96b700d251c293c81f6da51e825223b43b699aeaae6c62b562a6a319229404ad

Analysis

max time kernel
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 895KB
Sample260820-wmprdssglf
SHA256 96b700d251c293c81f6da51e825223b43b699aeaae6c62b562a6a319229404ad
MD5 367145103c14bbbc2bcce6e04d5d4d55
SHA1 ea3847fc552e619f41c180f6f7fa992aaf90dac8
SHA512 fcaecdaa53e335d8e6e2c46743c7046af1deb7d0f085476c23cac56e1f64afb195df4709e271a47148ae9346b9b257521a2a9f01e9b6005a9c118f24b4582f8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTd9:A3k03kHRJR
TLSH
T1A515AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4164-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c4ff-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4164-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/928-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c6b-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-579.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-660.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-764.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1126.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001000000001c4ff-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c6b-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-226.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-493.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-579.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-660.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-764.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-850.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-909.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1065.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1126.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1139.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
928	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4164	2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
928	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_367145103c14bbbc2bcce6e04d5d4d55_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4164

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 895KB
SHA256 96b700d251c293c81f6da51e825223b43b699aeaae6c62b562a6a319229404ad
MD5 367145103c14bbbc2bcce6e04d5d4d55
SHA1 ea3847fc552e619f41c180f6f7fa992aaf90dac8
SHA512 fcaecdaa53e335d8e6e2c46743c7046af1deb7d0f085476c23cac56e1f64afb195df4709e271a47148ae9346b9b257521a2a9f01e9b6005a9c118f24b4582f8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTd9:A3k03kHRJR
TLSH
T1A515AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 24648af3ddebbf4be9b9e7416c0660238d470a016f46a3ceb450b5c2f711578a
MD5 60902042f7b9527419c2f43d38c5e4a4
SHA1 fdbfe9e244dcd544e332cfa7bcc40e1cff87060c
SHA512 062aafad44f97a87e25fca6c2b1b0005db6a0522d9c39bb9533997b6f1fe0fb8098196d83ba2940bc395867443f7194f7f686ebf9a69c33f63bae1123ecbb3dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdJ0Le5ji0hmxNrM:A3k03kHRJtPji0Aj
TLSH
T1D4657C17F6A402B5D027C0B9C5D6966AFE7138821B3086CB1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 909KB
SHA256 984aca1ec16601c37e4717ed74601e4178206b65c45d46e88795d16952e14a41
MD5 70776f1f1e42fc4c6cb03fabb6dc10ba
SHA1 dfc5091a031fa54d83f928bb72692256b31d5dea
SHA512 f5b8a97ec0cd70f14bfb22783e695f50296939bfa70cdfedf8559a8877f687679136220517f6a6ee8ec006bb799fd121badbcd0381856c04e782704eca77b87f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdba:A3k03kHRJ
TLSH
T1D115AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 942KB
SHA256 50f9865ae55a4f1a040ccc2313105dc651937f862e25c20bf08413ac1e975447
MD5 5db2728452d4d34d09f84c8bea06d33f
SHA1 41cded066e846f8f5e93d085e8bb1ecaffff7481
SHA512 1247c6d0bcf7b0d273695efd0778d3b348ab108b88669f1356e4a6ce94531bd7fe63bfd7dac9d4454f3685bb73311d358685f44eded4831a7e798d4530897d92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTd4b:A3k03kHRJsb
TLSH
T18D25AE13EB9500E9D10AC174AAE58622EB75BD56277093DF2358C2152F63BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 918KB
SHA256 ea7ecfb945e88a14aad93bb8767416e2f1cdd80fae3ef798cc3b64aa2d4857c1
MD5 a3927dbc0afc9431637e4f3bff06d974
SHA1 16bf3637f686e64dc620113a8ccd1cd0fddebd5b
SHA512 07b9b308db201b16110a755c1f68f01a4e95ba4c8ed380b3381c8b330953ed22480e9d62bc7dd400454275b634bd99b0239f7b80f0923db7bd4ec06247ed3418
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTd66:A3k03kHRJJ
TLSH
T1F915AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 918KB
SHA256 9538a7657bba0f5bf8f35ab0bc0ce5a31f784f14e2e2231292fe12c44a43e3d8
MD5 50bfb7e1c74cb8dded38ffaed16b9240
SHA1 91351100dca59c079fda0e21c308be426332d4c5
SHA512 f4a6075b7047a05f65b2f1d172eac84fa9d1ac3bae8905475c758ab3134aeb657965cfee40f0344033511c201fa60f78d516659e6fec9f6f51871b414184d54d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdyN:A3k03kHRJw
TLSH
T18E15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 918KB
SHA256 b2bdf70b9d2ab79ee8dee4395f200b6f63984d4f2a4317a53401db023d1bf38e
MD5 c12db8275a666f0c36b7feeb54754156
SHA1 1a9a226a078d79deb3a4f17382c74d125efbb980
SHA512 aa6b5cb5babf1eb7f8791d69f0f3d261a35102a744b01892d7402582c46ef60b81e3fd5fbe14eada77ab140fc5e89230ebe105ec18d1d11330bfe9d50d22bb68
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdof:A3k03kHRJo
TLSH
T13115AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 918KB
SHA256 b8e86d1833d0467da3b2ded6d31e1f4c2132fce40a432d339accbb6be0d5c623
MD5 6d9835005336203f40d4c45ec0cccfea
SHA1 4a0899592c32bf60373e5358616c82bd693862ee
SHA512 5e0bbddd8241cd211be95b43eed84da88ee6ca1db4cd8bdec1a7ebf70aa3bd3a3843ed0974a9f8051feff44b485f5d5e7dab10a216a5993cb53800558ed67918
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdCo:A3k03kHRJV
TLSH
T14515AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 918KB
SHA256 799e4afd806b347fee4c313567fad9bb2b0ca4488b4b3075701152b9df44b09e
MD5 64deb212ad4b07949f595766dd27a724
SHA1 451343a258eda04291f0101dc4d8733d6978535d
SHA512 60046c64c3ec52309e29c46c598f9e6a3cd6d47d01a5ae842113d976cbb26e0b142ae46eac4d88786815514f0c2ab949c86cb8a92d6028bd778c747bdedb6b5b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTd2u:A3k03kHRJX
TLSH
T18B15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 918KB
SHA256 deb8ec99ec7a7320bb4b88ebbbba512e593ec5d42b80b99da7a2436ee66e77fd
MD5 06e4206dfb0bac35361ac64bbcac79ab
SHA1 87f1c40cc7309eadb73a1291353f5c5f07b01404
SHA512 231c31a58bb6b19a878383edf625080fdfdddb0206315acfe20bfc1a0754bb20c2c3893e88151bedbde5b0a444ccff5a29a930950809322cc7de680e1a3423b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdq9:A3k03kHRJ2
TLSH
T15415AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 918KB
SHA256 5349eeadedb6310fb1fdb4b0f1ccfcb54df4b9e311ff2a5b2af49601aa0219a8
MD5 d5826ac44fc3c07acee21e894789d1ef
SHA1 70607ae509939a04081d8cd0d187db7cb2383cb3
SHA512 e81ac7b27b4d3c1a97ee12e2388bcfb3ed9a6556fbe15cb0a74cf43ea4367a4f302d9e74e11f3138b3464bb5b29ffb0158dfa86d395645b6870f7e8d52830720
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdqc:A3k03kHRJb
TLSH
T13615AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 918KB
SHA256 4d0e7eb77d62ac22c67ed8026681eadd8d38946a00a4cbd3245187df246ff492
MD5 05b5efcfd0d2921129f90675094b4589
SHA1 3d1edd15fe09c968a1bdd12d3dfe923822a36416
SHA512 fb1a70c207c4e5e73c073bdbfc9dd896bc506b3d9d21425f198b3184f064cecca041e4012a2f7480fcaa9a4447655ae892b4395d91f320e76a8116c5e8d647dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdjp:A3k03kHRJZ
TLSH
T13C15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 918KB
SHA256 3fb7c2cd9f9cb7fa259baf31588f651c46d7e02e2dd720e87f792da13cab76d0
MD5 087bb432b50abb4d6dd6d3f96b19adec
SHA1 91b23d9638f780a364ecea6827d004488cc1e205
SHA512 9c1f249ae6ac9d14439cd8c063cc0fccfcca38800e824402333d623a32a2d33edf293a591d72c54e06856ba5bda35f9d8a0295b06fb68f1ff07efc450dc0400b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdEN:A3k03kHRJC
TLSH
T15015AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 918KB
SHA256 7f8dfe2b28059c84b9238be100f5b1d5fac5b823bd3c84a88d44d72828075dbf
MD5 a42db10e275f7a3ecf9b7f112492b82a
SHA1 8990ee5f097bd2f22cbf74cb4a04f95aab4ec151
SHA512 28d4e4ef2d1cb94fc28d9b285a47975e9975ca62118fd63fe691571ee7ad4ee9da8e5435c04a856b55e2a753194a0b692ed737939939753fa233688e9d056bcd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdsF:A3k03kHRJo
TLSH
T1EC15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 918KB
SHA256 d5419d293380ba751cbc370bae4053a45f75fea65d1c33b12da5150f2a16219c
MD5 0d6625f8b9bdbd4e27befc1186070145
SHA1 0fe845cce7a70a186f6a317582c3fb53efcefe8d
SHA512 8bd4516139ddda08dde25bcf5cc2eb4c3654377be2408fb357bbef2c2fcb35a4c80b65d7eb8c1ea8ac289431c88b576ed35135791fb21a1da675861b9e75804e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdZC:A3k03kHRJ8
TLSH
T1B815AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 918KB
SHA256 46f235f9b2e926222247384e6db9ac0e1e8cdb055c0ae33a7efa4281d12d0199
MD5 3c5c9cf794dbf1497dfaaca940c1d28f
SHA1 1c13dad8de82c7799de6db9bc4f488c504b5fd84
SHA512 9e8d41a35780e4cc51c39fea7cca279bba0b056bb7a1478ee1613a02c210c71a852181532c44b46877a31244baaadd6e3c6b58579eaec226047259984cab9ad2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdaw:A3k03kHRJx
TLSH
T1DE15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 918KB
SHA256 d8daea6e4f9bc2d061704527690ccc925c9d9e3a46829459ce6f5ec0ee9bab99
MD5 bede53a37fe12fb22a72bd3aac3d0144
SHA1 aa041a14890e07a2c2829c4ddf99ca06b1aa6406
SHA512 e7a6c001f71b5f19d213f7fcd93bc1c6966b378010b288d0dbc865667020eefbb3cac19e7661d13059039436fdb286b4c12ab6d856fed026c3c67b12f2ee5d65
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdhT:A3k03kHRJl
TLSH
T1D115AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 918KB
SHA256 14a66604222c1bb7de4bfb39262d002c5ae30931a5bd2bda67cf765f8eab684a
MD5 1bb0e582e7119b1661a5867e5a928c3b
SHA1 fe1dd04a1fac2ce8a9e9a71cd134984f7e865754
SHA512 afd28732e789b9e4f6ebcf8f53400466728fb45106051e15c7a9085d96cd9034744babc006111e7d6d2eee536c22017f3c07898c3bd98b2a0645e2e07f73a59a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdPu:A3k03kHRJa
TLSH
T11B15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 918KB
SHA256 ced3c5dfe62654f732d24bd5d3d9e55b2aaa880bbc3e03eff90cad0e8ab48665
MD5 4dc7b6235461025d8e95dd2d90488cc6
SHA1 0fc2063520bf2bf50ba9ef50ca528caca1b5e74c
SHA512 66669dfdd0fda3e1fb959e0c0e05ae66179078a5cfed765ac38a70f86ef7e1360608d16b27adb7f2cf09a6f74423787b976ddbbea3746fbe77e4e3d4f5ce0e19
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdzb:A3k03kHRJ7
TLSH
T19815AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 918KB
SHA256 ef2217a28075ce8a9c04bacd68caee40229b0811829bc312e660cae6bb7548dc
MD5 1115cccc1050b82083b1984cdd38773c
SHA1 2a6e3f70a6188bb4a82e1bf1e9d2bf3341402b7b
SHA512 5e62b71d9144a609e63fe15111dac591da6bae503d830c28b58fdae79bb1d8d8194b22a695ae59c3004babc455d888cdc2479b40ffb3fc2cf24bc47ce8939e5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdHf:A3k03kHRJD
TLSH
T11115AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 918KB
SHA256 6f3db5dd88c4d9492efdb9efd5447b57ad52d041a65f32ad24379669735f9b03
MD5 7e72b599ddc38e033a48e1472c317269
SHA1 2ceadde52c6ba5f1516a2020587f787541103414
SHA512 28584970f6f7cdd57cb7406fc13b91ae4b46ece4feab49a230bb68fd5cc2bacab86a0e32541b1c88be9ea9706a4dfdf0b0058039a151a81b69ae54778226c821
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdwK:A3k03kHRJz
TLSH
T1C015AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 918KB
SHA256 b70d43c0862a734fab59170baddb6c54b955bc86f0708c5dbf9b3c025884256b
MD5 0e5fea95874539b3bc5e14a634f216e1
SHA1 b23caccc36cd8196d844c6b85c58045bc9bdbda9
SHA512 12d0019d5acc01465a9efab2f73c4cf8abe6ee2455eec54952dd3611e70e80fb03c152c9310947b6aeed14db95d699f6f1ca1eed81a02b95078ee5dcd9329468
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdtk:A3k03kHRJe
TLSH
T1F815AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 918KB
SHA256 d90e8b194a67de0d7caa2f293fe40f3556afeb5fbd9d0a493ab8735196661abf
MD5 a5fd67b34b4750cc9fabf95e787855c9
SHA1 8cb368bc2a55b596d15972c01e7bd95a3c15bd7c
SHA512 416b88d7310790b15cf28ea44ecdfbfca3f76173adc7c61d0b970e764a959bc868cf202cf580c9901e0a13bc46dfc26d167efb4ce919f86d8f34d264544b749e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdy0:A3k03kHRJD
TLSH
T1DB15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 918KB
SHA256 233a85abb18bed3b2c34b06f3c16166824290860b20d8efaa7897d13752668d3
MD5 088726b2518e2f5f7b8e6ad7b836cbac
SHA1 0befcece4ce83dbf3940100ee6712207c4611ce5
SHA512 d45356b779d932793cef29131fcf94a2f3af88c819f4eceac5757d79ae7ee1573b581370e66dc6b2dd2215aed2ccab62d364d99f1ef5f423d55193deb0ab8e1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdBg:A3k03kHRJm
TLSH
T1F915AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 918KB
SHA256 83b4661d176ed62d146fad2760c705624d82425ac7e87c061895d6c0027964d8
MD5 25c50b9622f43b56c1f66ea75fb03ec5
SHA1 ebb697af6212521a27e8b01d87582fec9d8adb2e
SHA512 8a2fc6c36f51021c49069a3d713739822538ee9156085752ad3fbc687460b7bc2e973c5e0977e79ae7a5cfb6e395ad644b83ab961bdb782ee7f82e851965c3f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdor:A3k03kHRJo
TLSH
T1AC15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 918KB
SHA256 9f3e7f9879e40f46792c373ca8811b7d57d2ce3b6309ccb7519c25481c8e088a
MD5 10c8873b0404a5d4a7230c28da157ad1
SHA1 1a20610378e9fcb761739b574e9e4032800a9b59
SHA512 bd55e19109049344a0fde7e18a2c4150f950bf6bd4f8b5a50492955765f0ca12db0ae502450de870ff07ba56c21e392798159edabb0ed53025e1449be65d4ec8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdGn:A3k03kHRJK
TLSH
T11B15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 918KB
SHA256 f840ff0fafce3819d20cf868f1b8b7722803cfb9c3bd3019a84bdd37ae582c28
MD5 7e309f8e0fcbd4e42d686aff9439cac7
SHA1 80ab1bcaaea2c1945bdfdfc6f0a88d98d68e12eb
SHA512 b34b8fc3df8025b36a098ca81c6b2f1dba0b48a49247f9bc8e9bd583fadc75164f01c9f2f0638737d4aab69921b2e69802dddef3d0a39ce108bbd77838057e73
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdMx:A3k03kHRJo
TLSH
T19E15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 918KB
SHA256 951a4ef50051e748e0cce33f4190974e03a84d9e0d691bc559d74921decbccfc
MD5 9217669ac9276b81ff265023a799deea
SHA1 0a01fe1ba1d0fa560e76842736b64ce665bf32df
SHA512 afcb8ee0c4212e5424c0cd5234b97b370180131c6aa1d6174d7e6e9b0f395bd184f6d5e47b393001e9fc0753e4114fb3c47a58a8666734246f2e5bc8be94910d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdGA:A3k03kHRJr
TLSH
T1FA15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 918KB
SHA256 b297cc1401cd32386704776beb2255050a0be86db49b67814d740d4fa9280816
MD5 bfdc36d862faf6b719aaa8a0c0fc0bf6
SHA1 5158155e5a43e0d077298621c5348673c904b9da
SHA512 bfe128e8ef07ccc46afac12056d79f0429873ab720d2568ffcb78dfb2a752ab8a208661e8d9ee5f27bcf82957a0222cef5439ec4f40f2179166ba4cc974ff953
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdf9Q:A3k03kHRJm
TLSH
T10B15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 918KB
SHA256 d9a42f4a31ac06ebaa5ad306f9a3fdfc969878e5df4af416d97d5b116df83cdd
MD5 0c586598680c9602489db7e3a868a109
SHA1 e74ec58bbdf3fe90d0875fa91d4c65e58e594cf3
SHA512 6431dafd1b58642fb09a5a2b2110267e1ddd7f3f11773019b9137deb7a2877a861e32eb1cbe40ce3cf0851413452453113334eca4be393f8c2b5b1e9e0a4f73d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdW4:A3k03kHRJ1
TLSH
T17315AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 918KB
SHA256 5ae10e9347a0de53cd3199f96256b7f9b7af9a0bde5dbe833e7b8abf949c9c92
MD5 67bae1a9b5e7ebdeaafbe3cafd1ed0ec
SHA1 d7c90caf9c5beb3ff05e63a650220343decf1eb4
SHA512 d66b7bb7b7ad9c441df870b1e1640ead16d767a7767499e2fe340ce14eb0685df793a8593cbcfcba13288f7effa45342d0e05457868321ac8111aaedd574df86
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdFu:A3k03kHRJg
TLSH
T1CC15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 918KB
SHA256 9b2adfea33eef178040085655e5e22fdadaa48b40e402ee82fe7fcdc5ae23f42
MD5 88617d156dc1fc6c4aa0c70b241bb929
SHA1 ca5ca77be860cacf753f9aa9ce68d8d41d3d97a8
SHA512 c30b595dc674b006a007ea1f862f3d70bd88092f97e77f5c2658b8e99778f83af6d103b39983b4cd6ffd9f42ad18a781922d24c4db5ec1759604775b9516a4a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdYj:A3k03kHRJ6
TLSH
T16615AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 918KB
SHA256 271d0d3e2a600149faa0c6b0efe0ad0c3958bc164547876a0933997f43b156af
MD5 0ef5a650d065df7a20b1d65a12661b24
SHA1 8b353167b06ca9a854708f736451be2ac0090bf6
SHA512 948f7f4dfff816fa17f28e72178256ea9a99936aae829a5f3a421b1c3260e5f8e10d948880a7b322577140b1ed45f3d832af1a7fd9abc38af6ca4137d0b76ef0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdpg:A3k03kHRJO
TLSH
T19B15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 918KB
SHA256 52296e5b28fb8c081c9567a835516b080a59e112e6a88792180737347165fcc4
MD5 67b3ed7c1934b9d3492c3a52d189c3b2
SHA1 f6ae86643cf14a7f7d985c6e2c609beb239777c9
SHA512 ba32e76a0b8e9fad35870426638cf877988750098e55720ce10f4a94a138ca2f34e845032599b27dd72b0d027ced0f5673db446c69b50071c18611d557238222
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdwI:A3k03kHRJH
TLSH
T11015AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 918KB
SHA256 f8f419c23a55db701c0c33dccb0c188e02d2963e4036aa86ed8af34e91e078ca
MD5 6c10b81d46600ee4d789de6d45b69168
SHA1 7960c1671b2beef06f8c58dbef7a171d5c6969bf
SHA512 74ae9af10009fb88be9f4e50a5c333d15828fb69f1a443a59864cda1b18bdd20a214088fbcb630b1b30e162e5fb3ac7a62eefa53188e2bb001c3dc848cc638b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdyo:A3k03kHRJB
TLSH
T1BA15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 918KB
SHA256 d62d5a05e11d4e75efee1dcbf7055564b383c1f166600ef1af25adf552577b0b
MD5 8f789a603c134e8e58ca187e86a88cd1
SHA1 996c0c5d4cdf92ffec1b97fbfe01cf72eeba1bf3
SHA512 278efa327195a82136b2d80028415aa5b6312c1be8cdf3ece750bb536112bd864030c9cefa45c0e9a91834f484c133b9947d16b9e48fff1a5fa20bf22e57cc84
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdp+:A3k03kHRJE
TLSH
T18F15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 918KB
SHA256 c168555abb1ee25599414a8aec5a721cd2ad5c118b81c9c4cb69ad0994e99a8f
MD5 57adab7faf986d169c8c2d50e3fb7e4f
SHA1 b30cb8e787a028f8d8ffbd7f9fa09d5706e458da
SHA512 e8db639cda345dd14d708dc5106b03dc3e07929bc3136b9e56535002c1d04e041a0b8ae80ac74bc3c861c8ed1e2293a1f87b2646946a82ef71c7050c6fcafe23
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdXQ:A3k03kHRJM
TLSH
T1AA15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 918KB
SHA256 25ceb4d835f440d18c3efddde55f86a9e1fc3aa767e21c1f25b7c2cf1d845212
MD5 dd52ed5353b5a271468a5ad44e3878d5
SHA1 42090aff0b7000920f8fc7592eaf8bc7b4af02ee
SHA512 43a9b6b447f819c0e717cbb946990adaf13bd2480014a493d777dac08dc7a401b721a08a65676a705d62c7b29354df231340fedeb3896b2b9df16687d6be2653
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdsX:A3k03kHRJM
TLSH
T14E15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 918KB
SHA256 78a2b182e8827f790d186246959f705a65985e4b36add80d5f824f8e65b764d6
MD5 af83b50a442d9047852cf2f6d365555d
SHA1 97beaab15fbc5bf4ef8d90be7fb32482792165da
SHA512 8702468cef92c8e394751fa7adf1bfa46d1c31a87a99baf0eb21e262b7326520633a902e859fc16a7d0d0448658c69521149e55763a510964fd3d4059a28e87c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTdKL:A3k03kHRJ2
TLSH
T11B15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 918KB
SHA256 b879678612e4ab5b3d8f476de21937080bbdf83826172efc3a1eddea11958900
MD5 dd3375e751304f844d260cc1038a02aa
SHA1 acc98fb5edc3ce60aa588ee58d49a659ce90a0ed
SHA512 fb4ea438ef756df3695b080a62417df1daf7dde1cf99d72a9eb93e0c4af1ae07e4b8dfcfab605b8364f83463260f20fe60109889b9ad256fae813a0761c4f6e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTduM:A3k03kHRJz
TLSH
T19815AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 918KB
SHA256 d9bb9599b8c9e06895130b467893ea7d4298d6e854a3a7c897535d71ed2d9bde
MD5 928b0b53c3106ddd4233f0b0c90dc65b
SHA1 f6e51f0c91286c9da23eab3db5596e488c025597
SHA512 92876a66594e6649cb74cce071d85057a9902e801904c88211a9ebddfe49b3f26b1927119486998363a3e60ea95190ab6932e3342b75ab30b80315f7f17547f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTd3h:A3k03kHRJt
TLSH
T1DD15AE13EB9504E9D10AC1749AD68A23FB75BC56276093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4164-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4164-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads