620265231e8eeb982ec1228a76866c28d76364641fa5dabdbcf77a63321a3db8

Analysis

max time kernel
108s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 821KB
Sample260814-23cdwsce46
SHA256 620265231e8eeb982ec1228a76866c28d76364641fa5dabdbcf77a63321a3db8
MD5 be6e4d2e37ac9871129df6fa265b618a
SHA1 61dcdf25a4ca55fd7d70d5f74e9aa54f7a3901d3
SHA512 ddd5d0cd00809b46d1c87df66008ad904e51bcca8ad9a96c8957d7ff4df1822511ec1309c64a3ba24935b74147edf45d88767aed1129764779f3c96bc26a4564
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGf:A3k03kHRJt
TLSH
T15E059D13EB9500E8D10AC1749ADA9A32FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4300-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c511-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000000043e-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4300-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4720-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001897d-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a57-209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-594.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-632.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-681.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-755.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-847.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-860.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-939.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-958.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1069.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1106.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1156.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1349.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c511-5.dat	aspack_v212_v242
behavioral2/files/0x000300000000043e-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c8a-59.dat	aspack_v212_v242
behavioral2/files/0x000400000001897d-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a57-209.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-265.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-392.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-502.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-594.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-632.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-681.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-755.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-847.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-860.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-879.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-899.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-939.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-958.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1069.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1106.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1143.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1156.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1349.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4720	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4300	2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
4720	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_be6e4d2e37ac9871129df6fa265b618a_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4300

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 821KB
SHA256 620265231e8eeb982ec1228a76866c28d76364641fa5dabdbcf77a63321a3db8
MD5 be6e4d2e37ac9871129df6fa265b618a
SHA1 61dcdf25a4ca55fd7d70d5f74e9aa54f7a3901d3
SHA512 ddd5d0cd00809b46d1c87df66008ad904e51bcca8ad9a96c8957d7ff4df1822511ec1309c64a3ba24935b74147edf45d88767aed1129764779f3c96bc26a4564
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGf:A3k03kHRJt
TLSH
T15E059D13EB9500E8D10AC1749ADA9A32FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 eea4d8db61fe5b32486139d65123a399e8d248427e19011f06e36108a8b9f8fb
MD5 cc39411ffb3e97806e1fa22595c16873
SHA1 ba00cbee45404d273abbfafcddbce7b4b11a807c
SHA512 d7ee81abf5db67bffc4e2683d312fd7d4832befe609436450cb359df70cda5e931dae7b0df622b90f73581ca55977a89bd610d53a243d9a3a7065a48d2e0c599
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGL0Le5ji0hmxNrM:A3k03kHRJ5Pji0Aj
TLSH
T1BA557C17F6A402B5D027C0B9C6D2966AFA713882173096CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 869KB
SHA256 12c9bc41623d783f32767c0e933c331919ef52d8a7e7034b082ff915e5264a6d
MD5 94aed1b59629b5f1886c828eb087a238
SHA1 2553959797a7c5a823879a2a62d3ea89cf224e9e
SHA512 4f683d1531dd6ee28d982a8259be07e9c105d24a7572c1c060b1f4a09c9b7e8951d35170f2041ad4447274fbe8fc9604d7286931c4f81241de9b5c16adabbf11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGub:A3k03kHRJob
TLSH
T1C0159D13E79500E9D10AC1749AE58A22FB75BC562770A3DF2358C6152F63BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 845KB
SHA256 5d6c0f89c73c74a5b55616f59ef285ee49d9eeacb3d746331e0cf6bed7637449
MD5 2b2732b4255daa808e9e0433fe1c5afb
SHA1 fb17952085cbd90cf58dc67bd2af169602c58f92
SHA512 3cfb48ac6680b11f16de032c9284b03a4df7881187b0bba0a52de981f4cabb5911509287f0b65c79682cace493e7e738454210adfdf08c569b5dbca8f771c065
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGtZ:A3k03kHRJN
TLSH
T1BA059D13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 845KB
SHA256 0e99281326f74688ca44b85688f8a5fe088bd85c14699bace704a4ea44643d22
MD5 19bcf20f26114d30b9f437bcd902596e
SHA1 99577d89e97ee69e4b699b17bb743510df4dbd27
SHA512 2dcd4e85bf85e51bdcd41a312dfb3ebeabab672910220d6ec980f22da57de8712eab802bc5a46878004b4ee01cec2788ed1bd1a80ba789104e341aa4e8695c2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGW1:A3k03kHRJq
TLSH
T1A405AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 845KB
SHA256 f0c1e3230a93af1fd6fc8eda5ff58955c919f5226b7bd71189028671724889d7
MD5 9f816873289306aaf857e236a61d8ee5
SHA1 e2db0cc0e3f37cee523479b4ad72fdd464bf00bb
SHA512 571b8a043c49a4ebdc9b034c962a9620c780c3494d268c0a8d325fae2ba1f8cb4edbe3488d76bb8057b5899f64aea771df0d95daf2bcd9b182d961551e9c8cc4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGE6:A3k03kHRJF
TLSH
T11A05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 845KB
SHA256 e7434cff5a9edb6fdf53c8371a8954dc669f057f5f4586e9d47639189038433d
MD5 679ba5544be03411dd24f2f06747629d
SHA1 6bc72bd71ff4e63571e238695613917da2584343
SHA512 b16a8d718cb770044fe5880567d9a2ea8a363a69db8c6e297c00a70df4df52be1b7ab9eb152b1cd7faeb469b99144c021c69639de23db9c55ef483f5b01d361e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGOf:A3k03kHRJ0
TLSH
T1BA05AD13EB9500E9D10AC1749AD68A23FB75BC561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 845KB
SHA256 ab881a220d54a5f87f3f39d4ff1cfe60c50a552d6bfbbb44fdfeb120f36dc5cb
MD5 13f99d6be70617725285af6b480d4902
SHA1 22742e14bf24bbfebc3418f48396474f243a55b2
SHA512 91f780ee6b826ee48b1e7da9df1227048c255d512bc66157dff1356bc43b98e78b74669d373b24bd8fd07f137ae197c0c8e704c5c970cff18a438655fa41192c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiG4o:A3k03kHRJJ
TLSH
T12E059D13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 845KB
SHA256 d38e827749ac21d84c654072d181260f39b6796b787cc94c82247a36dd3dde50
MD5 abbef7c3b17d14231990a55ec6037be1
SHA1 ed62864a870b4782d495578f0800f690af6d243e
SHA512 fb27144342804f77724af0486ef96c3778b5347b4c19f60db74bb546d3c3063fb8c12add1c797f9cc0d3d6b6a850004ab19030c7ccc8efa17b30159c79da3722
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGIu:A3k03kHRJr
TLSH
T1D205AD13EB9500E9D10AC1749AD68A23FB75BC561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 845KB
SHA256 765a41043272d9e78472aca8da785713ca91e723d8d6958135908aabec1f3b45
MD5 5dd79695738de6649dfdce9d86b93bc9
SHA1 e9df3a72fa42356f5144cd8da6fd03724c504ac8
SHA512 3f7b57901fbdf64f33f2000d187b4fa1a5b534214c28b9434b654ea718dcbea6f89450a7cc39c7029a47a564064c431b33186308bb4b5035ed9eb1315c361741
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGc9:A3k03kHRJK
TLSH
T1F405AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 845KB
SHA256 6c3b97519d82b1bbd93ed1965b009bf4338c96eb0b728ae6fa027d30d59ea4fd
MD5 125a1d8ecadcfae742e3080e591264be
SHA1 b9705c9003965f08a7ea6811e649ce6277354b3f
SHA512 96f48e6f6b6320f24473ef51efe914ecdcc23d5864d2d4ef27d51db7a49662ed63d2d72278c717bb93cc49ecd8ae73593ee2da223af06d9d5078a700e83a814d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGEc:A3k03kHRJn
TLSH
T154059D13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 845KB
SHA256 5722986cf9c0dfd110733e0d2c3ea64fe115b4615fff373466ae1edbdd0b9af6
MD5 73e908b808f394ac84d7d948e7310fd7
SHA1 65cda2742f4014a9331911c8f157f083da9ba230
SHA512 e7660fbb974fe5ca1125e728a2010414a2e3c23dd66906a63dc02e37a6982bf51205c82b9ab968cc2999ee86751ea8da065d4565a1b18d8f4f6a948ed8868187
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGdp:A3k03kHRJ9
TLSH
T19F05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 845KB
SHA256 2de36227abdd5f713c5fc17315cad7a608e6fb06949f42081d695107e1d844be
MD5 ddf39ef66ba79c386ffb4da87a14b743
SHA1 16ae7edc493c99dbae3884e4b668974e52eb02f2
SHA512 c5bac638027f5cd882b1084182710c0872b429664145a5d2b5cf0cac4471ea4aafa65feec643448555373baa2a6cbc1b086cef70bff5cef2c76aa0c76656d433
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGiN:A3k03kHRJG
TLSH
T17405AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 845KB
SHA256 cf7e01608ed78b3830252f40082c00f7442b4266b87d9f246201621a986466a5
MD5 3a697460b5ffff532f86e86d4fa77d76
SHA1 7e20cb644a978a75cdb7e651fbf907dda34e309b
SHA512 0e42aea5045de8efb67922947e21bff4f7f4956afc87cfdea4c01a4b4b8c0e9ae03efce6212cad3d2a3b2f716f28d1ec4162f77d7bc7288490d2d568befe234e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGGF:A3k03kHRJk
TLSH
T169059D13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 845KB
SHA256 1ad26fd2c6f8870458c9a4b720b0f9bdb5c12b6be4a63595bdcd9697c678c11f
MD5 3e55ca0ffc03a9119283792e6f708d8b
SHA1 c5aac57ead967cd5106a3de4e859af30879145b1
SHA512 cc916c1d7e844f82a54fa33af5916f9304e8aa4b432dbde87b83ccfc85726d65e4701ff6b19921dd5e6882aec0aa5d2ec5ddbd57f2bfcfe0a2ff7ac2b00b1556
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGTC:A3k03kHRJQ
TLSH
T16B059D13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 845KB
SHA256 2965ef6f0600faa7a81c3a177231f9ed02861d831cac532d7574fa32f72fd6a7
MD5 351395190c23742ada25dd61b4574947
SHA1 27492475ce9aeab64fbd3f00cf3ee83c8ee18728
SHA512 285fd4d6a73199f523bda04a6d838758698c383aab5d1142d700a1f1508f4ea25eb939c897469ecd3d782c941cb1bf882438eb245c691dcbdf5ad36ac52337d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGcw:A3k03kHRJt
TLSH
T135059D13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 845KB
SHA256 adbdf2514d5ccd19f2f10eef74e37b3dc450b308baaa3c90f6fddf5386e50740
MD5 9a1ad01ed042c08da40ac0920a4c4f00
SHA1 f7525fb5da9e2d3506af14087f1c394befe52584
SHA512 e3f472a6f38f95c427a1d7df4914463aa408d5ea84b939aeaa9a22d4e577573c6b936e455ac57e8f7bc4146fd13653c8a3f5fd96878a97be4455a18a29b63b38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGTT:A3k03kHRJh
TLSH
T14F059D13EB9500E9D10AC1749ADA8A33FB757C561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 845KB
SHA256 0673da1321804213d1d2ee1164bf9e2ba824a6261f12b885f295be24c4400687
MD5 4d0b9a844a1836f95a862c97b6dae4f5
SHA1 1982793499fb0f87de45f5b40f5a5c44aa3898b9
SHA512 ea9a653c687dd02d6547958b622ea2716273eee4816378e759e22990e14c34c8664cdec8b476c6c0c1e874fb24b0a8519c95da7077eadd94ff2a93bb84c01e22
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGlu:A3k03kHRJW
TLSH
T1C505AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 845KB
SHA256 c99dfee113a00483e0103419845cf991043e779040b7ba4293a9dd964e6ff7fc
MD5 a9ce99bf7c4a1b3d974a5586c9961fd4
SHA1 f8b5ec8b8fe99dac319691cc55e857b4cc33291a
SHA512 aef6f30f5ccc783afc26d256e362eac59bf8fa9edd69dfeb0b4e9cfc3b52bb7537e40039fe0209eac3968a42c7f8521efc835ad4bd2f1311d68c17aa5549c615
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGtb:A3k03kHRJn
TLSH
T15B05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 845KB
SHA256 2414809519f9e98070e4f8ba7c201642d9792ef400a14d154ea6d3c442b34080
MD5 ad8d8d2b05d203bacf6ada26b251ef33
SHA1 e46391d611a0a066cce02d4f05881e92174bd7f2
SHA512 7d7ce6edb4e32371657ae010589c55bbd300f9bd4fe6c65ea43dadbda90d8e0c5d72bf1f6911c9c37155f5b83e33464ccc815b8f05b9abf481d89d8a30206f20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGdf:A3k03kHRJP
TLSH
T11205AD13EB9500E9D10AC1749AD68A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 845KB
SHA256 3660baec5d5f15850f066a3983759fe778d5a6deaeb66ee81ea50c72ca83bc42
MD5 43b0084c7278f6b687ac905ace7b2acc
SHA1 f2dfa34eddf8891d245e4cf6329607d0edc59f5a
SHA512 f191c5ba7d14fa68976e1fe2a47c9c219552e6afd092da241dd6df96f3d63db9f87812d946aad1a8a4442a4374e3006f63168b32ccf142dcf7891f704c0142b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGGK:A3k03kHRJv
TLSH
T18E059D13EB9500E9D10AC1749AD68A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 845KB
SHA256 024b87497a3728c0ab1d1206eba04332c50311f0841d1658f3ad6ca32c21f8c1
MD5 1fa3f344ec0e279e8a638618214a9b5d
SHA1 1b62cf00dcc3e1ad0da31bef8dfb2b35e1c851e6
SHA512 e013cccee7cf26cc47c8acda046094eb37f905c3fdda1feac87f407f57f1e99cb2d49c2d0855744773e11c2e839a09158b152ad4cc2c4b80ff5cdeefbd1965fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGzk:A3k03kHRJ6
TLSH
T1E5059D13EB9500E9D10AC1749ADA8A33FB757C561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 845KB
SHA256 1315678d1dfb1c7b59193908f95a86e116ac2b62a3493ff398679ba21313ebce
MD5 9c57f0b1d8a695c30fa6bf420556977b
SHA1 a68ffb8b49c086464b020090be190f3b4218da96
SHA512 9f6bed23c44d1e04e543a153f49bafd4c28fb9afc6725a4301911930121b56cd7283463523a5adc68a259a8aabfcb1313446f6952e78a6cebc43b3562012ceef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGE0:A3k03kHRJP
TLSH
T10A05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 845KB
SHA256 c730ae39457375bed2b03f8411165d41fd393994fdd507483ac9c32e47a76034
MD5 d6ad4fad5edc6acd1de6e5dce7d52c8a
SHA1 4b894cd877a119537dabb85b888cfeacdbdadb59
SHA512 807531e70d4c6b98d7fad885c8bf4a832605c784e2bb268fcd631b3a077871f895dcfeff67c582771e5e8f54c9b6ffd0a1ff46957bfdc39adf5858bbe97c4bc9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiG/g:A3k03kHRJS
TLSH
T1CF05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 845KB
SHA256 783e38b7a9b56d98e2ea0a66ffd88b3fcdce0df1a1ca4c737c5c34e9396f07a8
MD5 e63501834c44cecde642bae884b8d827
SHA1 fb750cd3fe7046e49bb3fde363c589872d9b6b67
SHA512 41b4bab7342579b74c99bb774836c590a921f8f57222bcd598d5ae947069370e48f3fc63fbf3a03b77a59231e1ebc496170ee4d0120bb369246b6a2f7537694c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGSr:A3k03kHRJc
TLSH
T17605AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 845KB
SHA256 1583f6a474cbb9fe0209cfed61eded460ac338c257d7b98098b5f0b3b42d9902
MD5 83a1c371b1d83f453b01b35362415d52
SHA1 36a2a1c231765fa0754812e56fb8e9d605f82a58
SHA512 f96355e3ce0fbc937fb300772b71614f918f83a9925a9859e871091154aa9d2e61ebdcc0cf79f29751492525fe9c041bf6a63dda837ca2d6bff8bd07a8bd2844
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGwn:A3k03kHRJm
TLSH
T1D305AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 845KB
SHA256 7e2b7ad5c419a9b3bdbfe97a13a82f81e3d14989b034320dcf75415ce1752938
MD5 23950cb65b6ccbab0244aa339457163f
SHA1 e7fa7fcdaa85c0bacad7d23a6706462718b64268
SHA512 7044a99731ba8797e2ef3cc1f44219ce755024c9f2a70b5d2ab469b14a48aaccf519c0159dfb910e9256132b70e079de2eb898cecffec7b0869b0376a4b9e3c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGOx:A3k03kHRJ8
TLSH
T1D805AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 845KB
SHA256 c46997794d622626211347571474eab16c7118e53c0f1f30cfb7a099626aafa5
MD5 26f35c61c8d0a575a97a845404765b6d
SHA1 a5793c9a5fa85f5756c79c090365e6c2454f6b25
SHA512 1e784733f8a5f5e7213c34016f02a6e6ca27e3b32f880fcb16bb968e854dbc404bd0679ffc37ba67d745d04423ff547c80063f6a81ded520538ab1a60e065d58
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGoA:A3k03kHRJH
TLSH
T12C05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 845KB
SHA256 712ea62ebd120b086893cfcdef200a383acb2e8362977f2f1e7f68d6b2f6c3b2
MD5 2200ff42cc8112ae5efe8543af320854
SHA1 39e551018bcd2edbafbeb239224b236105d809cc
SHA512 064503450932496e9275515e8dd36f501fe3f0128197f8ce0f451adcd4861d202efb548fe76bf538d58b25219bc1c1e9170abd6bc1a560127bfaa02fe933ff15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGB9Q:A3k03kHRJq
TLSH
T167059D13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 845KB
SHA256 27fe0bf1436388c48cae56c585f928c276bcef13043c62e724c8a80591cf9d89
MD5 5b913ff4fcb5c4c0cb2d424e6112dd06
SHA1 7db90c8a2ee936e8f5a207131cf6374c483c5f71
SHA512 3701ea1a97edff4226817d7078a0acf3e7de9c5696cfef4d0602a8bfdb1c6db0ad3fd7a720039c1964e1c8ca48953b0b31d6fd5638f37db009b33b3d8f3c9a25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiG04:A3k03kHRJp
TLSH
T10D05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 845KB
SHA256 a1670cb02bdd36f452c9eddf272087a53e4d6d43d24241064645708293c2a131
MD5 d38ccdf3cc3a459edd4ba25dbf89c67a
SHA1 953dd5cbcc70f323de55a2983099e2dc40e5d74c
SHA512 203c4293855eecd4c3c66cc7cbe0928325877377b78c60a16c36ca8571df8763de39fbcc974e9c84f9f3160927cebff1d5718de39804777d127a4dc783ad7f80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGfu:A3k03kHRJ0
TLSH
T18505AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 845KB
SHA256 a561cab101d371d12124a808844660c338bef4f08aef37cfdb736edd52a99de7
MD5 3f9f994f12bafea8dcc1643c0ebef2c0
SHA1 edd4b3d5cba0eefff00aaa06aebd81537eb840d1
SHA512 41f22679b3d10dc51365b4029fe51abd2756535f441075e98cff71a2f2ea43e61a0405265f54bb4db629e3bcf30ca11a83b5e7ad3d162193948c65c9d28a79f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiG6j:A3k03kHRJW
TLSH
T16005AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 845KB
SHA256 293850abba4b503b43fd037c0917a68d94f13303c3af85cceaf274eda0dc9caa
MD5 cb42c56cf00553aa4a340696d7146f6d
SHA1 284bebe63855f9f3f69b198bd92bbb46ec8a2641
SHA512 425e4af5de633bdfa96aa36fe1a2a2635479c4d140e0f62a9ef994c0e51eee24f44138a79c08d461d52cf054a5afe4ad4274927b560f0987cf0391c101d3ca06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGng:A3k03kHRJ6
TLSH
T13305AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 845KB
SHA256 3b5ff2d6073a8e795021bfdbb7dca040c6cfeb50678cddb8dde09b74a29bf61b
MD5 1930e69cb5d1d89424c6120142bc9088
SHA1 18b2128c46e66982df7cf425afb4ef99f4c17533
SHA512 80fe96d9fbdd93d9d1408cdbf8e2ecaa083c8ac2fca201a37587e8138597e79881421fcb9bc91f5267d8c1e7e6e329d705b44a4d429c5373d7bbcbdd3b461f04
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiG6I:A3k03kHRJ7
TLSH
T1B205AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 845KB
SHA256 82f31cb1b2aac8e07d1def413dfb73b9b28bb9e30d8e7f4f4010d4759f5fa141
MD5 075ded1b22d0ca258925025ca582bb1d
SHA1 f614d1b715863a0574a55a0bf215977cee17c6f0
SHA512 f8ccc437606c22f18c4364c7cc1f205ad34cbf11331b6905112e056910c0bfc42be5ba2858b16876c73b3a097b36e4682160e728eaeadf5e4a7b3d24bebda853
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiG4o:A3k03kHRJF
TLSH
T1B105AD13EB9500E9D10AC1749AD68A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 845KB
SHA256 83fef010a7864c982c24efe17dc7981ad9a2a632648706ac491d7dce8c9a7b92
MD5 7d2ccd6533b5ea446607f6aaf54d56d3
SHA1 1c79f4673732dfc8bb97b89c77fc8f8ba3610dd6
SHA512 cefcbd856cc28273f755de6b1df44df4d9c20d2abe69654329c3fc098bf1537aeca649a6f45321f675398fe58a3dda0272be7fbb5199325b689e8bd2aa7a5c81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGL+:A3k03kHRJA
TLSH
T1DD05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 845KB
SHA256 897f9315494164aa0d0f26649f526417bb6d0f444ea0c2819ce6df16a7a6ccd3
MD5 882e66a89ac635b0f43d7c9537576619
SHA1 1aeb14f4fa05704e3338454954afc5f6073d1b29
SHA512 7061d46f1a40ce09c9dd5d51ae2d0a18af36d2d52cfd339fd29fac9cc179c377824c72288178fc95927d6e236213fcb33539ae460ed056047e3761a908c993bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGBQ:A3k03kHRJQ
TLSH
T14D05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 845KB
SHA256 2cb32da9941a650785bd92e39f62300ec74a146d6714288e9f2c43cf68671267
MD5 7af96a91ced4ea6ee7673e2d191baaed
SHA1 4e49707285a2461a7aa662a83729314f9025937a
SHA512 0391e95432dd7eadba134dd11099b8962bfa4573368326c8dcba0bc3de8ab9d3a8a1ef0278923516a5d0614d1cd5eb36b65bc9c17194c3827e2e2e4813969cd0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGGX:A3k03kHRJg
TLSH
T1FD059D13EB9500E9D10AC1749AD68A23FB75BC561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 845KB
SHA256 a759cf03d3d8dcbe6d56ccc9e508b0be1ab99e3164294e54aa79cc069a647b71
MD5 d5d30a5ccb5c2f3f6c42ff07352ebe72
SHA1 62a1612418c9fe78adc51d7021736f8674d582fb
SHA512 66dc1541f903808c63f4bc23e92e45e8f994988495b5fd56f680538bb040dba41f6ca072408aa022102c68e6da41ee1c56a87a1f16908342d1577a7c8c495ae3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGAL:A3k03kHRJC
TLSH
T14105AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 845KB
SHA256 ffd3e65941b14bdf3d7c3dc540107dd7416ac94aa8505a945f35e2c469fa1cfb
MD5 9c90563cb219401a8b45b7b1b67909c8
SHA1 374f022a95471c8e22d028ed495906c1581dd126
SHA512 58638dbfb82bee73e8ddd4bde9e184120b19f2c8caf53ac89dd94f270143e3ea17ef5cd95e99bf1bf6a7b2ab4c77d7c52cc50249ecc90986a4873148718051bd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiGsM:A3k03kHRJP
TLSH
T13005AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 845KB
SHA256 34c8f2fa4c1cd81acc2e20e1e89efcc1e735a11f2491b1c3876494eb81e6ae2a
MD5 c7b183edda40be64082ac76c8742feb1
SHA1 269adfa783cb03ef05203f07bdecc917cb08538b
SHA512 fd46d1bec36b84330efda66f025d3ddeb84ba029b92829b5dc0c5ca7122ee337109b278a898ffa683a80976523b67e97e08b6486c8946b9cb58bde8e829af6c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9tAiG1h:A3k03kHRJB
TLSH
T1A605AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4300-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4300-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4720-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads