ef11d937b4e36ec361bf8b6bad7bcfb900627ba303dac4ac5552af88ef3c3367

Analysis

max time kernel
99s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 839KB
Sample260806-qw57vasdkc
SHA256 ef11d937b4e36ec361bf8b6bad7bcfb900627ba303dac4ac5552af88ef3c3367
MD5 448d5ff58aad73ce12c3ffba15f2313c
SHA1 440fd833d5b46b2a661c7ba45e2b4c6011c264ce
SHA512 5ae801d097369a676ea41710dcda0df6b3f7153aaf2e5e56fe2f5d232ba4ab8a4f7bdfdfb6cbab3f63083c19278eafa48d91531ce81af3d1178ebacc61003259
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZu:A3k03kB56rK
TLSH
T1EF056A17E6850FA8D00FC1749A958672EA737C065F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/5872-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1820-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5872-58-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1093.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f0-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-259.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-428.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-490.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-510.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1093.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1367.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1387.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1820	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5872	2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
1820	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_448d5ff58aad73ce12c3ffba15f2313c_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5872

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 839KB
SHA256 ef11d937b4e36ec361bf8b6bad7bcfb900627ba303dac4ac5552af88ef3c3367
MD5 448d5ff58aad73ce12c3ffba15f2313c
SHA1 440fd833d5b46b2a661c7ba45e2b4c6011c264ce
SHA512 5ae801d097369a676ea41710dcda0df6b3f7153aaf2e5e56fe2f5d232ba4ab8a4f7bdfdfb6cbab3f63083c19278eafa48d91531ce81af3d1178ebacc61003259
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZu:A3k03kB56rK
TLSH
T1EF056A17E6850FA8D00FC1749A958672EA737C065F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 9fe25e763696b2326772bd37fb96baba8978dea21dbe25733579ea704e176350
MD5 69409d80cabd043c58d82c1f4b00da6a
SHA1 6b12962f0f3221d612291877151af402dcfe9126
SHA512 f33e9b31acabf6fe76ec72047a4c62d79ae54c9aaa7e2f65db8a6eed48b16b92c1e75fc5a4f636a578b24c28cea380e095a833c5754d75433608ade6eea1b5de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZe0Le5ji0hmxNrM:A3k03kB56raPji0Aj
TLSH
T144654A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 853KB
SHA256 27c9b1cfe87b9a0c7204bfd9ed431689c819e952fe00a1184c5c3275f8e7c554
MD5 3a5b5356298223f39df72d83ffd12b0e
SHA1 9cd94f1220b57f2fed6c8342b7d654a39689269f
SHA512 0848f7d9f94eba3da9bb1d39b721a8b2041f21023b560afec353f3424f0379139e3d04f8de9a5795bddd8c8a7eb433c891014d6d3638d8433735d50df0511618
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZYa:A3k03kB56r
TLSH
T1AA056A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 862KB
SHA256 dad4102a5d8a87fcbfd1d1b0c9057ec2b7ba0314a326e63ec1a2980bdcda5433
MD5 555c1117567753c6e499e527b75048fb
SHA1 abb0f28727d63c6f00c86654136706a088f25dd8
SHA512 fde77b58ae824683668a2ac343d2fc15a8f98716157b2c58170117fedb09eda9a86e9b5d2bcfd502fd991e05d089bee68117cdfdfff135ba6af13ba504064ce6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZx6:A3k03kB56rk
TLSH
T1BA156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 862KB
SHA256 5f169a90eb29cfced6039b9914f182b3ee95a413921c9dead5f6b1b4e9776857
MD5 fccdaf4aafd4f4d41c42bdd462a2bb10
SHA1 6257d2e191304ce9e20cca6e110d7da148bea620
SHA512 8f5daaff3a56d47cd9d0b1dd08640a525d4fd5352690ba4a07ef1338d57929faafdb448d4e58ba553945e0322efb617966462c70b439e5ee86b65968cea1e7ac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZXo:A3k03kB56rM
TLSH
T13C156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 862KB
SHA256 aefb3a44b25ff942b1011bb2b647e69c51b6b29a5e841e67684467b8640a4e4b
MD5 6e34c1318cd7e4bc0f277c071b4e29f0
SHA1 6dba6309f73f4398b6043edeb064e52af5b5415a
SHA512 18fc60e82ba5308e3f4d80d82a947771645d40ea0f1ea8a06325e34bee5e913ed47f71d5b44d6e52665d7e37a811ad5513926ea7a5f387d59eba3bfdeae0f87d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZbu:A3k03kB56ru
TLSH
T1E7156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 862KB
SHA256 b74e1b7966ced96d58cd039340204e26e35a0a46687cc658487d82065433d163
MD5 a6ea664e73b9c9fd011278143194f2a4
SHA1 61f24bb7018bc21148e0f9e976af05cdfaff6fcc
SHA512 899caf674e6caa22a86c253cf619f248c404ccaca9b775ee39c2af4c63358ee08feadd5dacd0357b2a46992613f3d4ee927b37f4dbbdbcc4d270d3d528f8f898
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZJ9:A3k03kB56rP
TLSH
T19C156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 862KB
SHA256 267b96826282a7bbcee21e7b595a25062c7b9b80405dccb5b871aa1a1a56b997
MD5 02661857faf16171dbc80c154690e09a
SHA1 e39cab9fc5153200c2ade87987761b37e99a02e8
SHA512 244cb62ae86897f57cb37630badb7b744e6beb25fe7646a907dc7f474c8736b822bf061ec3579c0d6d8c86648a9070ae6e8359c48b84f8626b1d34824cbe04cc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZlc:A3k03kB56rO
TLSH
T1D0156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 862KB
SHA256 0901fad113552aaafca9adecec2a2301060e570276c9b88e9faeca28b0a42c1a
MD5 75618c1f7efbc11b7faecd672012f2d6
SHA1 b471bb870f2f77c33dcc6d132d2dadef6e0306de
SHA512 046d4855a4fc8034df986350bb7a3b3d22eae08178a73e3e3c4e55e1988267e27a32a49df1c66ae1f122b400ba0999ea275d6063a2172df326b41c6811422704
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZep:A3k03kB56r8
TLSH
T16A156A17E6850FA4D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 862KB
SHA256 dfb75e90bab5832cb847027a9be80f346e61b527c9048e2e0736cef1bf6c57fd
MD5 39e4938b083e03cede799b565139ffc9
SHA1 f6201dc15a0110117f4ce959e8652cabf5cd28d5
SHA512 9149a4e86f406cdaa751d22d2d462a5349c3d2d1e1560c0026508ff2837e1e24fd4370d28201a6da16e71f1d2786ce4a76ca9ac044b8a285628cb3a8a275add1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZRN:A3k03kB56rb
TLSH
T16B156A17E6850FA8D00FC1749A958662EA737C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 862KB
SHA256 6f829c7dd0959bb4250693be21cd03cd3be708ca45f3107ca891a4150b841245
MD5 dd9dfcf534652c6d74c0d76f4e256aab
SHA1 cd0bd70f169eab0a1814358721a472505bf858e6
SHA512 2894ff20109139404cad9dd1ca56fd2a8adb686b789411aea652b6f1a2b591766d9c49df2c703191beaa88e83d8dafc4fee1a92653dd40e9df4b9cea96478e4a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZzF:A3k03kB56rN
TLSH
T1F8156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 862KB
SHA256 adbd534f043900f178088e672cef811b4aefa058fb8dff733c81f8e681233626
MD5 316e0675b8b9151192d18af14b8fff12
SHA1 ac80f7fb953373b5670c91deff70079111be9d89
SHA512 ba47071bbf9510a3eefa3e3e46697b57aaf15b5c45ba4dc022d0aaf4ca17b62a5f37ebff7f40c428ed6ddeef8099705d977cdb8a2744cd4408d73c0ff3346b0b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZcC:A3k03kB56rx
TLSH
T160156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 862KB
SHA256 dd0251aa6e3530047691bfa3f411ae21125206274ef01933fd7bcde49d71d1ca
MD5 8135ec053106ac8a8640c940e12082c9
SHA1 6628e3aeb2dbc78e07a935482cb4193830c61dd2
SHA512 e378795724a9f05aa55c8745cd1b972bcd379a8b3456e437d6b71dfbda39cea258010d07f6cade3c4c24b76c58c76e1f9d73df0e57dcc8173a293ad025eaeb69
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZ3w:A3k03kB56r8
TLSH
T180156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 862KB
SHA256 fafd41742ab0d1063a189ac98967d125a1259e4b5b7cbe015eb4f2a66431dbf5
MD5 3ede4489c6bdc02eb7244792afcb9de8
SHA1 5765986228459466adc936778246eeb237890664
SHA512 da1cca837fedf79641e008e6c3ecf8c3dcb30a20bfb0dddc6ed0006bc394606aeaa7891d99431a801c4bc6bf549b19735d42b1a73fd3d9fc2e698990608e41e6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZmT:A3k03kB56rk
TLSH
T1F4156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 862KB
SHA256 1937f2c83fc68492b7ef51e2cbfb1d724b4f2dfff748e32abab9880c764c778f
MD5 dc8d28374131f786f526c3ec6ecdfb86
SHA1 b0241fffd4d96db0e16ea44281662197f262e3a7
SHA512 0351853e43567bfcec17e4c52ebaf18c801287f3570ebc34687eb44a0a888a325efe1de42d90543bed4f2686ae8201097d1d450b7fd43ab6454ddc27ea6ea2a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZeu:A3k03kB56rT
TLSH
T1D8156A17E6850FA4D00FC1749A958662EA737C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 862KB
SHA256 624a7c6ee4ff01c6f624f7f658560bf400001751a7a71f69a1aff91034767537
MD5 e6e50fd2a9461675c7791e7f2dc4e157
SHA1 73c5395cff8eb9c10748a088218c26737c80e7e3
SHA512 3c92eba5e4af411bbf83fd72633db627beabed49b21ffe312f811cea936eeb2ecd1bbb12ea5ffc5a5cf5b089e6aade927bca93394716380a34418680ec986542
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZYb:A3k03kB56ra
TLSH
T1D1156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 862KB
SHA256 2c9bd73858587edebbfc793f379b668ce4a4ac62de1ee8339ea515e7f88294a1
MD5 ad9d405be1732a944ab84f3fba74956e
SHA1 036695bc0d04411a9cf2b6f8886d0e2037b7a02c
SHA512 18dc0c5df2920e7b28963d6e290f9712b0782e4c97182516871b6dd8dc789d5f17bcffe91132c9ac4e39c508d9de8f16b06c7d25062fa699367fc71c240d367a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZGf:A3k03kB56rq
TLSH
T185156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 862KB
SHA256 49644bf69e44e9b61e806afc7a16c7387eda031fe6a458bfc85e686d5215ad81
MD5 0a99c1e3d05dc76bb2a714d5d58777c0
SHA1 5de78ebb8c5aae355b5bbfeb47ae9c2c9d24c5d0
SHA512 50784d843bd881492055db1ef100761c2ca9a2afc3d25cd566188c9a35f28a32345bc1cdce6c200976217c56cee6217d1cbb51c691daf832cff467bca68b3cf8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZDK:A3k03kB56rq
TLSH
T17D156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 862KB
SHA256 be1d62025f48ae004671d8071796617ab60f45373b7b2705ca1052fde9b91817
MD5 03533fd953982f5223aafbd115cd4d0f
SHA1 db8b9e2f637a884974006b0d7135ce20441e7bb8
SHA512 7fa02de08561d9df41b4e2c787897b401e9eb4047923024aeddb3a8e4772cf240fecfa2534556d929b8dd6ddbbe44a1a11e3d6e0c9b6a7d245d24962618b8f14
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZkk:A3k03kB56rP
TLSH
T156156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 862KB
SHA256 3dd1a978c7617fc31d75c4f91a7cd05e7e58bc9ad6df2fd33f4e9750b33b3a47
MD5 126aeb694d8ed47b3d32022890899a53
SHA1 e0e986e00ed657aebb19c0766409132afc096f57
SHA512 196629352046cdfe09150f9200d5829ca0f76eafc560f60bed549905e62caf5a30ee2e5cfb404bf8c66c15b572561f0e0d81698b1c9c73de6692852be9bd8e88
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZt0:A3k03kB56r+
TLSH
T117156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 862KB
SHA256 7eec927f5fb83fe1e36a488410a7226729be8b772af27064afd89a140101ff2a
MD5 34b12830aca9575b7499cf0d487c0cb1
SHA1 a0aecc36d194f10f6012e268cfcfdeca9d7a2f28
SHA512 1b083b530588df0e1f912eef4c2fcc89f421ff854e17be0dd84f0c6a3560c8450bcbcee15ec02378fd8af17bd478faa662dd6974c7fb4233bba510bec40fa4a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZwg:A3k03kB56rn
TLSH
T16B156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 862KB
SHA256 c3f44430981bd83422149344f8b34b8e549ca9d33ae579892444163236e7cbcc
MD5 e6115b7a9b758d4daa086618bfc74b85
SHA1 2b71e472cdb93dadce4bb66dcd872ce3fb39e191
SHA512 f272281de0c2d549860abfc1cd95e6bb53d90602a6ec5add8238027823f1292bf0b06e1b88f57e5c353939a3b1c23ec173fe69badcc0fd70ab69f6701741f893
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZFr:A3k03kB56rB
TLSH
T10B156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 862KB
SHA256 ea30a3dbd2e82466e009ea0bb21ccbc325fab4d307d763bd53e7e125d112591c
MD5 d91981af4d9cf549a5b5f9cd57711363
SHA1 361af95bb616260fcc37fb26532390d37c451a2b
SHA512 7af471047b268f8bef41c942a9b831c83bf3f4b865faa44488f673c7e2a25aaa21d8a36132684a819b302ec74e5f1605ab4c0e5427fa6e33916ca380b409f83f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZPn:A3k03kB56rr
TLSH
T17B156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 862KB
SHA256 54777d8e885d24d915ec3f31bf68a0596f0d3cfb4b11eecbbe6438bf28f88145
MD5 2b7c23ce645ffa1ba66b1645fc32ba70
SHA1 88fcbbccc98f6676ff22cb6ad52cfa212ecd710a
SHA512 4d9364f3b4e0f3e871078983d85b66c4e1e96f08be0e8b8e8d872d6a8e711fbaa2c519fdb7e731c821d474b2a795f3883806c67c257fbe09627c668aca33784a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZ7x:A3k03kB56r5
TLSH
T175156A17E6850FA4D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 862KB
SHA256 c5b79314b752a6eedddf96c83bd4db6c8edd76f1178a1f46efb71beaaa071bdb
MD5 95e31d50d75313fac3e0d1dddaf5669c
SHA1 62173e7702eec6f63ec3ad63ca7e0aa5ac3e7f0b
SHA512 aa8ad5ed63cabbd39da8afd738ec7be8a0ae460fe8f4ff913da2f8580b72ca4e7747aaa756aa3151b47739d8471dba42d9ec2f6bee534e2689c0868539b44dc3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZpA:A3k03kB56rG
TLSH
T113156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 862KB
SHA256 d779580fee308b19a1af2d68c7711bea1d3ddbff2d91250f8610dce9a14a860a
MD5 48389f91cdaa4a825e2a96ce4e111039
SHA1 d68d04495da9e38345454034a1cddcd254207d60
SHA512 532f2af2b3a16b53749cab6cba308693f54180b17aaec04e83d219a544cc5fa9af1cd9de67e0c46f5e4cdeeeba40575a83c11416f490f3da5c2aea170a364dd5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZi9Q:A3k03kB56rb
TLSH
T1E8156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 862KB
SHA256 76596e1abbbaf5a18cd278668fd81fc1ca166fc5af1b8a0c86c87152a6cbc79c
MD5 d8acbf621e5e2c1483383c106f95a305
SHA1 4277db39d125d98eb52157a70241d0aee043e07d
SHA512 c35024ebb7f3c6c5a040d4ac5c8b9a416bfce96a4938a10ba9cfa59f22d3e239e66ee1d1c7999a47be232a926000e26d00cc39376719bdd1850c7c233c015608
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZH4:A3k03kB56rM
TLSH
T18D156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 862KB
SHA256 082c6930f9098f7060b8534de28790be7bf93468ae81e547805fcba86f7aa2dc
MD5 ac1a164cf753aefa6533fa7320a4c9ac
SHA1 a7029e7783afd8294d08c039babc9728f7668e90
SHA512 7228e25f4f5ddb121ba469335d8ac720d62fb0222d83827ee964c4263cf86c0b1f292063b3253d87598c1dc5babb3043ca031ac90a77d1b85ab43fe23b71b1f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZmu:A3k03kB56rN
TLSH
T10D156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 862KB
SHA256 03b1e7bbbd9a0a07a8881ec1668da1044f0e0f20095056a8df532b94453ff500
MD5 2049f8c4f146e00de65c0e27f03b366f
SHA1 f691c04492f1d066d04e42b1ae01bf79eae1905a
SHA512 9b0bd4d4f735594fb6e8e5b49d15b281022f0f8bb092502ac75d2312cd455079aed3025cb17b7027d65168428bfd98d6ae1fbd6d11bb4a9ed12bc11f6930b881
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZXj:A3k03kB56rv
TLSH
T1C9156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 862KB
SHA256 483fb9823c0260e20ae4950908b3ca75e6c2e88fb57c34e2b6a8b94fe78eb672
MD5 87fb52acc5ed2a64890ee5e4ea038ca8
SHA1 dcc9a8fc35b865d6d2a9d55dbabb74021744ab9d
SHA512 44509ff6dc199f74167ad5c2e3ee98581944550fc7f02b3d7fc920ec21180b9205dbcd07b18e9716674d9615343b0eb999d070e7ec94695f476b8ff01bc17675
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZCg:A3k03kB56rn
TLSH
T1C6156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 862KB
SHA256 9a71b633d9ad8bc324ad5d4582cb0678adfe7a593baab94f6cdb192518757cf6
MD5 cf4b5bea6810f4610d624e535a646c76
SHA1 cf7f9ab46e4aef264aa6976e44a11d22606f2a8f
SHA512 ed79006d651226d19439fbd6cfae00c79d6c886e599e6e1ce146360c4aee21779c236363473fdcb5ffb81a5a0bcf409dd6a017461b1edcf430182ee9c514cc6b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZ9I:A3k03kB56rG
TLSH
T164156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 862KB
SHA256 dded535a78e11d7daea7aa6de1ce02825bfb8adbda62639fb9e75e2ac40deb96
MD5 155142678440f0ed43b9a90b6bb7d820
SHA1 4ad718222efaad9b0e2debb6e14af1c190b6508f
SHA512 6f29600203f9976cc4e003d84bb00ed53128f12dc69d193e755388c28f745ecf12c116d6c3c0fe2a2f1dc0e30351f38f9bcb743157b6cf00b38e19d12ba0c2c1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZvo:A3k03kB56rU
TLSH
T12B156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 862KB
SHA256 2954c1c91d018232c7ff997a5e328cd6fd3499b319a60cca2105918900fcd758
MD5 dc81a100b8c6ba7e405806b8316dab97
SHA1 2035abc93cfb1cfd736d4b89b7ee0e0ee32ca5ff
SHA512 4dab3a56c0f314c48efe478cd679cb32986d4615aae3aa67e0a0f143f7814a58c92340d2d7fed2d755ce70991e360e5d0a678ae2b43ffc0e31b1513976027bb5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZ0+:A3k03kB56rJ
TLSH
T182156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 862KB
SHA256 400f147d0aaafcbfb7ad69b215037f0b59e377c3077c0cdf7516596be4476f32
MD5 4fa90a7802112c126013c64d99158fc4
SHA1 903478e18b212bef0f7d0d687d0bebeac2706543
SHA512 d5734aac75aab0b715c73c57fead408fbc547c0fabfa5887923bc2ad82d482b107a54385e0a9ffc578f7040ad07c843d7d8949536473609025bdf55a9cd4bdc0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZ8Q:A3k03kB56rZ
TLSH
T1A8156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 862KB
SHA256 b80c24c5ec6695dfa4518a6079f44653b33f58226635d84031ae7afc57d602e3
MD5 42d05ff2b273b7c724fae4df53f413a3
SHA1 5c3f840dbe12850b48bece5da57bc105967a8c6e
SHA512 4a3db8b3eb924aed37efd33800862ef593290e69fd98108cbe18d8a6784c280e0faaeeb900121b9e29a6e716260e96f9f6ad9b6743fe0421c24ff31e0beb7f92
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZlX:A3k03kB56rF
TLSH
T132156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 862KB
SHA256 8e8f5c6dd46ff1b704a90c003d295d275c1692f722fdc69d93a91a3056f66efd
MD5 79f4a9ebd38498d8b7036ef09ecebd8d
SHA1 f1ceb521b6f8b0d8b00f3a3230b5335796b8309a
SHA512 e2e6c3bdf051199492ead1d276776b9514df321ab331687f427f4e6ccecbd923531ebcd572b9674d8e9b47c50dc57697dbfb1aeb33371ceb32854aefc54b9940
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZHL:A3k03kB56r3
TLSH
T1A8156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 862KB
SHA256 0585fd6c346fff50db7aac43fc56afe0d1153f17ee8f8e2bbad8c964ebe750c7
MD5 4685b8f5d03a07a026ba9a37ea82e988
SHA1 baf7e0dc12c87016e8493ce1cca84cb7b77d7d40
SHA512 622b1e6e50003e85df5485d53343e421aa160489147b59237531082f369bd07d9b8cc6520ebea60120d06fd3213e7c6c281f51b6e5f3e6f3ee759c7d3748c261
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZ9M:A3k03kB56rS
TLSH
T19B156A17E6850FA8D00FC1749A958662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 862KB
SHA256 eb6e967d5140d51ec27d2bf35aea45ae536cd5ab01e6a76e0748a66a5673782e
MD5 bec8533bad1d9a456f4bd1b621f4e85a
SHA1 1a24ea826ae47814b0953e66abb493c8c06938f0
SHA512 0a94f6484b86399a10f67d5d21b089ac543a3fbf69d0dc249c233b7c3e2fad4f0fc3a7ede67fe926a9fc15fade4c9f82428664063c3dadc9ddbbde69f497b0d2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc6hZuh:A3k03kB56rM
TLSH
T191156A17E6850FA4D00FC1749A968662EA737C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1820-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5872-58-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5872-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads