcbe3b287
SHA512 83f9c6ac57127e0ce28689ec787029884c3f0504a2cf06d416d0048e069328c0646f4a91f3d06a4dced8d32a3f785ca2013537b47117f22a0441c4b65b1be89d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43T0:A3k03kB56rU
TLSH
T182257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 1ca84567bab408182d06c4a7e8f6cc9a8b97e21a04bee260bfa1e147644d9681
MD5 532906d930c2566790160fd80411f29e
SHA1 d57bb3b76d7286b56ee25936b4e23a3e696d7b4b
SHA512 cb40370af800d435073501fab9d74c19fa5ec410b3a9a721c9a02bf2cf050b9ea37d56d3452dee0665b3477b95460263750282b179c449bf77fa32c9743c9975
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43ig:A3k03kB56rp
TLSH
T114257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 39a729dcc75ce74e0fe3036e83bf2aed0a05a19a49b8997d786397ff1e8860ac
MD5 50120c4465db8fb601760cddcdaada61
SHA1 e6efcfd1c14d311e875fb39b8fcdbaed21b2424e
SHA512 277dddfc74f29c269b4522ec265d167e4c5c31aec9d34c7db43b7d3967bbced838185c25aecdcf10d4b92c6877bdac3d63468ce5100f6f8308c0f00e694ec1ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Dr:A3k03kB56rT
TLSH
T1FD257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 1f34fbf476499a951b67a9dbe53c5742e0dd323008b2c46d1c39ea26e3178317
MD5 fdd06b5d8640ec51722dd118d7e87619
SHA1 1893c919fd3a3f8fb60bef29a8a1a0a35ffb0d6f
SHA512 57c06a7cd8c9645ff43df51b2959bb3ff0bda5d33ca69378002ca0305309f73a6bea4053bc1d6d34261ddec203f0b2afdbb6d9d7993983de0a61f0732b6cb5cc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43ln:A3k03kB56rV
TLSH
T15D257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 4e71b9e04c97632e36fd551892b5d4c287efc4bb696a7f84feeea040e22a7542
MD5 79d832727caaa625cecd5af31a61c9cb
SHA1 5ff38353a66572741b444207a97bcaa679f9a344
SHA512 193cf337f9172f11c36702638296c15def902262ed03de727973efda3e2ca38916f95b884e25cf91f650e9f3059348512348f909e0636849515b117f80fd7ea7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Rx:A3k03kB56rr
TLSH
T151257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 d8d4a0476524fb95005a28e4b4f00e451fa0e849118d6bed76a5006aeffa9ccd
MD5 c154f0a67dabd6ee7fa8f296c264ff81
SHA1 2ecdb81a97c655a65e7c8d0a9da39b9ebe130a3a
SHA512 4e9358acb4380ad98d29118331b007701dff1f1498e2b8ba5bb1181ea8ae82544ab4765e2edd9c361989f2c70fa8904ecfa1dfd00b65b8f57951f899c653f30f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43/A:A3k03kB56rE
TLSH
T11F257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 f79f28d2c4e17a52ba467910fd0a7f6185cbc746cf0bff42b5bf0fec78c9b89c
MD5 dda62303ff2810f4b2de0073570cad9d
SHA1 c1b6f042acefce5f568e7f6cc25afcee5fed4c5c
SHA512 a2f61093bc6b877860c91bfb1404b416491fd37202f15c95468bc0f40660991d68addc4f0ac0b6a31e7155f6d78bda282bb459297488b8d0cbb79f4745bb1ad3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Q9Q:A3k03kB56r1
TLSH
T162257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 ef9bdd6636e2b4a511dab7c82fc23dd4c67348cdf06001bc243b5ba4d0f93bc0
MD5 9814d9fc0719c83e4270c08a9f18af6b
SHA1 3e185a38cf09c44ac966a636e82f9dc6eea88dee
SHA512 7614bdf6822e83e451cf4b53d11b19410104605f6dd52236673d1eb540ffa4ff8828bbd374d59d23b309f42005972d2e6b972da59ae5a25ee96d1f5c250827b0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43x4:A3k03kB56rK
TLSH
T166257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 b792607906ed16fc77f72ba49422ce37fffce6df49d29a5d17e9a398577f906d
MD5 706f7c4771a31732b99caf656af96eba
SHA1 ca40e0f25b43e9907e8732b13f73511752a26f86
SHA512 626a97ca397438c0e5838dafde77e6f46adea089e2f5db0c8e1a35ab97fad5817de4be6f0bdd596f1941bcc26ede26544e6b2cdff5abbde45be871fc5bc736db
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i430u:A3k03kB56rL
TLSH
T118257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 b8d85dc84130b3ff268e9d8c9194ad42a0197cb22f0d7f831d2ee4c4651212d5
MD5 d2a65388a4eed3482696c53a70021274
SHA1 07a76e0e8476964916d4a3280e78d58ce1c5f2f2
SHA512 2c88c567a98368e38afe3a2910506ce5180e5d258d2b2edc42cdcbf8a429f4d09b2418860740c660d5edf9f11b6c4d458f25eba8ee9156d2a7f85e46c0f689cc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Fj:A3k03kB56rV
TLSH
T16A257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 b783ff4bd5fa3b8679746dab64132185b46eb688550e11abea0427036b1c39f4
MD5 a9c1c5d1405532122fa93854ae07904e
SHA1 ebd9f5647e045d4fc92e88d767270fce3d1b7838
SHA512 e24841f1d217ace90b19c93de29a6c71fa726e0b477301eba49a15bff53609cccd6549dff71b1b2613daf6ed22474fe215136ff19b5ad2c7c3b7f3aa07a1aa76
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Mg:A3k03kB56rJ
TLSH
T105257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 836b99bd07bd4ae42027b3f0f1aa2d4e177ab750a45a576b85916cbf7b6c9249
MD5 ecc54bb25323e27a6b2a4adca148c9ae
SHA1 4e1bec04b9798bd99c5ff519bdd42872c9d0f184
SHA512 20d6e5ea704c0e4d47c84321e5f01437c4b1147dcf9a9e88623563f447730f842c01ddcd2b4b1c56a5df7b20fc285f74390db4b39803de2c829b8d7445e98d97
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43TI:A3k03kB56ro
TLSH
T1C3257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 40a18d5a72668d8d311958fe9e1ae0c619c7d4399ac73a95dcb5e7aa4277fbfa
MD5 436cc8f03e2cac0e4c5ca1b637e8cbb6
SHA1 a57b46b809bb9f066d0029cc8887a492ba62419d
SHA512 ba28bae5dc497024f9c136eeeee18da8d083cfd07552925cf73bbb7029a7f04f2d77c21cd9199c1b9752cc509fdab25c9b9b4faf16ef1252f7201d279999ad0b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43po:A3k03kB56ra
TLSH
T1B3257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 762b0d081c9ffd2a488dff8891cbf2deb873c7662cdfea2c861f1624f35f9b2b
MD5 1246d0867f95515accac4aacdb2d12c1
SHA1 b61eda4ff13460fc749f180381f6e61b9aa29995
SHA512 f424061d74a10f7441c20fd27aabae5447315df56773578baaef2de293c294bbf1f8eef77b854a073e01f5a2ce4c7b507c81f5969a24170f1c3e369565fe4821
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43a+:A3k03kB56r/
TLSH
T1AC257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 31470cd9a962a17749908f684939b0815ffe7af8389cf5362c72e33a4796f601
MD5 b9eccd142ea938a9d7e0cc672c04457d
SHA1 66758b1283b9e4ae8b7ef5737ebeee30bdf85c9b
SHA512 3375fe8008bba3aaa00e196b0598655523cd63b998a76974577ae10b2e637f9a97660e78740b3bf0038c138e3a57d7857cb96d6129eb8073a8fe36096fdd7b33
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43aQ:A3k03kB56rb
TLSH
T11B257B13E6850FA5D00F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 40d60527a9c07a5d4ed4e938bdb8386f196365539673de3bbad253617a35dae1
MD5 8c37adaf742136143f2e21071a138801
SHA1 a9508042e1bd975033d73570dd581223a8ef7657
SHA512 8176b714767e8225b24d4cda7aebb265458fe8236c1fd134bd40a7d340519d6398148e8c6624f4706b8b5ad3cc78a1fa686f5131e852c7fac27e49899282c6cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43rX:A3k03kB56rv
TLSH
T14D257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 0096e6c7abe2cee6405f3d721b578f903e57c10f482382c231b70862d543b5dc
MD5 7faa518b07c023c511dbba87aa0a7ad5
SHA1 9c1425716fbacb060a76d2fe60a5fc0728498225
SHA512 e35bd0a69599ff3ae06c94c8c674eb34703387023bf3a97c6137171d1352e3dec073d74b44253b7b670839ccf7657db54d3bbacc64503ba5e2ae07542aba821a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i435L:A3k03kB56rB
TLSH
T1BD257B13E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 bf7ad4e3a4a97c6a7d9f8a56140a60025e86d097b262a580b389e601550cef7c
MD5 97246768146c02345b6107395a6bedd0
SHA1 7c80e809d1f4170d2adc5dcd7e9dbfdb96e20383
SHA512 d4f75779c114fcd8f2e9f57c5deceec8073ac9aa977a0e6fc022bb53694ab2aeedb85d18a5674c03ae3d714f23dd7eb9d5d6030772d04405bff4c457aa0e2f90
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43nM:A3k03kB56rY
TLSH
T142257B13E6850FA5D00F81749A954662EA777C025F6093DF2358AE153F72BC06B3E3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 37c53ab10e2735601d256121d3d7996c09331067e677a5b71aa7ec49553abf26
MD5 4ac13ddfb23d508c729969f55ec2b5c3
SHA1 4ecce522c1c6c54271787eee3ae4dc061306e773
SHA512 5cc8322fd7e9b7879b6ddce4ffa39ed9d0449bba1f5ebfbc2ae18aa1b744885c011e118d7a532c45c6e28c5f2c26fccd947225dcaf614cb0b55e264821a810b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolxtt/i43Qh:A3k03kB56rK
TLSH
T161257B13E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4452-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4452-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5480-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads