ee7ed243a7fe0285519362b52e6932563621246d42480d3e89ffd6d6c609edc7

Analysis

max time kernel
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 895KB
Sample260820-vyly7ssbmb
SHA256 ee7ed243a7fe0285519362b52e6932563621246d42480d3e89ffd6d6c609edc7
MD5 a42fe7b14af72b7cb5d9c821641ad242
SHA1 d6deb94039ce051dc1e5d56a10656f8ccc2c37ae
SHA512 0e27ca957579422758cc536b19f083bd932ce74be00c10db069cd975bbbcd4b8fe195f1042b38208f677a8b7785d205c4b2d0336341cf26521de40dec52fa8c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToC:A3k03kHRJz
TLSH
T1F215AD13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3312-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c496-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3312-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4060-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c85-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018978-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a52-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-248.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a54-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-305.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-689.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-738.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-769.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-806.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-940.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-959.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-990.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1070.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1119.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1189.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c496-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f6-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c85-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018978-203.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a52-210.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-247.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-248.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a54-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-305.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-475.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-591.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-689.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-738.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-769.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-806.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-849.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-902.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-915.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-940.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-959.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-990.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1070.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1119.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1144.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1189.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1388.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4060	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3312	2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
4060	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a42fe7b14af72b7cb5d9c821641ad242_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3312

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 895KB
SHA256 ee7ed243a7fe0285519362b52e6932563621246d42480d3e89ffd6d6c609edc7
MD5 a42fe7b14af72b7cb5d9c821641ad242
SHA1 d6deb94039ce051dc1e5d56a10656f8ccc2c37ae
SHA512 0e27ca957579422758cc536b19f083bd932ce74be00c10db069cd975bbbcd4b8fe195f1042b38208f677a8b7785d205c4b2d0336341cf26521de40dec52fa8c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToC:A3k03kHRJz
TLSH
T1F215AD13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1dedd672239a20b6e9260e2edf9554fde5ebbb9bde98b39a7b3391546afbb643
MD5 06b7d06113f4ce15e6d4c26a917a8249
SHA1 304e51d34fc3ec39e648615c3fb6cd36bfdae01d
SHA512 bb116513ad53476c02bec7b0a5e0e7bdde84b99b9a848c198ae33feb3406d1e95ddb9d8210409bc8f502cbcea4dac6a4ded747bcdb7fb7146b0766fad5c9a246
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToC0Le5ji0hmxNrM:A3k03kHRJvPji0Aj
TLSH
T188657C17F6A402B5D027C0B9C5D6966AEE7138821B3086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 909KB
SHA256 4ee0ee0bfb3c9db929eca63f7f20bbc817914ffabd6cf2d6e1592bc727b1913e
MD5 c77a9668d67a497fba98259c3ed35a53
SHA1 b7f066c002a64d38d4e52b28044873a8e926c50c
SHA512 5924bc8f48f801185c1ce4e796d45c5b39f1a7e3da2810a5333033a4134fe48133124f9ca3701fa1907b34f0d0cdb1566d6c7ab315958af1c8760abb76fbd21a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToMa:A3k03kHRJ
TLSH
T14115AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 942KB
SHA256 443a1dc00c1a01ecf3a388cd2db717d78b570079228e4916590334fcc4b81e2c
MD5 bdf547e72a34c1832523c2c347ed77fe
SHA1 162a313793278bed9595be12d636e50adffebe5c
SHA512 072f1bc74ea107acc91332fc82c3ace408d27cfab7b4cdde783972c90e879511eaf91661cca4a1e856550a1297aa58349d4cb6e93869afa86f55844931da37fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTonb:A3k03kHRJSb
TLSH
T1EA25AE13EB9500E9D10AC174AAD58A23EB75BD56277093DF2358C2152F63BC06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 918KB
SHA256 c2f613b5fd450ec7d073d3629880a11f18cedfe0a3cf0d1fbdceb733a6ef9b7c
MD5 49adcbf6b99aba274f12a1b8f3e07443
SHA1 fca8bb0d8288e5426f96f3bad39542cccacca74b
SHA512 44193c8e3798a2840d4c761c57bd8321d2b743c795321d18b1ea72dd8915a893ddef923246ccf119574ee07b0ff099c3b64ac62c8a87eeb1c812320c1fadb833
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToGZ:A3k03kHRJD
TLSH
T15015AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 918KB
SHA256 98525fa79dd974f415bcc5857baac197aa7a02d8ecc21dd41aa35d4950df446f
MD5 facc073122747a63bae4946409d000a8
SHA1 3a8606a37aa1d5c14f7db70a84072f76fcee5370
SHA512 c0c0b4347decae283fdb8b3bd2ac8588fe583e307f23767fa025b0c3c5cf5657408ccb36014012b9d323b7cee4333f3af762c7bd54618e545df997c02ed23ffa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTox1:A3k03kHRJs
TLSH
T10F15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 918KB
SHA256 98d08b4d764bbe63c4b1b3902383a0c29445918c6f29a54b1c4f1e7b1866bbe3
MD5 af33538ac65365decc8152ace9da79e6
SHA1 9387a6c0c52931573353e788c647b32893470028
SHA512 7188480f77433ea42433abb9ea1a44085dececa23e63d9450235c2fcc8d46ad2b1db8dae77f205718457b5aee69ba1d7283ae1e41d1ccea2f834f8bb85ceb320
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTol6:A3k03kHRJ3
TLSH
T1C815AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 918KB
SHA256 93f3e7f1c4fb62f319c929921c053d032a229a5850b6781fd26b936c79bf128e
MD5 69d688f2e8cb4542fd7bbd3a2f595c7d
SHA1 cd687104d8804c7bb3fe8cc11b4cdd5bd28917a5
SHA512 eea2691c2ad646db7ad4a02d730d6eb72338a7fb3e0944a1c8855c5469f4e513d9ae638df01cc7df91cb850702f0d5a1496c2e7852225da2ebb82fdf39590333
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTobo:A3k03kHRJH
TLSH
T1AF15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 918KB
SHA256 b9975af439db7d978508c04d290e8a4924f07ab429f51fc008adb9bde20f2697
MD5 f27f309dc26b7b8588855165fe4c717c
SHA1 0c179451e7ab5ea88b756a2592b6d176a61076de
SHA512 035877bca70aa5361841d478041898e37d1f216796b761167c55e66269dc38cfaf44dafa6fc4daba1e431bd1035fd3fb6611731f79f78811fadcb473758aac4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToPu:A3k03kHRJp
TLSH
T19015AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 918KB
SHA256 ddfa8706edebc60f1241be6dcf0b22207423994869dbc0183a070ed9c8eff309
MD5 4837f491a987801f5ca39643815fe75f
SHA1 449c5592ca02709a858819c2fa97d8dfab3dc8d2
SHA512 db564f28382b0463517399242dd2aeefc7067dcf42d684618ed276edb4c3a8e8e23c6b657622ce78f91de05608014c047822e9f802b7258de01c959eac521474
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTod9:A3k03kHRJE
TLSH
T18115AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 918KB
SHA256 f9aa3828f3c9d1a89aa255939ef9d2f3c797bc2f4007b10f6cb37c4c6a99e7b4
MD5 93e34dc5f853734207befa8bf3265b1f
SHA1 46bce60481e08e060ed0ac99c20c8dedac03aef3
SHA512 1787b225729b6324d41faef02a9b7bddca10aa212dbfb09ac9fabe7e7c5e9cb4a0223dd08653a8ab02af2f866fa96f1358471ecd00cdb234f6946236f2674738
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTo5c:A3k03kHRJt
TLSH
T1C715AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 918KB
SHA256 dcb71e8842163738dd99a9ef0ad83efc7a537aae496e64406e8973829fa2f03e
MD5 9722497b1352516755f837f2b3efe635
SHA1 3f577945a4b3204d4699fc0d1a6c9debe0467d53
SHA512 5ca48becf548b51b2cc28a075fcaefe25b8fddf243d04a430ab8a65bf8ffd2c8e6afb9a074451e2d9b3221c166184d9f82c662c7d8b2d147aa7cd11d172df962
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToyp:A3k03kHRJz
TLSH
T14C15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 918KB
SHA256 25526afbe9c318285f2c41a13eee1351b4c70b048926604d264baca7e7d620b3
MD5 8b42f0294cc23d274c700a08fff26777
SHA1 cb1d0dbcee47231ed7cbec543b7508602e6275e7
SHA512 c4a965f46b709671a55f3f779ba46d88e5008388ab4587ac15256cdcd86680ee06b1076cece4a184d8df0d643dad69140d33832ec19e84307881684636043969
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToFN:A3k03kHRJI
TLSH
T14215AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 918KB
SHA256 835361c6ab1e7b1df6ac294a3540f7cc4de5efcc9544cbb6cfb8ff58e6f9a965
MD5 0fb767706d15d78fd63e8f12e54a52b4
SHA1 fd8882994312675fcda3f4288263f1fe76e20b7d
SHA512 d9cff5d5ea8ee076fc0ab2713a62f58300a16ef49acff5bdaa7d9d65e47539194be29df8c9e0ee33daba4fd5c877c7ed59974689e691a18cf48bdff3ddea954d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToXF:A3k03kHRJe
TLSH
T17A15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 918KB
SHA256 c2714d4254d069c2b7896334d73c5a0bbc03c832134d824b908c3830940ae9cc
MD5 1cecc0303ff9fbda800ce3ba874a1026
SHA1 7011bbd24e27d7115cf6e0ba732c374ad76d91b2
SHA512 7c469fa7ac4851370c67c68293d9a832ce9471c21a1eeee5df9a7a875071bed23650218568a917c27e81a5647e28fafe72a1ab5e8d43b327ac054c57476de510
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTooC:A3k03kHRJ6
TLSH
T13315AE13EB9504E9D10AC1749AD68A23FB75BC56276193DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 918KB
SHA256 d664ee48e87c46bc3e15bf6e24b5a0805321625fdab297bd61c140fd37d3cfec
MD5 ff46b967b267a54bb6c922d8c24ab4a1
SHA1 25a611c3c20588a5137c91f49b4d45a25b934d89
SHA512 7c840c8dbcc9968e3c735a89de64331fe437c4fcfc70047a19fa15168a60d0b02a7825dfd66729c65d187fba7b7ca49fcdf4b773ee2c90ad601385e33889e973
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTo7w:A3k03kHRJP
TLSH
T14415AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 918KB
SHA256 91b5c17f5f0504f36540c274a08ec4147014c3fcf3ea26f717140083b90acde8
MD5 6fba93586143bda01dcf6310afe66fca
SHA1 497a4fcc503e0dbe5e45f7e68f825b5b48e39e3e
SHA512 e406f5061cb8e7af18a91426a826ad273aa294ba420c1f71a4d1bb106eb8b15c28a920a991edc31bd1f8e0bb6e592685767e93ee278854b7d10725a9ed804376
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToCT:A3k03kHRJr
TLSH
T18815AE13EB9504E9D10AC1749AD68A23FB75BC56276193DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 918KB
SHA256 2f8f8f7aaf789802e8a91706ac556a6e8afb6bc026a01505d619091795d8c048
MD5 c031b78ac5a6e96d148f0b496c9014c5
SHA1 870c381261b7e6287b3a8a5e87e1d1786b0c4e19
SHA512 3693d3d4e2d9f42587e36bf8e76d7e3de011f87f0b7b42518436f1d965e878b9ce8acab9df8528cc58a5727161b1d72ce263a6b163e28227646a23032a5d3fb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToSu:A3k03kHRJs
TLSH
T15D15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 918KB
SHA256 7e9f29e92ec1cde129b396b8f49e2ceb6bd7b5a2d6fc49a433be073182f5389a
MD5 5e9f8390a68ed45e292d284ef6998cb7
SHA1 a6afc9c6ce8ed44d65f0c6354d887d859c1d19e5
SHA512 dff7e2f9dfdff12d51f4eea2ed6c65b1f820934e8da9e8776ea4c38a5019df385ca9a8ae5791c2f88c50e6c8351b9eeb0bb30c2342698bfbec3506987ac5b38e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToMb:A3k03kHRJF
TLSH
T17A15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 918KB
SHA256 10057ffa1e172ef2ca7aaccd896bf25405b7f3626d0a683424037d443fc09979
MD5 0b5d37c5d6b54b2b0b77a8aa902dd4ae
SHA1 b43f21e603f5cd50013112d022f6c4c45585962f
SHA512 2903bd16a886678d2d9960e16a08d569c1ebfda8a2b28ef9ff0b048e7a1b1bf0dd1b971ed2dc41e0c0b3981c22e6f36e19d7f27085b70738060ca2a2e6240e95
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToyf:A3k03kHRJF
TLSH
T19315AE13EB9504E9D10AC1749AD68A23FB75BC56276193DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 918KB
SHA256 3ea43b0b571d6ebfe1bdfe9f7d09765c2c4154e7129a30aab29d5c51cef5670d
MD5 2c4dc266f5818bb8938574b92010d45c
SHA1 35f4f79bb422aea63d4b19702d384fc183ae6840
SHA512 e598b4c81003eb5124b2190e66988c13195266ddff2d54b5f32aefdf2605bea47957e4c934760265b995b3f497d84f862c57c77d81f49b52b2446407de1b0205
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTofK:A3k03kHRJ9
TLSH
T10915AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 918KB
SHA256 2e040f5d6b03fd41237f3d882da224da9da02f41ae54d7efaa2c6ce8cfbfe1ca
MD5 366658176dabd3641768b3e9070518d5
SHA1 cf4d6237f719e5ef5b4f67501c990af5d93ac6a7
SHA512 2d811c1b2cd1a328d0f84682e62ee2fac15c8f8898c3d10390efa7caea9d97125cebb5fc5a033cc74c888fdb5121630ba1f5ab4b9103b047334657008eb40617
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTo4k:A3k03kHRJU
TLSH
T1AE15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 918KB
SHA256 0a99e2b207abfeb5187b1a72ff1c6c7e9d5c4db246b4a5d2f336112154bd0ee9
MD5 f24088b5d696257fcfe206af0159e1e2
SHA1 f38884448f59e4c539f2f7259cd3a05c89924090
SHA512 7da72158f1ffa98eb40bbbf695249bd20192e5f686f4bfa5676f117a6ac1b21528b97fc3e4bad04459b062c6c03b11e599275f0e0b96008acae8f12cce6a3eb5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTo50:A3k03kHRJd
TLSH
T15B15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 918KB
SHA256 a339cdb8a4a950e4bac16dae227f6aa7583a0bd7a0e60274bdeb5d98b5a1f732
MD5 5e3b0bf75ae36d21046fb7a47b4a7c77
SHA1 0358d56211d75974d10f513cfaf66f587d3fe55c
SHA512 42a09687c26282a2261643715a8adde888e128756b84804ea03f5fbeb66f6279b2aa1c8389aa4c8d42fc7fa6a62d734d2331ada06fc2e782f0052fa97a9848db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTosg:A3k03kHRJs
TLSH
T1B015AE13EB9504E9D10AC1749AD68A23FB75BC56276193DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 918KB
SHA256 282b19c17924721501a17d5e9396bb175b41bbac50efb26a7491ddb27ef07048
MD5 e1b9d84a7ceeb266e8c6c8cac7e7c9a1
SHA1 1d7b02812530625e0224382f1ab7fbfb579290a2
SHA512 c129b8839de451110c03414892e5be1aef5508129dc440ba5ee003426786fd96cc8789d17d1e4a2bbe7421c849dec0ab9dccad10f7dedc3dbe5ed0666033f83f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToJr:A3k03kHRJ+
TLSH
T1CE15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 918KB
SHA256 01f7b47c6a6d17e768dbcb66cd0d097c820ab09e0d782529590e8f4c3181f211
MD5 29b903497fdab84900d35cb0fec2512c
SHA1 3eeae551d45a4257661fa98813d6e81f7f47a2ca
SHA512 d8cb718d5018d3e9b54ea058cbb261138e0ef52726ae4fa1a85a27b8efbd42c121579487ec115be95ded576df2bce0447c2581d08749a3ad4f0c5c5d0590b8fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTorn:A3k03kHRJI
TLSH
T1B315AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 918KB
SHA256 bc381a8f675e7f9564100c1bc2964a1b79845585c67aeed46242f32f955ca8ce
MD5 7bacf79e8c46350ddccab9d573364b2e
SHA1 4441c095c85aae30b301e250dec04e1894e35763
SHA512 7c0e67a3d33d5eaf2dc5deb29c45941454375cad683efe4a286390a38e745408ba67111fae9feda87ee7ecc6aafedbf1b7ac63691a4c1b41df0083d70ea15ac9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTo3x:A3k03kHRJe
TLSH
T1F715AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 918KB
SHA256 788bbc0141880879834e3730047d68a3960d59bbfb23ee6eece0b3fd5d5aedd9
MD5 72ad663a5c138562711b389f85912be2
SHA1 44c54592829bdde83f4b41dd83d07c99ab95f22c
SHA512 f84d38773739ebc59eacaae291dbd79d1f87473fd63fbdbca0b74a5dd89d5fb383413532e52fff2d3c0486defb8128f393d857769a5966e91e141cf8985789e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTotA:A3k03kHRJV
TLSH
T18315AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 918KB
SHA256 8c86f87e71ebc55995e93d42ed7e0d95ce548c774e8d158ec51de808b36c896e
MD5 0c30e11d3a54d765ae5d6ea28c6d45c0
SHA1 10ddc0bfeaded4801d0afa7ffb219ffc71b72a23
SHA512 c4c8bfb420f482184170059946df0f11c570dd489079afb971cb50d5ba02713e969f7b15e26cdad14bea2c1eb788d9fd8be29d361c07249f61d7501018cccf0c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTom9Q:A3k03kHRJU
TLSH
T1E015AE13EB9504E9D10AC1749AD68A23FB75BC56276193DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 918KB
SHA256 1740ccb881cf1dd721b120cc1d69c5e97f982f40903f8e4bcac0d7d35f765017
MD5 05ae2c0aa612acf633818c181bb89ce3
SHA1 42eef84e28c96b22291b671bd6544e2f87ad781f
SHA512 5e0172243fd6796e2353a5014f970188bc30005b8e00b272c4a762cd28217bb05dfbfec5b21b9235c7516b0421ab9d64fe8f7695ec9ea3d0486457dfa6094116
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToD4:A3k03kHRJf
TLSH
T14A15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 918KB
SHA256 78f033feda9d3257d665e572f9ad5a6ddb31919fb9181a34dfeb09a2f8af9c7f
MD5 09e107f6166747dee07fa50fed30cf62
SHA1 d04c389fbc50a7dfc958cc00dbbd7060822eeafe
SHA512 e280a952df7a5fdb935a654b5174f7f0aaa748c1bb8c24a121a883fd4ba9583699bc825898f1ec88bc2afb56349bcb3b79595603eceea6554771adc86d7be7b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToqu:A3k03kHRJS
TLSH
T1B315AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 918KB
SHA256 a1be858cfed9da95956fd3aa103eb23ae06b5d279111ac738eb62c73e92cd815
MD5 92dcbb697d1804f12d12b5427fa36864
SHA1 9b38a0590443022ad8018a85ebeee5f487a04670
SHA512 c1dfeba057d21e9203057c153f65069f4d6614d2e6d623a0a6bb44f270e599e1edb2224ec44fdf66f6be10d4776052178ac14527a61b4515772b437023c8ff7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTo7j:A3k03kHRJM
TLSH
T18815AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 918KB
SHA256 6151f519c46dff7cc7f1856a2af8c0252ad76c83a12e0f49dc8b7aa677dc0ad2
MD5 99999f10e2283772fa80e664b7919a09
SHA1 9d5ec50317d4516f15130ff53f98088458f80994
SHA512 910d83e905e788dfbdcbb8781f573bc4a657e362ff95c3d9295b41868d44e02ec480b6f220c2057e481ab7ac5cfd25fe86ccb24cec2ba2e477e92211e4b1d8ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToGg:A3k03kHRJE
TLSH
T16715AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 918KB
SHA256 e1405c0e786b884c6b5dd90436a44feb59f4b9788600efa4023d8dc436ba74d1
MD5 b1d4ed4974fbb899757d1c3cd0892798
SHA1 c9a0f2c2ec816c509d977c26c0568b4391d827b0
SHA512 e8ffd538648acd6f98da1d1960aa1d2a474085787a50b82848c6815b7b2ad0ba476a4ea61014ab6b12f976585bbcf08fbac605cb2b0f6a10165186853b519b6c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTopI:A3k03kHRJt
TLSH
T1C415AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 918KB
SHA256 c4c2fda877d04d26ca4853d3c6b1479bd308d7641054792ad87a788899139e2d
MD5 74b3d70f47cb2c5e0d0f8198ef0d6079
SHA1 ccb8f8963fe18f49cd8eda3305c9c6a25892d9b3
SHA512 c62a2224c07505df44c30efeff1070cfc422cb76b5e5e3920e3e11a6befb6ff8a31dcdc86c6f5edc1d6ddbfb56284481bd332fb807379e6f858a197dc0d56f5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToLo:A3k03kHRJL
TLSH
T1AC15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 918KB
SHA256 5525fd94576146e3543c75c73ac409ee235c5f6302da02b436026872b0d907b9
MD5 41f3bfc5327f84d738d6b74ca9f96a74
SHA1 8c6e277c3a33f20d75699926741fb4b45d6e8a65
SHA512 05fc5c31c2952d507aa3a949a1622d795f6966f3ae52ef9a8655b64c01be73142dc0fd117e8af32255f37ac635a95bb392220ad6dc83dae60fb4073c973a47cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTow+:A3k03kHRJO
TLSH
T11115AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 918KB
SHA256 00645b10123d95d4764f7d4891e76cb97501478f3ac4f0a2b0dc65164fd9f85e
MD5 a627d9185790e435548fb226e8a71dd5
SHA1 148a848c87c9a71a99b8e800e60a2b46bbd81c06
SHA512 df1318b3c8aa82773df7d17ff7124a202dc67db4edae7c6ae3cb3dc8f985d3dc242920dba91f55c3a3fa718c8230330dfa224bdd804a2337a893721cd58c8e81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToIQ:A3k03kHRJ6
TLSH
T10615AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 918KB
SHA256 e039b70ceace75b83cac71cabbefb4c9a563c9e1584aff73ef3e6e1f5ab4f6bd
MD5 54e9b321a5a30c83b9ed6eb671ba53dd
SHA1 a179b8250232b4836e17c3c725334e4abfb5cfaa
SHA512 daaca303f13c7e1ae35942dc4f713405364f62e9bf074d124fc25056cc67a919d29fc1b5ea720a372896402e3357566236458b870c6abacbe8ef5775edbe7bd4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToBX:A3k03kHRJq
TLSH
T19E15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 918KB
SHA256 65cf08fff7647c2b77445e431e998472da4d9b3f16975ed4586c0e306dbdbc24
MD5 774c3e026f79858f326f8496e120f3d4
SHA1 5b44af803f30dd7fe66db1f14607a0777af59417
SHA512 6872299b748541fe2b3063e7df188fb012c1b858d1ff106e68fe25c3c3a845c23a99cff765acb9c1ab6f50ae3228cc71bc51ee2a9420c8dc25bc6eeea215e223
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTo7L:A3k03kHRJE
TLSH
T1AA15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 918KB
SHA256 ecfb1261e9f0dfc765648fe3b117aa717d5a07bce9c3b0c547aacde205936638
MD5 cc173deb5675892333bca354b6b20c19
SHA1 6e194784db003c8d21752f5314153c82eca3b7ee
SHA512 4f2cd3bedcb09f23d64af904d46eb3f35c98a4f714c19dd7e822e57ecbe078178f239323c25707f199c8146c93cb43ec109f7727b08be1646dc1cb4a3aa4c73a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToBM:A3k03kHRJF
TLSH
T1B915AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 918KB
SHA256 952b6308f73e2ee9ff24c3ea8370cd911fd821f2ae9cc3a34574b4525a0cc702
MD5 8eaa1f131abfe969675dc0427c0fd760
SHA1 ea69a0d6d75ccf52697d6ca856e5f4fa7cf3edf3
SHA512 e10384b9c42991e9efbb1beda509b3d5d5b68cf0623559915ec759d30848d33f2491e20297c9660cadcfa7f32bdaf73aa12f3403fe910f9b277fca7a5cd35bd6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XToqh:A3k03kHRJf
TLSH
T14315AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3312-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3312-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4060-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads