8ed1ca6fb9b7a18cc3c4b9ff3ed80a4050d8dd833f0245e712814c9d06729dce

Analysis

max time kernel
102s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 839KB
Sample260811-qlft7stemc
SHA256 8ed1ca6fb9b7a18cc3c4b9ff3ed80a4050d8dd833f0245e712814c9d06729dce
MD5 f81383b0e6d7e530efcd34c5e11192ac
SHA1 83e9c555475d65019f344ebfe911e7dc9d6e696d
SHA512 bc3835806f92c168a61c0aea657e3fc2883b4023e27c854ff60d437b5e1d1373bc259b49968e1a0bd55edc835397d620a05b9f26b7dd47593ddcac624af1c1dc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99p9:A3k03kB56rK
TLSH
T121056A17E6850FA8D00FC1749A958672EA737C025F2093DF2358AE153F72BD06B3A697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4840-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4e4-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4840-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4152-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-544.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-722.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4e4-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-240.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-259.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-440.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-544.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-605.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-636.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-722.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-742.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-791.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-822.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-853.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-872.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-891.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-911.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-931.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1006.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1043.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1080.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1129.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1148.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1218.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1366.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1380.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4152	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4840	2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
4152	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_f81383b0e6d7e530efcd34c5e11192ac_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4840

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 839KB
SHA256 8ed1ca6fb9b7a18cc3c4b9ff3ed80a4050d8dd833f0245e712814c9d06729dce
MD5 f81383b0e6d7e530efcd34c5e11192ac
SHA1 83e9c555475d65019f344ebfe911e7dc9d6e696d
SHA512 bc3835806f92c168a61c0aea657e3fc2883b4023e27c854ff60d437b5e1d1373bc259b49968e1a0bd55edc835397d620a05b9f26b7dd47593ddcac624af1c1dc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99p9:A3k03kB56rK
TLSH
T121056A17E6850FA8D00FC1749A958672EA737C025F2093DF2358AE153F72BD06B3A697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 61f43de1081e1d7a17ef7cca4493300c335c41d58bdc78e1b1d233bdce9aac1e
MD5 aff056196fe88b73614725e1aa2d7942
SHA1 479942c48707a1fb4de365f58e992d0f2050f523
SHA512 0fa0d5f980a67c75b27f8d6b61e214dcb683a272aaedd8ebfe2559cff407d751b53a989c190c790d928a02a4efaeb21853aa5a2e59bd643be83a326bd6aef2dd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pJ0Le5ji0hmxNrM:A3k03kB56raPji0Aj
TLSH
T19F654A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 853KB
SHA256 32b053dc8c0bd5ee39d1df9b3a08135e65fd49e7f2d0aaa90e1abb853f21faa4
MD5 a203ab71ade5fa80500813b6c25f17e5
SHA1 2eafaf98c3c81bd29ccb3d4efcbeaeed24572aaa
SHA512 f82b73b7d03d490e867084e5977e57916ade5b8863a0d2224a3e77eabb07665a45bb6daba73c448c309c8f43da9791ea2df6297794aa50ae4277d5df021f90cb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pba:A3k03kB56r
TLSH
T1DB056A17E6850FA8D10FC1749A968672EA737C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 862KB
SHA256 3063e6a3404353ddf20e34fd33a7deaedbc9a1cc346f152699eb401c7f461442
MD5 9c64bea26c792ccf421207fedbd3255d
SHA1 7ebddb673a632fc0638fb7e4c55ba3263bc14fa5
SHA512 1fa355d02a9d07b49ba130f4483ac208f70b9bf1d63f51705ea5b13277526d6a1a6653bab3cd359ea7c405a10f00603fa91b8b2903fe2a38dc67eb5ada310dc5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99p66:A3k03kB56rk
TLSH
T196156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 862KB
SHA256 a695a0864ad94ecb90fa004605ba59fffdf5591eec8ffd4e6952e7b575b51e92
MD5 11b9ac071e91eebf7a04b3400b8ba79b
SHA1 90906caf9074fb1db8210d7168e2884cad753b72
SHA512 2afc7b625bd95976364b972921248b7ec4fe9f3b171bde1ca28fbdab36227c0f75128e4125d00a1f9f0e13225026c2a637efa366236c5d1bcc48b92f47a3a677
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pyN:A3k03kB56r5
TLSH
T1A8156A17E6850FA4D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 862KB
SHA256 fc87a2540492988036c5536ffc9fc596962d223048e2d7f54ffef45a5d06af44
MD5 beab80bcd29be6af39a51b8f0d35961d
SHA1 44adf791a946e2ba2e45e81d3264576a4cd657de
SHA512 d7d6082aa81e53133c8cd0c968d14c20781ee0f18c66f9c2bcff98ba8e61964fb31769801a47e6cbf5159ec7dc10220e39f7b2afda85f4fe3c884fc5dcd72823
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pof:A3k03kB56rZ
TLSH
T1C0156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 862KB
SHA256 604561674613776da3c98d4ca94e129fa2ce8d270b33c2f56970b33e331da9fd
MD5 f6ac5850308cbbe40bf8e0d3a25a3312
SHA1 ef4f69165f3ce221f9fed1a8aa8d999f847034dd
SHA512 7b59afb66965798ff5ef031c95db8f0e4f57e0d08ed443fe71a951e54d1ca7ead5d31c42c517cb31e7cf9fee03a546e8f466dadf3789af0881bdbe1e1cb06742
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pCo:A3k03kB56rM
TLSH
T1B5156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 862KB
SHA256 57aff739f3bb0cbfc8598ad812deffe20095c47d9d881d472407ef2bb3c337d8
MD5 348ec4332dbe357f218e2471f9076222
SHA1 fe9d2a44163a3818ea45d7f7e6663e53bd1aa7da
SHA512 03f5044e430ee1677ca6fe0a22cacd06e3e1ec4fc9aaf6d1848ef2e2c39ac66af2d02f278b41e97b682b9b5fd4dcea32e9dae17371238bfcd8875ff72248931d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99p2u:A3k03kB56ru
TLSH
T12C156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 862KB
SHA256 3cead65cc5954c7aaec5139272fbc09ab73e9057158cd1df18d405eeb985e80b
MD5 8a21d436b2f12f760bd215b05acfb7e2
SHA1 f064d66a5e2ccef3f5f1ba0599de8f99fa4c909d
SHA512 71a4261f5ecb2954e608df3fd0673cc05a0f71337e7f3c6b557a333bdc990ef78a2931102285d92a798da5c1ffa479948b1680812f64b6b1dd327df160b36997
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pq9:A3k03kB56rP
TLSH
T14D156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 862KB
SHA256 375c988fe684765536a6926b32d9836cc6cf782a5fcf87dd3b9fdd0c721b0f18
MD5 b5064adf1c6a2eb7cc3d3015ba38e52c
SHA1 0038f0b7e3e3a068126a69e21e8b81022737698c
SHA512 25341d7149ffdb3177017af6bda2fb7019b43e9418c2fae8cefb522e2173dec949b386aa08f31e1a7362e3377dc822f6c0192f6ad8f6e4cf3d30c3a059d371d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pqc:A3k03kB56rO
TLSH
T19B156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 862KB
SHA256 e6603a4c438afe058100fb66b66bcbd49b577e07ec586425324c3e280e15eff5
MD5 c70ac17b1f72a57f6098b8c48e8e34e7
SHA1 a36a23904a920fed1fe0e24c61d5af8be7c0d8ab
SHA512 a1acef29d1454e3bd6fb99765a9b7b3c352a1538796d6a42c936cab6fe0f4a39abc83d97748b3b8b0c80fa59971cce354a2199c5c50e2b3c6b7ccc81b5af53a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pjp:A3k03kB56r8
TLSH
T181156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 862KB
SHA256 3ab2fe84919fb566613573d222637eb78192a7c34c8e440fdeaf06bf0c1f70d1
MD5 c1becb684a06880b1626979487c4b60e
SHA1 60cd892f7862b011678a0848dc89fc36b71990f8
SHA512 c7b08872b65550d67ea750901cbcd9de75276f0f89aaa69dad74228b15f45c5186d8756432c5c2d1b946f66b5ed493a4cc4318e809483cd354f1ccfae28fd7f0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pEN:A3k03kB56rb
TLSH
T124156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 862KB
SHA256 d5d932df34832c3c804d2a117591d48606de01fad23f11374e936ecacef120b3
MD5 39ba370eb228282e38ed64ec7e706d50
SHA1 6307ebd997551a7cf1c15118ee80dc0f14b88a12
SHA512 6777879ae576c85d5f5d029cd61d31c0eb7b663ce1aa2ece4e381127ebbb8ef01ec3b6f0b277aaae42c4d8d116d5eb8175786ec2ef3fcca6acbe468c3ec2dcd0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99psF:A3k03kB56rN
TLSH
T144156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 862KB
SHA256 1839cc30a976b4e3b2ed4d806ff430168a883dcd29ba3f3ed76cfe8c3b4c3e66
MD5 b0185c22c30364a793b7d504ab9e8254
SHA1 b5f401462eb97c6d2ddaa54be910b8196610d4f9
SHA512 5b2f47a16a2c6aec5a2715df550e55fe2b8be8ffe9689b23f7a5c8438211fe2f3400d87c5450cefdf42fb70e689a0b87188ca9dce8420624f7003cbb0ead09a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pZC:A3k03kB56rx
TLSH
T1AC156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 862KB
SHA256 5863d922632f54f56c72d449cc9562c55d969b0076fc3b331b95a840ffa83c00
MD5 67c05824c6a127986a6e308ef485d69b
SHA1 52939b195bcf7a898a414e17f794851babce061e
SHA512 e8899b13cb5c0d2173e9efb3560f8fd160326cbddbfb1f52741ab1b3ebc228f156f41685edd6018f2d35409fb781c3b6c99978891530a83a312cf9c0add94ae9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99paw:A3k03kB56r8
TLSH
T1AB156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 862KB
SHA256 c64dc9c8d46ca853f6304f392227bdc013ad973f99851aab92d728f7cdf6ffd2
MD5 e78129cac75c903578e57d84cb3533df
SHA1 454efe03f575b7c19dfce2fa1e62247268cf958c
SHA512 edda1bf5d98eb6fc3e923a30e2124ce1032dbfec5c996aa8d3b287428ef186f5ecaa1cf99c1acbff4bfbba39ed6de8277946927f0749af5b902e7f5918e017cc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99phT:A3k03kB56rk
TLSH
T1D5156A17E6850FA8D00FC1749A958672EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 862KB
SHA256 dfeefd08dbd5be1567dac007af55a6f5b9dc9fa059e119bc26f803cf87196859
MD5 3c343a3d98aba142e481965d559152ba
SHA1 eb47faa3563a597d03711e92f32028546fe60b99
SHA512 7694740d5442ad28c677a25ac42aecfe43865337a0478fa80c0ae8145a406a367e6632f107257dc2800e873102c86bccc268b6c965be34c118cfbad291dc242c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pPu:A3k03kB56rT
TLSH
T128156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 862KB
SHA256 83cd8d2a594d3a104b7454cc8ee445e84e02df981c35f2e398ac25842f630417
MD5 f6f4faff1028ca63ebd1db3a24802d77
SHA1 70c4b855101836dc6933b7296ce5d1684872ff70
SHA512 881cc09b8322745d5970381918facd8b3621f0d5c54af91744ddee0e121f78b265ab46cced9498dd1ef582398343baddcc83046c00be8c38dc5453ae1c0ed96d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pzb:A3k03kB56ra
TLSH
T167156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 862KB
SHA256 60f01b09c03fcf1ea0a6bc5ff4d0df078679b35e16ebf28741d30f7aa305a1ca
MD5 a0d327b99bb414580602fe0a53a54dc8
SHA1 9d1a81f9618d66c27db4f5f8bf0b59e8f3ff2d3b
SHA512 f1476947ae53d27c1bd862153d25dd05557b27810448329d1423cb842ccc5387bc98028aea1164e0c921a4256c96ee025f4716644269dd262288c663be935a19
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pHf:A3k03kB56rq
TLSH
T10B156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 862KB
SHA256 59e5969f73e7ecac2487e1405ba77633098fc84d6ddc3c7d096023cd10bb2b74
MD5 417e77f4cbfd196a08427238638fbc98
SHA1 0e1d676257fada5416798c04962484aa1d849ec8
SHA512 6c8a05fb784945f96449293fe9a160d4bb4c5be5297d9f623fb2afe3de2f3248e695fec224c05d63ed53f58fe879a894c03a74ae73ab7b9bb9b77a5ed0c8e58e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pwK:A3k03kB56rq
TLSH
T11E156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 862KB
SHA256 0f7da89dcdaacb102835d252436d1a5ab7ab727a9dc36ec7fd9664f8d4ee93ff
MD5 fcbd560009776b77fa15dc0e026840fd
SHA1 0d49b6934dbd16ec75510cab406d4658ea99b658
SHA512 9abf72113c0aa43c27eb867667389da81eba9cceb1b0864a000f209d030e091e8dbe3b801cbdd89a8dd42ad4eb975f70d71093b5236984f8d26d468e76fdb61d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99ptk:A3k03kB56rP
TLSH
T153156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 862KB
SHA256 0fcad0814703e19c710f88ad2750d82836f5e5d0a1e97c87f0fc7425150f5e11
MD5 7804e65affb9e70e46cb35b1f2a3d7e2
SHA1 3bd86467475f6d250b6cab1587c153999e9f4a61
SHA512 6631be37029e8c8d732328c1ef4a59646f03b5efffb3c9391b97695493c370a1826a185145e22312e91344a22edaa60437b606f98ef1500863cec2d8bcaef86c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99py0:A3k03kB56r+
TLSH
T141156A17E6850FA4D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 862KB
SHA256 20372f6aa1ef180fcccbfc8283bf3c898dd2057ced9870370a812444291a8644
MD5 7fd65b8ef914d34c3018b57962a6f3b3
SHA1 18a23b72fdaaa9660a999de850fb8bd3d0df58ae
SHA512 861b2401998439753d2136dbd12dc232acaa8f6221fb8cb8196b73fa2cc9c869d2d414b54b3c864385a4c11d085a332772b80f08405765ef48b2520a51a3631e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pBg:A3k03kB56rn
TLSH
T178156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 862KB
SHA256 a90e744f44b9453a604da5988830213b8eaef793c9f5909108fd5bf369888d8a
MD5 6251ad7bb27f6e638c620eb001d7f58b
SHA1 2fca4be0914ee5237c59e294c0d51bf56276d664
SHA512 4fdcaeeb3109b5c00f6c1478d7b763e27fd71a58d63d92ecf3daeb3fcd0957efc6bb851580277d5d916ca786bd6bec665a82d3918d9ecb931c46dfeee037d5a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99por:A3k03kB56rB
TLSH
T1FB156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 862KB
SHA256 b2e1034a2d5bbe9eefa3a40f7546806fabaed13c0613bb36e4f2011ae32dd02d
MD5 22375f66f678534d9a9a16b5661422e5
SHA1 6a89416d0cd138ce9f3de8081829330f4fffa458
SHA512 bb363d8cea7cf5b2fa9d4d681177f6b61f671ae0260c0e50ec0a319d14b28cd9fab587e8b88df71dd22c6c0bf1cab99c8e0da2914ace29c8c73905dd840be154
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pGn:A3k03kB56rr
TLSH
T176156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 862KB
SHA256 9ac09686f62564fc320da89ec383e4e4af893d5bc6d3f74c57c3d12849d09c1a
MD5 6e40b3e2aac9ad35af3da1945a1e32d8
SHA1 c64c7d2b8a7edd3708959116d28898bece81e036
SHA512 d560c03cb467787cbf6c38eb7dce83eb37877b3c2ece3f0d37df763504b96abfe4a48a4aebb64e31ca4b7415cfae5cd535eb5edeefd324be2031fab35705ef54
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pMx:A3k03kB56r5
TLSH
T134156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 862KB
SHA256 4afebcfd113c98bdd637a4cb83906d87828d0ed07bcc35b2753bd40240dc9d99
MD5 5188cc3686c9414ce205ec5bd6925854
SHA1 39073ca10354b454bae47553c56ec39fcb3cf76a
SHA512 2181196ede2cd27ab1f6d8f1d4de181de7b2762249e43fbd41f76218c3d4986e791395ac39904a1a4ad113860394342677bc7c5d8965e8ea9224a1e3687fc66d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pGA:A3k03kB56rG
TLSH
T179156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 862KB
SHA256 8682598705c15a1b285b106c05d651a1e1a65b168d21c4448a2fa348d018c916
MD5 3fb517914cc4ed4ae6fe35ad63056c2a
SHA1 d900cc4030b1824c90ec2a89a8b5711dffcf58bf
SHA512 c17e6a27ddf9c0950a07045459fa0ae31d1af4eaf1e189a03f7b584d619be4e4cfeb824112c1a12cb1fdf1b7a504af3538f096fead305187c436b3ab677758b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pf9Q:A3k03kB56rb
TLSH
T1DF156A13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 862KB
SHA256 1b46495879f57e9a132a409072140a0f7a20acc217cb2db1136ac61fb20545b6
MD5 57b88565f3422af7b241640b025d4277
SHA1 13c8e2c9de3ec80c3daca03837d631fd3126c8e3
SHA512 89838b6e84c3629bc3623577975c498b1a34716034e91f341c95e28fec5bbe5c9c5255ab91cfda4c4814a33e19f7ed451180930db000216ea037288fd6e3ba85
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pW4:A3k03kB56rM
TLSH
T11A156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 862KB
SHA256 6d3d34ef6ce3d7d56dacf0df778db6179e937723d77c59546ecf511df4d6c38e
MD5 0b545d4e0dd9320dc0cb651f1f86703a
SHA1 f1b3a33ebc68d01eb24b03cb107792e6cf28133b
SHA512 f2b11711d4464c554278f0529c3aba742c1607e107c3e757c5b526506e24bb7a1f71c746a307b68475874276bef5998de0210043ec9199f5e775a0d5e4aceaf9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pFu:A3k03kB56rN
TLSH
T114156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 862KB
SHA256 900af61d9a1918f8a42d0ce3c484c6ef9aee861cf9c78f9f306d79867409c7a1
MD5 e874cfec8a4f7fae1d42f528a65b21a0
SHA1 7a6ba5ce68cde67c9d05baccbbe17c64ed571b8a
SHA512 44a94ec0063de65ffe60d67ecea83ca3424337a3603b60857ec90f234fac07a659acb5ee352d3b712c9cab83203dc79fe343ca8dac0d1d59b74e21cdbac32d15
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pYj:A3k03kB56rv
TLSH
T1E2156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 862KB
SHA256 24ac9c14a77c6e40c75d7904100e2b1cc96cc041d5f4e8dd11b4712117f39a63
MD5 30f5ae9a34bdbe587472a2a533123395
SHA1 5720670de3c7cadcfeb1be053451bc8ec498178d
SHA512 b0187e796b7b2aa38e18d2d1afa6a2494010db3f98f9a7198747a949be2f952402f787cfb030d9161fe73cf99a85bdaf13b4b93e8a8bc86348254729161916de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99ppg:A3k03kB56rn
TLSH
T135156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 862KB
SHA256 f9f63ac6b7a9a7a0bacd61f959bd61e716703d7a8d3bf307c27ed01fcebdf359
MD5 38ff3797be0116fe0855e52e3b7b5c2e
SHA1 2ba9e4962f2287186a5f484b8e26ea0db694098f
SHA512 1ff40b85e9ba8e705dc89357dd3fd814cff138b2a1dbf5ea2d7e3ee1363eeed496af75a23767777d714443267def0e64047e7b8b084ca3b6b01fa97b322a6ad4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pwI:A3k03kB56rG
TLSH
T1DA156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 862KB
SHA256 6fc07179b670b1e5b5fc95959b1800a9a9811323ed2afb93b73db75ec4f8ee50
MD5 407dbbbce114a7028bc1b10dc4880900
SHA1 48ed2465cdeabef2624dc0d56e59130084d21d58
SHA512 cbf1e1575700bd35040e46da2e281976575fae33190085a0a293ea50395b941aecadfb072254f54ce2e7770ab87f39505627fce0938c6dcac815d98084119db9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pyo:A3k03kB56rU
TLSH
T1AB156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 862KB
SHA256 149bea5e5d7b93918732358e8a88ab67d3735eff38749b007493c36b43ea1a38
MD5 869979c827f1f722b5ae8740043234ca
SHA1 771095774bd76d5edd2e0b99adb5fae6fad422f1
SHA512 26c77d3c422e8625eb93c2fb451d000f17676b461a6b3772bccc203082d2aad61e8cdb5ebe993c60d015c1a6c8da46c270abee091e7c8b870f40869b00712d90
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pp+:A3k03kB56rJ
TLSH
T1AD156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 862KB
SHA256 9b0155e2073ebbb768459c0258ec06a63170fd2ee6f34e2536f819db1843cc2b
MD5 66bd895101729290f751b266e48d3afc
SHA1 aa7db8966c738b600c7a7c4f88f0f910c1c7eb76
SHA512 2e78090b6f4396392f2fa7351461a5e9b24efa11cc6f9d834b0b8b4195c55189fce425feaa0672df962281faaeaa61a9895f7338e091b4b0933906f768e888fc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pXQ:A3k03kB56rZ
TLSH
T190156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 862KB
SHA256 d85e0fc902a416eaff3ac228985d0c9d257bab51feb022123fe3e8e3e1970fd5
MD5 5dfc6764d7ac736dac964d83f10deb72
SHA1 d90cb9c02c726f6b363803617af6e242ed4e7b03
SHA512 2ef0b5ed9e32e7b04c25089a25cf4aec3268e65d0d3fe368c3621960a8894a25e73c92d4755cc0c6f6a08b5d2faef8055856a7052fde8ec10779919d38dd29f2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99psX:A3k03kB56rF
TLSH
T12E156A13E6850FA8D00FC1749A958662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 862KB
SHA256 3541caeb841118413fb349b1ce904e7e95cd3f3b8cc62b51502f4751fb7735c6
MD5 7cca3a3dbec4c4982e37b698cbdf5a38
SHA1 43e3d6bc4aebfa4ba140045d09190b2721306db5
SHA512 5d20caddde3dd3a5fa361396c3b1429cb1fdc07164ffd52c7a60d896c4783897ab9b8820917e597c35d8bd07f2907006f02c67e3e78e3555e48044b0ee311730
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99pKL:A3k03kB56r3
TLSH
T1CF156A13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 862KB
SHA256 cecc4efadb458da417b211cb733e47889b5edb2f6d6151c7060da10a02b0a0a1
MD5 216da7db990a6fa4a51dd3d7511bf400
SHA1 890cde0e0e78a7ca5fe01da0ae42725eda2fe52b
SHA512 05498ca1185e74b5ad2dcb68c8d2c47506ff8a309fd1809523f7aa56ab20cff66e6cdf6fd59c57c80b706b4d9a95764f57f566ad5e70a5386ea875bff7c7eaf2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99puM:A3k03kB56rS
TLSH
T12E156A17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 862KB
SHA256 712518185c6f5f54dd3898df337b1ca009d3a30304227e47004e1c4458291928
MD5 fb486eeb9df2accce16ba5459ecada8e
SHA1 35b92ea42d15698eeeee9c8bffa40733ec0a285e
SHA512 f6ee4ab8a5185e412c2341f682ed310caf94dbd57f626c3133fbe5970d5eec9f920a0301954620e6bf74860c18e3582ba1df9c7ba39108c5dd7b04c30ef6db82
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc99p3h:A3k03kB56rM
TLSH
T104156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4152-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4840-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4840-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads