3708a39f0a482a43db09c666174e118f8f4436dc66e93e1abc3e326d01b58999

Analysis

max time kernel
91s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 862KB
Sample260802-3els4ahc62
SHA256 3708a39f0a482a43db09c666174e118f8f4436dc66e93e1abc3e326d01b58999
MD5 f07f35ed9e1eda10746b34150a8cccbb
SHA1 a71d410f9a3e2dd081e4754c339c7e32a7f513ee
SHA512 4842df1540cd129cb3aaed1708f5d2be380281609fb9dca7e4fc1fbd992879e33f85622c999bbdd06e67fceec904fc283b2dfb350ffe0258c55c457a9b21a606
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3z:KIifqFu1//IifqFuyDA54GX79lSHW6D
TLSH
T12E154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/1908-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5b7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb57-238.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-634.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-738.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-836.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-861.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-880.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000064db-1982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1908-2085-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4856-2104-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c20d-2129.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4856	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1908	2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
4856	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f07f35ed9e1eda10746b34150a8cccbb_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1908

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 862KB
SHA256 3708a39f0a482a43db09c666174e118f8f4436dc66e93e1abc3e326d01b58999
MD5 f07f35ed9e1eda10746b34150a8cccbb
SHA1 a71d410f9a3e2dd081e4754c339c7e32a7f513ee
SHA512 4842df1540cd129cb3aaed1708f5d2be380281609fb9dca7e4fc1fbd992879e33f85622c999bbdd06e67fceec904fc283b2dfb350ffe0258c55c457a9b21a606
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3z:KIifqFu1//IifqFuyDA54GX79lSHW6D
TLSH
T12E154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 963KB
SHA256 bc753470d423cc58734b5c8221b4be45e7ba7182d800556eec045d22d26970e2
MD5 6da3f3b14852a96d400b7fbfc86f9d8d
SHA1 522f367fafad33d231eed00dce147c8786d43083
SHA512 1a1c5f0adafc6e66f67acca43afc7c7549d0ad66c133dbcbb892ad4a80dfad2e05c08c9aac9473198e0125384739a3f94ba0ca7bd13ddaea722e80b398a7cfbb
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSHW6ST6Nr:WqFgqFUHLTAr
TLSH
T1F6256C06E2A144A8C55F8130CBA65372BA73BC2156E0976F13D4F63D2F31B906EEA717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c29604220df73dec167f16f6d5b773904124f6073baf84e13949652f3d2a0dbe
MD5 3852db7546b6f382118c5322ba515789
SHA1 0b3845aa8f5b9ceee694a51b1e9ac93f94bb888c
SHA512 3b464026e92cee4fe3e1a34cf416769c7690970a87a8c25b6c24697f093eb7ec47a7f6043009aab97774e4cb398d7c72227aa7eb23d485e18e1d3ec5d032b597
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSHW6/0Le5ji0hmxNrM:WqFgqFUHUPji0Aj
TLSH
T1E9654A16F6A44278C02FC075C7D29266FA73785117F096DB13D4E63C2F22A919AFA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 877KB
SHA256 0bb44b188423e886b5916b6688856d8994e4d630d0c2ad6e8298176757b09e20
MD5 c5f0985c845d8b223ce353d1386cd897
SHA1 0c1c483221f3194ce5868f54740c0ceeba073ba9
SHA512 325bcc56c27c999eb4a8bd06d170b1731d4460c096a1adffaee40196721427271716769ea63af5bd8a37e60214dceb7e443ac687d71c76d1131480d96e84e686
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSHW6ha:WqFgqFUH
TLSH
T1FB154B06E29104ACC55F8130C7A65372BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 886KB
SHA256 1b9dd734745581bd008ce8e3caf9384e9bff80189c8c2f87ddeb2936834435b7
MD5 fdc934bbed46912aeeec2f0f12ba4d59
SHA1 7525e40e54f7ae8a8e543d253c06cb9bb67bbda8
SHA512 f0cff5fef6916488e73fe79b9890ec45937d1b961c2f33d56351b143f3a9a56b9a9f37f0003e311fec13683e9d76b8a672140e87e697208253e86edde95228fc
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3I6:KIifqFu1//IifqFuyDA54GX79lSHW6Y6
TLSH
T1B0154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 886KB
SHA256 09804cd8a4974722d27f9e02821d3db84605c9aacf485b9619a9a06aaeb84ae8
MD5 31724c2aa7f87478f2563bea7859d189
SHA1 aaccf051da80f099f49320ee763a03467d7f5750
SHA512 7eef134e07589df7a9b4ac27560df3a34ac9eefa41bc7d6ca6cd7c587d50cd1bb59ebf705e5fd406536127e12d9c5f55ff1cd9f48593e66af1d0cd6f67833686
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf38u:KIifqFu1//IifqFuyDA54GX79lSHW6su
TLSH
T14D154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 886KB
SHA256 a2475a038ceb637c42be600e3c9baad0702c4f3aaf05da844dc877cfa88b0e90
MD5 9c042bc1177abf20039e1343d8b1f520
SHA1 8316bd38de3463fded306260108ba4f49c191429
SHA512 d5380f83eacd709c0123fe47b1130bc110db66dee4837e94f83c77c58cb59ca0be0999d4b55165d9038cbb6f5f56d2ec7a8da3007e87cb88ad513618867410b7
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3A9:KIifqFu1//IifqFuyDA54GX79lSHW6w9
TLSH
T149154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 886KB
SHA256 935c2041de9db27e2fc128166a9433b52b162577455a55cb031c20e623e73e3f
MD5 0aaabca12326ab43c17aadd6e47c8a71
SHA1 33f6f7a263e4d66b3dddc59b50529049ff4f8959
SHA512 817d61f9614d716aae8ab3fc895e63c96fc7b8bc58ff40ba9e150e214838ed690f7892bfb0bac39058a9ee34b713bbbcdc6c06dcf870673b1e84ab9d71453e11
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3Ic:KIifqFu1//IifqFuyDA54GX79lSHW64c
TLSH
T1C5154C06E2A104ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 886KB
SHA256 6b221d622406bbabbb31b7b3a473ba977cc25bed85dbf5a1dec9395ef15a616c
MD5 306f1fbb2e53f39a6eb8cb6494b2f168
SHA1 dcea2dc795b411caf62093d7d278dcd43f2ecf30
SHA512 34fde4f9a555d0299cd16e9916cb17865f2858931ad90a19b7e15df0199cacca09e368c4a9fb957df848f41ef3ebf20a6390b4191a00605c918d7194d8219edd
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3hp:KIifqFu1//IifqFuyDA54GX79lSHW6Rp
TLSH
T12C154C06E2A104ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 886KB
SHA256 8aa0827c7b1bac002c7e476b6e743ea325c11ddac34aaf46b0c967e6ae432a56
MD5 8f986da5a989e5fa046d5d421505697b
SHA1 5acd4cdf23105ccc675c976fb34c20bff1c21319
SHA512 dee1b18b1fe3e0aee9593e5553d87f647a0e3f3acbaa84809bc9f542444dd6d3b2ba6285010315a93790278116ec5156d1fa19089f69919e624f9082c22c5e8b
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf320a:KIifqFu1//IifqFuyDA54GX79lSHW6mN
TLSH
T1E6154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 886KB
SHA256 4086f2c0e9ec3af778fc3bc057d4dafadf2c166cfb4a9a4ea6cec3f50cfa99d0
MD5 a973f815d705272d6105ab0779e4f86a
SHA1 4538b28a4fddb99afd9a3ae3fc36a33dcddbf92c
SHA512 77204fa886ed9047df0b11ea8f00808e16e084d678e2a7b8e7da916828bff94adbdc2ae6897507d77c589af43c00505f7c06fc4f7f3132111d7e54dbe94106ff
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf36F:KIifqFu1//IifqFuyDA54GX79lSHW6qF
TLSH
T1AD154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 886KB
SHA256 1413cc63f5ed2979f8bebac5a481370386b1f4ca60a95d92e3d94bfcd0c8380b
MD5 c36921b64a3d0a3e5d5ec3085c6d5be0
SHA1 77269b144d616cd7135d6acabb9d9c371bbcaf5b
SHA512 c8c933ada02b31cc8de7ef713212b91280c6ecaf60b49f91729e08004ce7599e993da1380f5fbcbf8cbf100b7ad86f577f760cc036c357a6e3e404a6d19215b6
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3PC:KIifqFu1//IifqFuyDA54GX79lSHW6/C
TLSH
T172154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 886KB
SHA256 fafad924eab04678ff96793828af3866d0d9fb2e2f4bbd70e3fc37cd8088d4ec
MD5 d53b7b84ac4c9721cb60235f3feab41b
SHA1 3fab7135e572cd2cb8d9ee87e019856fadb4568c
SHA512 ec93630192a5da527c56c799e415e756aa467140b1b09122242c28bbbfbee0bd9f2443900bdecbde4dd29bd1af56647870bb570dcfef63c00c38904769d0095d
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3ww:KIifqFu1//IifqFuyDA54GX79lSHW6Aw
TLSH
T1E7154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 886KB
SHA256 dc463d613da156c90d0837d81182e7b9f3be7cf0baf484da8fa5be0ffdfbd2d1
MD5 3e00e40882a7562eb29f08d5269a912a
SHA1 98831a370521da279291acf3aa326b35244ece44
SHA512 bba0f91afa0f2f4170a6998bba1442aef05f2efb1742d6e93cce3c676f7e1b7ec64e8f273726e7afaab1f53c0c06537122bf4fab975bf7d93b1b7242f81f7eec
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3PT:KIifqFu1//IifqFuyDA54GX79lSHW6fT
TLSH
T137154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 886KB
SHA256 5d62763b782846b6076a908aad1de3637d9a7904169f7a98946785ff3168bb9a
MD5 86d6644d8e81a618e5bbd55b1176066c
SHA1 1a950d8a8a6d6b8c051333c27a39fdcfc6356911
SHA512 9978370b0a314c37bf85cc63931db1d845892c0fda93e49c7b1cc83b3bfcb8836b319a328ef11d062ee8cddbfe6870805c29a6421a61af29dba1372f5ce9b420
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3Ju:KIifqFu1//IifqFuyDA54GX79lSHW6Zu
TLSH
T113154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 886KB
SHA256 f6c14444763f26378ba3f0f7c1868504571dee62f9eff2c1f5781cf945c0198f
MD5 b79363ea2f2adb2ab3a1832cd0c8e3c8
SHA1 c3d5ddedcc193ecdc369ef5057ec057aa843ec3c
SHA512 882d149680ccd41ee5d4152fc2cf4d14c68bb660c023c758ff172cd1c990845d462ead2137f2bb930eea414323a55ddee20c341adde642d5c7a1be6d0398a622
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3Bb:KIifqFu1//IifqFuyDA54GX79lSHW6Rb
TLSH
T12F154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 886KB
SHA256 1cbac416313becc1581a4894067af20a095a8748157fa40c2a6e96e02272cb97
MD5 6b6de8665d8e444259fd921e66b72cff
SHA1 91b107a7ec05c32273effab4df1b1934b4f09146
SHA512 79f1d9755e7a1acf2f0ad6f03fabfc3cfee548bdba968397966b536d834daefe95440c6709ba794106259b5a22c707f47407994c9ea02fa01e14ace1d4d55f1e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3Jf:KIifqFu1//IifqFuyDA54GX79lSHW6Zf
TLSH
T1F1154C06E2A104ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 886KB
SHA256 c9fba6649e538e0985c73300fc373b5f70f938d8778e7538342f611cb28b0d5b
MD5 d77051819802c5f95b63a47aa39605ce
SHA1 4e02f192ee690523cb4174f47093cf244d1dbc99
SHA512 a5bab5f2808295d17cbcfec6956c652f3cb08741e644f61dd92e375948d91f4962f6d6e44c2c1a2d34d3863ed32d36a2c448c3f01d33bc3d4d9c110cbd0508ea
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3yK:KIifqFu1//IifqFuyDA54GX79lSHW6iK
TLSH
T156154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 886KB
SHA256 f081b4ca74e59bb7e8a97a24fe74f7cd868811169e29ea4f90ffd05b0d45d8af
MD5 c7e12190dd0fdc446c5c53486de17bbf
SHA1 c5753abb3a0c42a5e06683261f6bbbd3bf7382d5
SHA512 53c9fc93e3802cb41f00268926a92e0726b0f8a9094a059e5ca372a6e31dc18ccffae5e949c2c1182c93a19d557ea15bf20b160badc5a0c1a3b766803f4b0c31
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3Xk:KIifqFu1//IifqFuyDA54GX79lSHW6Hk
TLSH
T19B154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 886KB
SHA256 ed1b638016663fc8c81870d9acacd87d01a1a962c3914d2e115f19f603c05cfa
MD5 ffdf0f0b8ce943fb2c415d643d4b9530
SHA1 574d38d9a2ee65a6feec11c6e6ffaff9fa9169d2
SHA512 64251a2c7fcb7450a9d66cd08c3b4e13e4a4c53d698b6d67e551bb5c75c48a4166795d4adbf8299c6f17b76e7e3b413033ec460e9c103c138f440232c66efe88
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3g0:KIifqFu1//IifqFuyDA54GX79lSHW6w0
TLSH
T125154C06E2A104ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 886KB
SHA256 bedb325e54d37195ff500894bebc93c151195dc079a654fb5cf9cbd7c9a90a84
MD5 4fe9b76547bc8f8c2ea7e66dd5ec0f02
SHA1 11a5225b2912a69a43a5d69340c9083726986cd9
SHA512 1c4db96fb0ce1567c331669603e3fa9d49e3596b0bb0c4199a42f6941b44167014f53c3faa4f30b60508261c7ee0ba92b0035f952faf005e032369ac96ce9bde
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3770:KIifqFu1//IifqFuyDA54GX79lSHW6Lg
TLSH
T1D8154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 886KB
SHA256 244eb692e20e8e473600a872f027b8e368f183763bca93e03506cda10b38646b
MD5 7bb8a2c4b42702acc69c5972d703eaf2
SHA1 351897917a15280f65b43cae990273f621b49853
SHA512 06c1a378513c01fb07fc7f46bc24ec94e16e7e4a0163fd1a016a364d9013c7587aa6232bb485b5e5463c4c4f3d0e3172b2455c36a80daa21c2b37fd0b242d1a8
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf32r:KIifqFu1//IifqFuyDA54GX79lSHW6Gr
TLSH
T1D5154C06E29204ACC51F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 886KB
SHA256 99ef8a8ac7a91659a5d71a9dd454d090d47224fdc8e2d777a2ca3ccbce4b3b63
MD5 9c03a81c1af61c83b0bcccbae493f0f9
SHA1 1acdbcaae377017da46a2103a9dae9fe8a0b6b38
SHA512 43a76c6b4699a88e9302033367ae7334ff9022a337c8e6967154915f534b6192e3cbedea194bc56e35e0e69ae0a72abda35ec0fd964fd947d2c6b2a219643a2f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3cn:KIifqFu1//IifqFuyDA54GX79lSHW6sn
TLSH
T1AB154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 886KB
SHA256 3580275a74ed46ada99af51362759d9fae892049b5076c3a3ec17bfa28c11f00
MD5 e82a02f7aff6b9b4d85b5040c958cb61
SHA1 ea0911fa0a5a22afa96c0fd8062b1f4e4eac0981
SHA512 25aa4651dcbcd129ad0d737e3e8dd8a6750c9d9d8fbc5a904fb9dd9af36d796e757fbe79735e1d63700108550b623073f6fe9d88aabe40dd935d3d866ece0f4e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3ax:KIifqFu1//IifqFuyDA54GX79lSHW6Kx
TLSH
T1E2154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 886KB
SHA256 373d0f24975c219065fc0deba34308ff9d263ec09c5fcf880108bb3944c38789
MD5 26e970d48ab6f2d9ff2624faf991318d
SHA1 128ee2f9216d6c20f328974e1b371f169e2c003e
SHA512 7f5aedac6365540d294b5828b99e36c3ceda9db2f514ae02a307c073cbc30e7464c611efd5a09ffca6d7cd9b89c79b66ae27237826fa932e9c750a1751259c46
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3cA:KIifqFu1//IifqFuyDA54GX79lSHW6MA
TLSH
T1AB154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 886KB
SHA256 ff1561af9135ca311d13d47e154850aca335d58bba5d75e46cda874258fa8f1d
MD5 ef1c0abbe684b36947ab86b84ee3a505
SHA1 e48ee1971586e84753745c1ee2f37450177cbe8b
SHA512 6d11b75c8630129cb9592efd3ff1936b6782d01e0fcfe6b4cbbb164f813dd605ea5da3ca51209f5892505e889b542bd59327ad0625fefdbc55bf9de09143f22b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSHW6V9Q:WqFgqFUHh
TLSH
T1D7154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 886KB
SHA256 1a97a049b6b8ae5e9d424ddefff7f9647b4cac88a5c408eafc6e7e5d3741c8c3
MD5 4f678cd385602bc48d6a4fe7d8a24464
SHA1 3a7a067de6967c9453b60245855e12edbc963ee2
SHA512 063f0169466d7d3528d469385cbc0f3664b4c35b3c0d58c889199b7080df1c918f2137e6feb5fb16709248c6a56b9d6ef837d6665990fad13cbe2f9056a58ec0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3w4:KIifqFu1//IifqFuyDA54GX79lSHW6g4
TLSH
T1CB154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 886KB
SHA256 b43cce9e9acdf39e12da1e5488f1bc7bd4f06ed10029825bc020afa917221eea
MD5 5d0b2db0ed1550477c35a2dbd8851f1a
SHA1 7ae7accef19f4ebcff7ab270e0caba2530f458ce
SHA512 b40764026f78855e4aeb7372a7a44b8eb2003fa653752cbc38e9af34be9429d51ba1d32d8ea4eb0d4753ed3197f9a4f0e5dcfbf6a73df5f2a97a70857a37254c
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3zu:KIifqFu1//IifqFuyDA54GX79lSHW6Du
TLSH
T1F8154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 886KB
SHA256 699526055cdd53c1ca32c46566fbdb7911ed3b7219ef65fbdf77aeb4eb1930f3
MD5 1da1dbbfa6ee365450c6d4d3fbce7d50
SHA1 f7a19e4c0e33de0d51fc9cc8acca159a2844e5f1
SHA512 8bcd201465871ee8deb00e9c93a9de26aad8ddc12a6c64b414f7dbcaf15c652f1a57775b93806be32b4792feba6393fc9bb5b3a70cc3164aa1982e8136f2be30
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3uj:KIifqFu1//IifqFuyDA54GX79lSHW6ej
TLSH
T11F154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 886KB
SHA256 1deea0711a0a63b12e8ab5aa9312ca206a885130607e06b1ce27f311bcd9cb56
MD5 f14554a8f51798c73945ab12d83c44bd
SHA1 eb3f177cc0939ef2e5c811499d6bcb87e773a041
SHA512 dcb9bbed006fef39e9da1b0b6e61c6e631270ef5235745cfb435f367e8dcdfe51c30412cfbac066864138bdf94a52c6a274897670b2a72c929c9a67743f10bea
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3bg:KIifqFu1//IifqFuyDA54GX79lSHW6rg
TLSH
T171154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 886KB
SHA256 12725b8040f30480128bc8ba1dd8a18316f4fef4f53b4b47d43491ad24331088
MD5 9f9d8c73d275fb696fb19374048140b4
SHA1 3c724a953e2b74eb406b308a693582865761c266
SHA512 2ddac9afdb8ec8b4de0ba97888a6cdba4142228a87e9a25cba772de2caa7ee5b69fd4531efb619a6abb881f7fcdae85a9b7a8b9a9bae16809db11a33577bb3d0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3GI:KIifqFu1//IifqFuyDA54GX79lSHW62I
TLSH
T154154C06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 886KB
SHA256 8a2bc955c7ea611ad9f236b8baebb66f7b508e9a8c78dda9cefe0817edcffb69
MD5 d882eab8586b4e3b27b2a4708d5f1dde
SHA1 af9c6b011b7365df013dd4a5e00fa1010f998576
SHA512 8d9537cdf699cf2ab807e7cf44fcc96efc47186759c95e622e60d1173155088c929486e19e1e2b967130c8e3d0284c606e9b9a952c49c0c26afb2d397b582b1a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf30o:KIifqFu1//IifqFuyDA54GX79lSHW6ko
TLSH
T1C5154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 886KB
SHA256 f74f901f883a392a9cedd1e1afadf3819362437e76035bc6e5cd83092ec5820b
MD5 d397437711523c6fafbce4987ac9ab92
SHA1 d332730058d00d6013b62996be0a11b9dbf96ec1
SHA512 be6ed94ded3c49700257cb4c0d66b8d1f7b795c19f1c1eac73fb130c56dc489568a6d0c9ea85b4e2cd54811bb45ffd84430270ceb164a093270149a8dfce89de
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3X+:KIifqFu1//IifqFuyDA54GX79lSHW6H+
TLSH
T149154C06E2A104ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 886KB
SHA256 9b920e38903b3c0209476528f3798872d00baeb0820cb79fd313ca0bf5c6a609
MD5 7beb4c381777423747b298e80643c157
SHA1 0561fd04a1ca5747054b3c968a48bb4939cce1da
SHA512 f762fc8216a411d07ebd660c4875731822833844a28c0dafa616f171fab3d4f652f8911e08f027cb77de359127fa65670f56144ea64a6da477d134d8ea9fe86b
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3tQ:KIifqFu1//IifqFuyDA54GX79lSHW6dQ
TLSH
T1E6154B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 886KB
SHA256 cae48a89b666a6e0d9dce55f83986e7977912bbe361f1eca96c5b14192d633d2
MD5 c3a49312ae5d24e596c86c4046ad8d16
SHA1 5e854d931a21c42ea05860f36461744695f780ce
SHA512 39082f671be9f5fa6828932b1cf0463cf1b08f8a80ff7faccfef87da74a362ab800600e53b8d9e4280e06017c390539e8cf9c7764f4130bce7df428aaa13e9ed
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3iX:KIifqFu1//IifqFuyDA54GX79lSHW6SX
TLSH
T1AC154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 886KB
SHA256 7c92bbdd9dd2ade6827ec535ab5b103dbf37a50e102b056d92e4935e844d5b1e
MD5 bddbecbae84d18c34e9b819d210c478f
SHA1 21f5fef6f6718b967807b49056aaf9f8ae89a1c0
SHA512 ced1b448cb42963d011ccedc12cc6c4666528e03e58c0310ae39df04129c78070e974087a4e410c12ecc8dd2c13593df1af1924edb49ad15c64d8038020acdd5
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3EL:KIifqFu1//IifqFuyDA54GX79lSHW6UL
TLSH
T1AF154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 886KB
SHA256 afa8417915e9af3f53c4a8e28bb6fb11f418a0f3ec3c12d7207108ebf842af16
MD5 5be4e0e9061e5c12b09bc3cfd4fea770
SHA1 b987cc8a247cfb33914e00d12a00045dc06b7fa9
SHA512 589e08d2fdfbc80caf1e87a11d4588478b387d09cc0f0fbdc55aa7d561e355327ad5e861466bcb8945a6c7a3b46a5d4442e52c3c8ba5fd4211c5660fbd22f695
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3gFC:KIifqFu1//IifqFuyDA54GX79lSHW6wM
TLSH
T1F0154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 886KB
SHA256 c6b3994fae1a90d5ce017ea24f33802fbbafd7dd11d943805b65f2ef61a0ed1a
MD5 5f7d25746518e6cafc56ee12b0735527
SHA1 0e06ba4bfa28b07dc0ab89847c115265d181f70a
SHA512 4a408b8791d123ef6d092dadf6b551a5f8e46367e2d910c9566b45ac73e7e756f7753395472af77167e5d5f1ee33d269ef23dd8fb29c3c850430475c08dc28f7
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHW7Xsf3Bh:KIifqFu1//IifqFuyDA54GX79lSHW6xh
TLSH
T1AB154C06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfsvc.exe

Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
Size 867KB
SHA256 800aaaf9ac5a5dd02ed941f21ffc3c236379eadd5d35d3a31d22d88b87661743
MD5 7ef8ae13b1fee200d3dd1076b24ef78d
SHA1 6b5155612b73e707079a782067e76361d287d74f
SHA512 d791c39d8b5990a003c75fd294c3ce728a694507eb71ec88a2315ab5b21b150fc96d938b89983f59dafbb66fec703b6061a16049fd8881c4a32d33f1fb21569b
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSHW6Q+l:WqFgqFUH
TLSH
T12A154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1908-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1908-2085-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4856-2104-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads