ff4232ff15d2185788f611d7a98c22ce1a21920cde38e8ce4f03710a1c4717b4

Analysis

max time kernel
90s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 934KB
Sample260820-rwk3cadh37
SHA256 ff4232ff15d2185788f611d7a98c22ce1a21920cde38e8ce4f03710a1c4717b4
MD5 cb78147aa16e0e2db54d0026251b3816
SHA1 8151a2957c7af6f6930a2957ffb05999b4ae1c6d
SHA512 97f57fdeeb058ec2db643d1b8c069b7c285f5d1f2e5996fc233e3d12721884200bc35f23e1391421e779054fbfd816ca42b22ee94117a1cf8d7522b297ce9c7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JP9:A3k03kHRJARJE
TLSH
T1F315AE17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3140-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b807-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3140-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4160-173-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001b807-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-495.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-580.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-690.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1090.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4160	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3140	2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
4160	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_cb78147aa16e0e2db54d0026251b3816_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3140

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 934KB
SHA256 ff4232ff15d2185788f611d7a98c22ce1a21920cde38e8ce4f03710a1c4717b4
MD5 cb78147aa16e0e2db54d0026251b3816
SHA1 8151a2957c7af6f6930a2957ffb05999b4ae1c6d
SHA512 97f57fdeeb058ec2db643d1b8c069b7c285f5d1f2e5996fc233e3d12721884200bc35f23e1391421e779054fbfd816ca42b22ee94117a1cf8d7522b297ce9c7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JP9:A3k03kHRJARJE
TLSH
T1F315AE17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 4c45271d57dd6846871bb6c6b6d504f416822787b6e362c42d51fb7da0ced139
MD5 6a7105684da340a63108c7ecddb4890f
SHA1 4133dcad9e6abd99f8662ba800747ebc0f2c245a
SHA512 b5de3a2dc1950d102743d5d3b48e2945210def413c1bb1f6940d603088f994d74b69c56a9fc93d9dca628c1711f618d7adb1f770913cddbcae7e347beb4beee4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPJ0Le5ji0hmxNrM:A3k03kHRJARJ8Pji0Aj
TLSH
T178657C17F6A802B5D067C1B8C5D29A5AEA713882173087CF1359C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 948KB
SHA256 186fc3f60ad7da014917fa9c4ae1f4cf48d04ec52f8a63dc5456592a9ea3d94c
MD5 4d12b718f54bfff56acb639d78983fb5
SHA1 a034b35b173517ba53e019daf0395e094605bf49
SHA512 0088d38cac14c4cf7be5191b33b0f4808be007a7cba4436f95235f05c4537c460aee2c4ff4124bd14a17342fdb37a8b9a89bd38989c7f8cdf36ecad1c45d7ddd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPba:A3k03kHRJARJ
TLSH
T1C7259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 958KB
SHA256 6c0734ce71b8240e185e7e37b5f150f4fc6a207714bcb11dfc414019b7489f94
MD5 01e4c1b26d9cddcdeaf370cf54402435
SHA1 7f05927af756ebf4b0bb9f987f477a46b714e661
SHA512 c10d269f0d37e955f11e89d2d57eb70cf5d3659b88b001133b0df54b2039e405216aa6776103b8a4eba531e50f8a2866107f8610c71d422e8436f33d1b7a7f85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JP66:A3k03kHRJARJq
TLSH
T1A3259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 958KB
SHA256 6952322567e4607985395e2fa3a590b1eb61b1a3f850fbdbf872df201f26a363
MD5 e6f22115826debd56727c92926f8a311
SHA1 c1aae9efae62227d5dc0b939258f34332013431a
SHA512 a88c1a4ceae68466b3152b30dca2aef0cbec99a8bf465a39202629f77a04c22738108a2a7dd0f04ca34c5a73b8f6ded48eb201b7182996c0bc6119b8b519fccf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPyN:A3k03kHRJARJj
TLSH
T1DA259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 958KB
SHA256 6c19eaf8a95c275253067a49c2c5d214f0ba5516d9f8fa6ca99a350fe8059da8
MD5 60c6680f35be26f7b6f1c09ff089eed4
SHA1 b9e24c72e27418c3871fc10c240cd4b8fa91cf59
SHA512 eb73eeeba96a96e4cd0de9c4d4f61301fa12860feeb7450a39f72a5bb5ab84c20772c1188393d48a568aedf0c1b32634daee35b480a0b86f4853126805e23981
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPof:A3k03kHRJARJn
TLSH
T19C259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 958KB
SHA256 757dad75caea29b31d82ab5d1bffda4bac2eaa2b50e9735c46f66d872642b9a6
MD5 1b9d6f28bd662879e470b74d18fb325b
SHA1 66850c2ad3bc3527a7bd1feb8647fef487505fed
SHA512 8a873bcb8561f8e4c3785a3ca92ed23e9545a1eb64cfaa2214e38b84d331c27f5d3135102f2fb5e5fc5b2e4627035f3365229385c539a195919b6e22b2d93c8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPCo:A3k03kHRJARJe
TLSH
T1CD259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 958KB
SHA256 009666e11369f3fe12ae94e044bc2d2161df9d43b3384c28638255feeabca438
MD5 1e4107931e409aebb2af7176b1f6e321
SHA1 087e4ff9d0adbe912c821183dffd1d1b9e81a05f
SHA512 f30db7c2d8ebf0c41d581509d1bc4c9ad272e6b7bf21c42ebdb130c034f15f7d83c3d0f3f82a9a87790737a466763025a583d4ea9d033dcd88e72dc08f5d303f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JP2u:A3k03kHRJARJY
TLSH
T1AC259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 958KB
SHA256 49b05177af260ea87fee4ffefbe2bbcc886a332089fd980fdec5429ca129a2ac
MD5 0e63e772bd711ac3824654c24062799a
SHA1 f15e88a22ebf0a76c49f091211657775644801a6
SHA512 820bd275a7ad3f46b124f0644e728c8bd961f96230de9e6f23a048ee2521e917fbd5e2d5e9028cf79ddaa49ed4f2df46a45ba2ca36b3d3cdaffc51dc91c3b102
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPq9:A3k03kHRJARJN
TLSH
T1BC259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 958KB
SHA256 3c5d64cd642d0fc6545de1ff86d3afcde25dc8c1e79f77e3955962ba34768c7a
MD5 25d122e49a9c66f9ea8abf438f675fb1
SHA1 328f9fc2fec9f79a77bda1dbb1da4a9f946c8ca8
SHA512 e0357a4a0657215712611f80d13457756e0a99927a6f882b1ebee904b88d5fdc34d5926a04c47b967bed9ce1fa14ead0ac4d845e4c8d23596e1809fdd1b8d801
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPqc:A3k03kHRJARJ4
TLSH
T1B5259D17F79900E8D10AC1789A968A22FB757C56173193DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 958KB
SHA256 d1b67fe885b6d5a1820fdf2e73a7f6a53b01e341c9677044755a8571be8492a8
MD5 d810af198b409328d944f963b07ecb68
SHA1 7c124adc93e349a6f928b1f65415fbca3d6b3ef6
SHA512 e63a4b172de8454427748f4598e4f3ff063345f16990e25741bc818cdcfff4060bea22e8dc1970031c7c379ce6d2b7e7229e402b5c1c443cf8609c704a1df349
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPjp:A3k03kHRJARJu
TLSH
T152259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 958KB
SHA256 6292f7d513d7dcea3eab02b8df3d0379705eef654318b0f6da82dcd87895deb8
MD5 cf8548ad5469cd37110e6daf03cbc421
SHA1 3f538757b75efb4be3b15f39f3f51ce2b4458e61
SHA512 a565873486b2195dd118ef99491c091646e9f011574ea92100531649cfc032242d2fc28d4c5388f4c3dcafe016547b2ed0f86002a3cdb81b345e65157bbb3852
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPEN:A3k03kHRJARJB
TLSH
T110259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 958KB
SHA256 01c773aac0d851de9a17eb5ebbace3ec793ccb9a7a322e6bd8defbf855ad7d9f
MD5 516e487cf5d738b0b1c02f2fbf27108b
SHA1 db53e78b29ea933277a56890f4ed30bf450d4f5a
SHA512 df7b11af1c8691f3891f7bd4e7223676a415224491109a07617bac11eba75f408c8a5038b1fdd98045aa64fcd420de9bd50242052be38dbf45bcbab6a8c2097c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPsF:A3k03kHRJARJT
TLSH
T115259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 958KB
SHA256 f3f23a5021af3a9c29a5cf01c49a36a80914b5cd00489013965f0fc4b4a6ce8e
MD5 faa326a4fff8905588b0a04e5d7e1e6f
SHA1 c424ec1b1d7b9a23712aded59656c051a99b61dd
SHA512 467d8ddba4c8efe857fc3dce614fa1946208d9e68ba27becca1e4dfc538c632a2cb71346c71f00273275c962e55db360d3d29f9cb4e02bb7bfd92f42f2392337
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPZC:A3k03kHRJARJP
TLSH
T176259D17F79900E8D10AC1789A968A22FB757C56173193DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 958KB
SHA256 5d828eff31a66b113b208146cb9c1912d727870c5f4191c56f3f061ed22063d1
MD5 2758228204250b1c38a19b89cc408659
SHA1 9a9f16d33967c73777597049e767674c719d4a39
SHA512 cbc6a6b491b43faeb6c12b72be60a9e29f185378009fa4acc83e2ab79906e0e0abc8a8114d7397bc97154a6954956047581bca0e390d579b1f8268f0989d5488
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPaw:A3k03kHRJARJq
TLSH
T1F6259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 958KB
SHA256 9bdcff72d810498842e3325f54d02b719f15e4491b055fbf713922696581a4e8
MD5 75fe02768922ea721ea5a43ed57350fb
SHA1 0a6516895b957786eabe0e046ecb1ade43ff56cc
SHA512 2d52d6dd8823dc62776790319601e7f668862d58c003434fff3d4312d31f564fb58b23c53327dc3641bbc098838c24a989f2fc24b0af3eb7d8b58f62bd6d079e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPhT:A3k03kHRJARJa
TLSH
T193259D17F79900E8D10AC1789A968A22FB757C56173193DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 958KB
SHA256 604f35023874da4e4a26718e1e8873d028599fa6e9f2d7c2be25bf2f39826982
MD5 044411544553be98c3334d3147c8cae9
SHA1 9da7e1b2a235e972305f783bacb1da424bd27a7d
SHA512 78a6deb8bd2e7c457471c47465c0d0d93d468664a9f5e167149ee0458eb69560a61924d219f1ca109093a9cc2cb3c499a4410b653a46cbde9435aa65356debf0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPPu:A3k03kHRJARJV
TLSH
T187259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 958KB
SHA256 5f8f0c0b020b38c5fd85a919f69ae9ab39e8e4d4853bf338ee6646136dc3a024
MD5 af86510f03858ce46a4eca1b99311aa2
SHA1 4a2466e9a0d5b64b4b875bcbbc7e2f52f83e5d8f
SHA512 8c1567453c6f1aba83cdc49442f2ee02b54e7175861629085005eb79cd4929dd6ebb4df66e9cbc3457f5b25c5657b7efaf0b35d2169dcf67acfd88a1d63ce9a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPzb:A3k03kHRJARJ0
TLSH
T1AA259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 958KB
SHA256 93934e338fc45d2abb2af025fe9ef34d14d4ddc83e4323de5bf5badb12cfa7f1
MD5 ea3d4165fe285b283a15f9893cd3daab
SHA1 9cb35f9e9ae83a58bec24b01d013b425c905b235
SHA512 db77fbb822621711f6c96cefc5bc2d8234e38c7eedc5af807d72bc24fdbe8f2664687dfbeb2a800e05be6b3030040925485d288b6f5195bf59cf05053023a1e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPHf:A3k03kHRJARJE
TLSH
T1CA259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 958KB
SHA256 b7ea90438733a25d2590b52bf34303686b72d8fa768052a34b729f4b9402b761
MD5 8a1190db0b7a6f5aab8463236f798cb8
SHA1 a038f2f7e823e6531b43de3a8dedba1e032367e2
SHA512 853d2e387d9686ffdfae2466d054167a39fea2b7af6aadd09d2e3786bfc4647d176fd5734cfb341bc999c18bd4e0944ec7170dbdd83c16280e8689e27e6527d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPwK:A3k03kHRJARJ0
TLSH
T1B6259D17F79900E8D10AC1789A968A22FB757C56173193DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 958KB
SHA256 7b7ffa12bcd0ec6880da70cf1baf305f5418d9499c1084737b8d682acd9b4ce5
MD5 35d618148d0a4809ecbccd63184c5acd
SHA1 a8876d37a5d8b94a01c0e6b649aec8e2c8b49728
SHA512 eb290297ba2afae21dbac19edc82a8272b2e947a732b3ec30cfddd32c6f017e304385535c3573235e94920cbbd8b975a2c9e66d7de12e9098b64e9fe12b3468c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPtk:A3k03kHRJARJN
TLSH
T14B259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 958KB
SHA256 8a3a8c16bc78b8ba8d6938e83f387943e5e05b77b81125bc0c90f05d0b17f50e
MD5 a12d61d943998b43e10f194f17a780af
SHA1 1ba8b97da19801c199fda8415a32e5e24198231c
SHA512 8f34ed095e68af325836dd010633027a11b1434baba5657ce03f2957019b9dffc46a544cff5ca34c9059114c21332a030ac1a76a8eb2f886b811f4a45ed57278
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPy0:A3k03kHRJARJw
TLSH
T166259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 958KB
SHA256 dcb7a580994a85bf499ef8e996a35ac900b1eddd664aee55a2cade9e5b0ce8de
MD5 defaa5d12998728db380a4eadabf18e5
SHA1 e6002b1090e166bfbd7f66c0da3bf1906f821199
SHA512 79d14e1fdb189c7465b844f93969a99107d11e73c463a8ed19b68d9cfc295e0932f378b793bac29d5608f21753462ab8cd742cd80c981658e53d1c7b2a9601a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPBg:A3k03kHRJARJF
TLSH
T145259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 958KB
SHA256 8c400498946744620a71a78f739a7992d251734dd514cab90b82100f37ecf04d
MD5 c6a086faecddab7860ae7c8b4061083d
SHA1 37cf3bc5ac32822426a9e71e0de940867de5c59e
SHA512 59c36ea6b591a5f3858456af59fedfec4bc13a2e4483db130bb0968855001a112b421e4538e5c0960e69c151a05b020145b91968df481206436cf41e2bbd80c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPor:A3k03kHRJARJH
TLSH
T10E259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 958KB
SHA256 2667d7572c6d2125a8e8042d0d5ae1c0fefad5ef996d45ea0848a58e0d8fd51d
MD5 268bf37eb2552a15aa59bbc429391abf
SHA1 2d02d3344e5338f5c921930e1941a73566bab131
SHA512 15b65fda2d74e21ab04e719801b596af2b8fd2be10125d3c243c3de9136bf35f4322fd9e6a3f7088761d69c2a80436887d46ef3bfd4dc694c33144d49235b202
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPGn:A3k03kHRJARJx
TLSH
T108259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 958KB
SHA256 2b871731fc6b52969ef0662cd49e1d4fa254c9de6fb65d02cebbac6983c41aaa
MD5 30d7f6fe88e1fce33a659409fb53bd8d
SHA1 b893ff777a11a78980cd796fe4931ffd859b6cb5
SHA512 620e1943ed4aea86614c9c2a21f3343572b07ae08419e22f13195738cf3be8e04fe825f10f2019d482125e5ae88d515aa888b8a881671393d1b154b9acf291ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPMx:A3k03kHRJARJ/
TLSH
T1C8259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 958KB
SHA256 1391a7e82097b9def6d93953febc8698bd43ee722330862cb7fc6adad42e5f00
MD5 6536a71258bdb15f55403757c62d8887
SHA1 4bb7eef4df0a4e5f4f6aa5e2db62a4c2768862b2
SHA512 1a1fb6d1a397d40e1a0092c33193a96cec92937b9a2f8db48b5b17944ec0e7d82b79662641a3c76e391d72c5de1dfd6aa2aff0f681c3b5e070b5c87b7c1ad51a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPGA:A3k03kHRJARJA
TLSH
T117259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 958KB
SHA256 c55f6d30afc668d0f471e9df5b91334604d8be648bc5ae7a985235687cd0b27e
MD5 d34f9a4c8e90d3b358e06be53b8d90fa
SHA1 7e865b651864b123afbd18ee83d755ce77347d2d
SHA512 ddc954b896d29f31811b5e06d7fcdd7207109da787d302a80ab8e5138a3b89b69f98c774643fb4458a71b43c7bfd200f767bb76cfa756c796c5a393a6b64ba09
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPf9Q:A3k03kHRJARJ5
TLSH
T1E6259D17F79900E8D10AC1789A968A22FB757C56173193DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 958KB
SHA256 95ce9d440c4974e34446e89b2c59c033b5973d6bcdd1ac395978f0f521e39df4
MD5 430f75cc1a5c6052d61dfe3129f314b8
SHA1 636bca2e8559941596638542b1f7c6e6a4b69fea
SHA512 8277d3159df2a10fb4ac7cd94d376c2809b25e038d4a0cc3e64aa521d08d91d87d7237e904015aa89131a22ec1bab47514b8744ce1a8e9eb67812da41006d3bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPW4:A3k03kHRJARJu
TLSH
T169259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 958KB
SHA256 b75c04fa40dadd85d603e237e5e4fc13145904f3382e52c62b3cc59c280833d3
MD5 e5a44b6ad630ef2770e8c2a308a7f0fa
SHA1 1ecf79edecc4fc3778d92587ef21abb4cb54803e
SHA512 da90e99104afe21c36886becb2c8c99ede80aab6b1e203703604bd6616fa624098a94dfb302b17eb0f18a3e551a172a4204f1838a7e7dc766f14eba79d82f33c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPFu:A3k03kHRJARJP
TLSH
T115259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 958KB
SHA256 7ec8a5815a05d5f6aa75868f95892211a99f175a5c630061d1d0fe1676c2f162
MD5 cf991aa9d259a8fda8a716e23f70e63c
SHA1 124dab7e25577a99ebb211260527cd6ddbf18091
SHA512 8d92fa962996a1dd5ea5c9336d455541b0ae21c7803fd79365982af625bfc3ab8f0308dbe6b90dfe28a4f48baee951d89eaea048e494101412878e60ea19ce6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPYj:A3k03kHRJARJR
TLSH
T190259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 958KB
SHA256 8a7f8d39d7abc03b51d784a724552608f1a50ad5573fb8836bc141080948601b
MD5 14a378e259691ec4a1dd437faa777e08
SHA1 650acb64f99b2f848c5e4a4d7a9b213977efa307
SHA512 752f1b54df78ec99b0267dc291ea83723bc22312a987c04cb8d6067f4439425339cbe90a203a9a54c690a5b9846d63cd5b5b6af8b0150d6b884a4ebb5cbbbf16
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPpg:A3k03kHRJARJV
TLSH
T11F259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 958KB
SHA256 f00cda4f5eeadf20ea67bee7dabb4d6f9dd1ce6aee3c15c93ee5fdda1ed9a2c3
MD5 6289c22712dbd67f54694a54f242f523
SHA1 4d47790da984b29468046caf3801bb7ddb30baae
SHA512 7355af828a56d887772a80004bae827a8adbf204eede9bdc5e164b6e043ac9fd18522b34180568d9119d47a3d265a4c0f310c5bdfc040bcc2f6602ac90b2aa9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPwI:A3k03kHRJARJc
TLSH
T18E259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 958KB
SHA256 2f6490fff2c172f7eeacd8eef9b3fd0f7567fc2c2c6b62b547f51919d33994b3
MD5 4f288c851f00c524ad7fc39b20a35285
SHA1 adf51fda6fb2a08a421fb4f4265aebfa63d7c4bc
SHA512 d50cd3c75fc58fbe71f25da9954ecf8f5f15f66abe74ed1b8b5ddd4b091d72f7452ec509a00397d4def1c680bac4e65bd78fe157772302a75b20cf7772067fd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPyo:A3k03kHRJARJe
TLSH
T1A5259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 958KB
SHA256 0b0947384d26b4312ae10ab328f44901a6988baabb1728b244c34f0721cc35ce
MD5 384ef62567946fd2e147d6cf89edf91d
SHA1 667c57761d60341d4da680a7f214c746e410aeb6
SHA512 426b36c71a404931a3232077bb45c4f9b316a0b7c53198ee8682b069fba34c30b232faa5fa4a3d28f0d203203687e60cb9ef5c1272c201fb74be495a705f0812
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPp+:A3k03kHRJARJL
TLSH
T10E259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 958KB
SHA256 62d8c7cb2f34d00faea4ba19dd6766c0a45a040ea378f0403e16f83e6a9f0be8
MD5 1eaf35332afd92158010685a244a2b8c
SHA1 3635d988c2d73051756fb73dba94b8ec53b1c0d4
SHA512 2ff77c8e972a9655c711f344dc41530d135a3f8ed929809e586a4e3c55b02173d323bb2ff3bd47b601c7c245e911bf26ac22cea874c9b9896724ab366ebd2dae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPXQ:A3k03kHRJARJP
TLSH
T158259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 958KB
SHA256 1bd22d520a3d113a66534d3310130a7f9ba87ea5e342310e0cf6be7fa1ae7af9
MD5 23f8c1cdc98c55a9b7c224f8ebe26373
SHA1 7999a7df4ec4df8a07ba292b66dbb131daa2c3ec
SHA512 87f31473ce4e1e025eddf171948b2a5c948b547e8589342c7df87a5b7779677812502b8b062f4597527dd14f74b1a5d3b7fb079507fd8931ed810c4fabafb41a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPsX:A3k03kHRJARJD
TLSH
T141259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 958KB
SHA256 491f39dd2d8b87d4e7207f9f46ce2650ce9ae26b016fa679c42e213e03c8fe3f
MD5 5a14c76f976f0da2dcd244852acfd1db
SHA1 99e72c640a9c5fe8d0c7eaf89cd6fb02ec1a9517
SHA512 dfd8d09685dce034b48e4a5650e65d63c9137e935d9c33abed1a7d3cabbf47ed01f263b9c20ebdf8d1344ca3b88174f81e10812559cc1da1b0f6fabb782fa807
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPKL:A3k03kHRJARJN
TLSH
T1EC259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 958KB
SHA256 6045fe535296e2ab691b4ebfa827af44f6438055104c00a5cada3b934f485598
MD5 fe784ba0916c077bf6eff11a471dcf0f
SHA1 901eab03aedaf3349b5c3eddffe17efc0e0a44ad
SHA512 db54deba7452cc24fa34e6e7e954e20d8615d61722003ef8c33bcdb4ddb6de6a18eeda4cec01666e7b6ff3ecc988aff10cf0911d4eb55358e44d93b305fa08e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JPuM:A3k03kHRJARJ0
TLSH
T1E2259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 958KB
SHA256 cb23267dde44ace89fac3b5a8f6d76d9324a53f5309caac7737f8927e2b7eeb8
MD5 40bf6b5bda31b916e74da230478e811e
SHA1 713a7e53051ced4bf0303218b285eaf37e9f508f
SHA512 9727796dd99747b6aff41e543ece3875d5af628cf01792b048dfabba21e965e4ca5514b6c8987256dce7f2b52a0286854a1bfabaa046938096476626b685b8d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZy97JP3h:A3k03kHRJARJu
TLSH
T1B4259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3140-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3140-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4160-173-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads