9e11b0a6e364bbd9178aae1f41217ec2a3f0a43dfadc10a6296f7fab964744e3

Analysis

max time kernel
89s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 867KB
Sample260826-p4tncadr9v
SHA256 9e11b0a6e364bbd9178aae1f41217ec2a3f0a43dfadc10a6296f7fab964744e3
MD5 b37856b53d7df444c8b3459eea2ac005
SHA1 b2432e24d8e9cdf2b41013fea5024a2642d93c49
SHA512 998cb06ee065f5fefa32d4e7912c58475bc4c8ea86abf45ee32814329649c4dfd112e66e5d6597d00e2376bd853ab207695d6fa04d61e0f81ee6a2ff74b9030d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/6:J/sCv7rTiw24231h6
TLSH
T1C0153A13A6ED0654E6F266304CB54241DA72F9591B30C6DF15BC8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5184-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5b7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a65-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a66-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-432.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-597.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-713.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-837.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-862.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-970.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1161.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1236.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5184-2141-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4380-2148-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4380	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5184	2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
4380	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_b37856b53d7df444c8b3459eea2ac005_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5184

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 867KB
SHA256 9e11b0a6e364bbd9178aae1f41217ec2a3f0a43dfadc10a6296f7fab964744e3
MD5 b37856b53d7df444c8b3459eea2ac005
SHA1 b2432e24d8e9cdf2b41013fea5024a2642d93c49
SHA512 998cb06ee065f5fefa32d4e7912c58475bc4c8ea86abf45ee32814329649c4dfd112e66e5d6597d00e2376bd853ab207695d6fa04d61e0f81ee6a2ff74b9030d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/6:J/sCv7rTiw24231h6
TLSH
T1C0153A13A6ED0654E6F266304CB54241DA72F9591B30C6DF15BC8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f5509092815ddfce5da841bc476ed7464e5778594b9f002fdd4cb554161c9a5f
MD5 5c3f21b90257094ad529831f40850799
SHA1 b040a32d84e0e90e51a29637b3ea81ee8928b372
SHA512 41be95a4b42c29a890ab389c1b20ac26a28160659286f6aed3f3443303232cb5e7b6d77dbcf898598f00dff2254b8c59099fbeaf2e17593a160dc0c5964b39ab
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/GXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:J/sCv7rTiw24231hK0Le5ji0hmxNrM
TLSH
T17B654B16F6F84761D1B3D17488E19645EA72B5461B30C6CF12A8C73C6E23BF1AA39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 881KB
SHA256 92005d9ca5ecf9459581b7b3b88f1d7756bb81d8ca81ccc7e6f0aa0b26c93e56
MD5 d6e9208180498c8c1c76a71ec114a641
SHA1 bbebe21bb2a472c955712977c1095591a2ab2d52
SHA512 c9b1939d39cc7679e94ba6ab27434fd9daf9b33df96e24706dfba8a2ccdd34e670184275c4865d957b5bb91c70c7541a52e788c538c4b53e251e23e438783d61
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Ea:J/sCv7rTiw24231hEa
TLSH
T164153913A6ED0654E6F266304CB54241DA72F9551B30C6DF15BC8B2C5E33BF1BA38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 890KB
SHA256 14fef9ef4487e4677bbf04a5548eb1c4dec2c742ff96096a2a51cef5a57dfd70
MD5 db9296db3160b8dddb8a26dcf1869369
SHA1 b55bf53a124437e4c6ac09e4d2a3d52360e24b2d
SHA512 0758ffd646a130085d1242ebbd08524032c23449f20663daad0783c4e62a08aab7520ea0d69a7038a0b0af1bcdffbb2111bab53d448e68ded45d5486c37c80dd
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/96:J/sCv7rTiw24231h96
TLSH
T1A4153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 890KB
SHA256 b9fbb35c9893f7a708d3deef7dd9adaa4fb7bdc52dcc98bd5116c0dd2f099538
MD5 3cea03133f2e94e0808a8a2486e9f44f
SHA1 76df892207e06c4ab05c8212fb82b5ca50091f53
SHA512 9340023e56a1722a3ecc74bec771f25a2fb36a02e31edbb73c5d002a5553de8fb3a2d55b98a6869680022684c1e4b7322ea819fa28ddd9e0e6dde886e9d0156f
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/TN:J/sCv7rTiw24231hTN
TLSH
T1B5153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 890KB
SHA256 130f78f49a169d6d4627ebe8a5b4a3ec94fd938d8870fb568bbde3ccbd327f5f
MD5 629282fb508d5f79f151671e6a2c329b
SHA1 bec895804fc3ca1ff844c68d5dac77ebcee457ed
SHA512 696b6fd2daa640bc083c9417fe84daf340b9f98022d606bf79c011c862d0f00ace6cae0ce0fff3fd3f035f1edd8f5691ae7e040cf24b4ea6b7036cef33339f67
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/hf:J/sCv7rTiw24231hhf
TLSH
T173153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 890KB
SHA256 1130495432bc56fff504c3c850564428b4194c090a914048c4b4984934ae1bf8
MD5 f025120640fdac3d183704b857612ac2
SHA1 821d4074a24a2f944aa1a312a5aae6afb5f38e64
SHA512 d3cf144905c0482c902ef2cf59efeac63f29fbde220a060275e0b8374343b6e9003431fbcb75a5f1af7de9a9afe9e95e8b1c650a7261ade18508a970110278a4
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Do:J/sCv7rTiw24231hDo
TLSH
T109153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 890KB
SHA256 2ecfafbef0d9074bf4952026046a7c4c5c497dc191aa1e3f9afed271e196ec7d
MD5 91829331178ef205ec6bedf33bdc344d
SHA1 3a456feb137c7ad9cdc7ba6867166241d4dcab5b
SHA512 d8b5b05bb3444cd6578240ed3a9411b90a51b5edd9dd3607dea2ff9bd2fc1a9033333c8e0a02551820526d951c116ebbcfc52b1172feba811460f0b87a1bbd73
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/3u:J/sCv7rTiw24231h3u
TLSH
T121153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 890KB
SHA256 7cf559d94e48acecb98d2e06255045e8e167e3f2e88091192716c602bda81c94
MD5 286379803a40bdb2cab8a9b13a008106
SHA1 bf6665631a54617b1b91b5d93acc87b5dae87656
SHA512 afa0f0ef8cc5fed761655b4177c3586ba9a53a5749555a0c16a3507af883d4cf1cec2b4b041cb839c9698476450445c9ad7ce75a1b337ebb863292d8565e187b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/F9:J/sCv7rTiw24231hF9
TLSH
T1CC153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 890KB
SHA256 12f08f517a1760ba6beffe7725a7925b5bff14b7604313f343ad5d5af164e150
MD5 9f51b56bfa5991ce301627c45e6ea65b
SHA1 6629beba8deeac00d10d5e14918c46ff336fab1d
SHA512 7cd6976502fcc26298363ddc90b35134d428a2cb81565a36a984119db5580472ec9250a19fa57020de789875ad2724907ffde2302aeb6356a344f63baedd2bb2
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/hc:J/sCv7rTiw24231hhc
TLSH
T1D8153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 890KB
SHA256 a6311755185f0b25d3a34041c821eb5ae8d5446bef8a8c9f6cb86479f55a5f30
MD5 63968ff8f800d9d40ff3aa7491ff2297
SHA1 fb27dba16a3ba2b5f577526802e15a75574dc8e7
SHA512 88eba9e14d0cf0b931ee1ac1ca4fd46bd4a857710d2752d4374fb1b673fcc7ac533d541347bce55d456e27081a12d6a66b9224eb7318e0f2e1b936d064f54724
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Kp:J/sCv7rTiw24231hKp
TLSH
T135153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 890KB
SHA256 de45d54a25dfd98ffac85d4e223015ff2f4ebfb6911be94414e3351a16936068
MD5 ae659b2ee050f39c802263d2ee49814f
SHA1 f7f86d9dac83a5f2a810b3e9391ee18449fb3820
SHA512 b023eabe2b93f4215c48c75df6516170de5b248a3006669ef1f79cd5150a105a2d8a8a58ffd9710aff1167a3b1b05d928fc27809ac9c61dc39836812b18b9baf
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/t0a:J/sCv7rTiw24231htN
TLSH
T115153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 890KB
SHA256 bd6f8a4d5cd15e39635c313b7a4786596cbd9e79ccdaf1e99da9a4f998faacb1
MD5 f101f860c9f3b56345c62141cf335ca1
SHA1 ef0a45dbf8eccbf74850b07683d382d4dd120ed3
SHA512 98d0d5062a1c5c21b42a6c5ce98076d010a74ea9f771681fe73b74163c6786d65ada489735b89864d8d522614ea8507afb3fbdea7cbfcbc7ae3ddbbaa5260487
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/fF:J/sCv7rTiw24231hfF
TLSH
T100153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 890KB
SHA256 2a74f2a6c9fbf2183fd4104908de3beb4020f7c3e802fcf3dc9d2da5072ab4cc
MD5 7ccf7a0e9ec821167cecd6d66810fed7
SHA1 bb4c29ce8b588cf4a5d1793b4f40daebec27c83b
SHA512 c33207657585b962a788948fc4b74a16548367d4f0316cfce2abc2134a344a53d17d7a3c2931a5e4114475e158564a5931d1f9019195f187c5071e09eb3e7e83
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/AC:J/sCv7rTiw24231hAC
TLSH
T11E153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 890KB
SHA256 4cec17e0457105ba2bf8b0c8d0ee05c7702f5877615cad1e496da1079b8e932c
MD5 a3c55aedfa1587f45663ea74a672fb40
SHA1 60ed7127a191c30af684853ef5d300b236635f43
SHA512 da6458c98ffbe94eeb1cda3dab20594ed3b587a46daa50e4a3f2e756012e148e68d387ff57776fd6553dfe4ca24df10e44fbc4063265b015a2cc1d92069ec9e7
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Tw:J/sCv7rTiw24231hTw
TLSH
T192153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 890KB
SHA256 3284fbe335e71648c979e8c1c56e8f7efdf65c601e4d6097bbdbe51083887e89
MD5 c90d89c057a7b59fd5492dd0878bc064
SHA1 26aa8634726e870939e6e89b24b884ca175737f7
SHA512 34eaef7f8bf929d7a07b5994cf17f11c305a73e9b3a434392c8d5141c9bfcfadf20142d7078d3675b6806e5611db1feda19e08fa19946cb5f16c8476ccac6438
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/aT:J/sCv7rTiw24231haT
TLSH
T15F153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 890KB
SHA256 8f7d212b891e83dee2526d24a1c76c53698dfd9b03ba9d822bdd492538b5108a
MD5 bc6310c5317f08c3dc3a2c035c4c0dcb
SHA1 cf4272b9d5e27058c4ed4d2cd619e8ce4a4be715
SHA512 1f2eae946bae4cb21e3d8eb5543a4bbf6c82b252bbd9da266c4f971c54380f403168ca8a8e1096292eaee59e18dd7f95616fb3ecabe618d649e196091609b49b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/6u:J/sCv7rTiw24231h6u
TLSH
T1F1153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 890KB
SHA256 7bd72a6cdca8787551c2c2b0b820fa956b51a1e2d4526a4d2ad46442a6d5af0f
MD5 5e3ad52cddff3f062044e85b1da82aaa
SHA1 248ecb3c15ad393664b85026babf84ab2ce5c8f8
SHA512 a819f6906e4740a09aca01840e398d6fb00c4b2c488c54122f13b3bdd6ad13c7df565e648dcba0bef03244dc190825ea44af378bc40cb240fb212f1d006f250b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Eb:J/sCv7rTiw24231hEb
TLSH
T1EF153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 890KB
SHA256 ffea3e7af3f0ff7f301986c2d9d534d10d142c5987a244c145220545ca768bba
MD5 bbb3cc047ad179670d01f624dad0817f
SHA1 f8cf2f5ae9ca30eeb491f2a0b28eac41671b18fa
SHA512 36ebff246092aee7b33339db6b7e60349d3da24ed0b8ab41fc3621cd268d6ac7f63936f9b8e930c14911e5c8f0021ffb2c56f8803d305ab8db7bdea55fa66ed8
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Kf:J/sCv7rTiw24231hKf
TLSH
T1CD153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 890KB
SHA256 139a54a7204d0c4d653672a1bf1278f408b61a9024d21d4ceed69e07d2236490
MD5 1659077f02ba39bfbcc5b4f725b610d7
SHA1 203a230584f437e0574b01e82ed941ccbb07d856
SHA512 41a5f9071db8d00ccfd13181624a9ce4558dd4acf8819650d6830127c95d3df99a1b6e474e64672ede6923095e7a891a94bb3502244cfbcededf8f4675ca3f7b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/XK:J/sCv7rTiw24231hXK
TLSH
T114153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 890KB
SHA256 52b728d339d0b74a10fc208f87a88a9cb5dd8052062cabeafc3ea225c2dceaf5
MD5 9314325ac01132ea22dcfb1b9b1b38bf
SHA1 415bca47a81ad236a68e064c047e07f9dc276aa9
SHA512 cf2f66961921c8cbc4c6e7c5e4a7c0db26906695faf009c2b409a8b5b92d6fdd249c7a18149b5db3e545c934494604f44c085aa17c4ce1ee6121ee8fbc117faa
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/gk:J/sCv7rTiw24231hgk
TLSH
T174153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 890KB
SHA256 c9b99c2cd527484af00f11479aa0c8def0caf6c820d6a4f0cb62db047c9bf972
MD5 23775e40af3a2a551fda91ac4f137de8
SHA1 0fecac76cd4578a18427fda3ec9aa810c725fac1
SHA512 b25ea6d9b95eac38251c2a508c4aa35711c24c8b5beea05c32410c0c40484713dcdc482a6ae0d593cf3bc928b41c384a15601350288224e5a5bbfdc806138aae
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/R0:J/sCv7rTiw24231hR0
TLSH
T145153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 890KB
SHA256 335a035a2499cdcc348a05fe32e912acf0ef4f07392f11edfd5500a26fd0a3f3
MD5 54088326ab7b81b8b9ddb40a3705ac83
SHA1 246bd7523fae8267d97117ba57927c2c8cb6ecab
SHA512 67aa59ccabca80eb6efaeee2c6a9d30c00633c6e89ed04bbb436d0ddc9f98fc050f55db96550dba02b1744561ef2e040ae00e694672a1ba5fff6019765b1e9e6
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/E70:J/sCv7rTiw24231hEg
TLSH
T1DA153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 890KB
SHA256 d20d42be917edabf983707e8a045a078a33b7385d6f89c4752ce93d991c90416
MD5 ef9557dc9e764814b7bddc7b33db590c
SHA1 bb61962a44985931a663748cd19be993f954b39d
SHA512 422fa63e788140dbe252053a0e78afdbf157952fd342a396d34aa5d82571d815aff7a4ede80e1f6d96e69449cd1064927b9b6da7b9be5f075ab94e24dff91bae
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/hr:J/sCv7rTiw24231hhr
TLSH
T175153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 890KB
SHA256 61b61c2aa7526407a2288ebc5743e2d586014bbd8f31a65148170b0d5347599c
MD5 fb03374f6c59467f2a47bfd13a01c82b
SHA1 4a14a2b4ed164fcb1c05a156f17b9ce5fc636b42
SHA512 029208b6e6de1f7c86e7d1e1a325fd41074bd95dc8bb0f327920ac0c48db74dc029bd9b417ef55a77275ddcb460e611e25b3e5dc7249f2b346defe5063cd9d35
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/jn:J/sCv7rTiw24231hjn
TLSH
T147153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 890KB
SHA256 9a91cdead8581ffa47f5649d764833432cd744a697970d4a40b42e4c26b06c32
MD5 d88325dd0f9afac4d58c71babb0d099e
SHA1 27fcadcf65bcda88580e6ee3a2fa18989cdc1673
SHA512 a2a1eb1e1ea85b40b167f1399db33f8c9a5653c9529d344b4833d2d4022947271ab6e8ec79b5340384186f3d3f4b20e401a2e4c0fdd6a7a39a108ab5136e9929
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN//x:J/sCv7rTiw24231h/x
TLSH
T115153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 890KB
SHA256 e2a4b9f89f5ebd7cce5e90adc35f0fea268213009262ac3d1d612f6903e8d89e
MD5 ee673c0f2cfc8fed02d8440cc749a795
SHA1 8d5a8f44d0e9008c0931282c8386c48bfbe14ba8
SHA512 7189343e25a07a463351493a2f62ad244d2bd0948563e4e7a26a4bc63fcf7773e2dce4d5562a7814b026987482e29b795c8f39642173224c61eb032611d01705
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/lA:J/sCv7rTiw24231hlA
TLSH
T110153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 890KB
SHA256 6c54a628285b861ab977035b395393b1878e85fdef3c4d7dc7464371a9cededf
MD5 bfbd2c5f30543e4cdb752a03aaede679
SHA1 3e6bdfd9530c2a0b18283aed52e91d94bdd67044
SHA512 b38eee0e10edb9785d52210d717e599b096c68604d0de0336f0f3ea96649d2f131ab55f49639587031587e24bd2b1a4584a5a3985993d3acdbc5b6e5bf4f3f6d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/e9Q:J/sCv7rTiw24231he9Q
TLSH
T191153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 890KB
SHA256 644cea97ca1cacbe46ae97f5a4b5d472b7f7a5db8174c05a03e33ab0aa66673d
MD5 cc035c6643477bbf327e447602cb8f53
SHA1 cc0d1e7e5f85ef69a212da647f6cc7de78013dd2
SHA512 0b3cd0980935e6fd87be853a678723236173d83dc11677783ff1ea8665afa9e793681945bedfd2bf0e791ac3a55b3224548b60020db76d4c9df9dc171c631d79
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/L4:J/sCv7rTiw24231hL4
TLSH
T17D153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 890KB
SHA256 dad682f0ade0034a3f5c43aefaf4a4312167af221d587f23d0a36ddc2c1c244c
MD5 4b4691b1b5be265e93e00b9a56e08b79
SHA1 efc7dcfe7c4a4b98c04df2144b1ea8a30963f08f
SHA512 2ac5299a6978f889aae751c6966564fab77e96ca00fcdd38841ac02a7ebb314b563753872596dad52a02990475e0f331b5390a07008efddc0e4077a03cfa0f37
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Cu:J/sCv7rTiw24231hCu
TLSH
T179153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 890KB
SHA256 891d972b2c4e91aafb14f4875ab2afdf8b887621fae1e54a0fe3aca50f22b7de
MD5 747dbcf630170ab637863b8051139dac
SHA1 0ba05b01bf61bc4c17ef8ddbb85d4f10d9ab6b4a
SHA512 03f61a1d61dd7a3df441846d4e956b6d22e55082bfd648606d1d4722099cfa3d768ad03cf4de313a88fdb0c57779bb2a5550958a1549005d35771f2b103738d3
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Tj:J/sCv7rTiw24231hTj
TLSH
T1D4153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 890KB
SHA256 20a5eb25c5c5846aec2139e5fb39137c35616efb398958cf7615d79c69e53d00
MD5 93feb6ee9a89778c9100dde979c7d293
SHA1 723da1e076b19b3ae3e2ba2246c6ce6759d91dea
SHA512 e367a707d2934f4ccc321d4c20f6c75a5e1a653601cc875c524156c66372f76d9f43e47c8314fc02c9a6975d9ffbdcadfab18371aca137f82a18923085dd0d70
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/eg:J/sCv7rTiw24231heg
TLSH
T107153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 890KB
SHA256 c4c304b9f22f9fa1c369ec316f62423bb5f27bf9b6ec753fd206c46892a23e63
MD5 34692d0ee9d9d697abd4277edb64bb5f
SHA1 3edb8d008745fb75b8be51b5548f60d09644c4ca
SHA512 fd3f8b29b5fe0b1003b2a5d8bb4011b8f497932fa2fc12eeef5ec786eddf1eebbb6a204ee13db3e070e045bc8d39a889a8793bfca123a63430f55bc42e13640a
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/RI:J/sCv7rTiw24231hRI
TLSH
T167153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 890KB
SHA256 269bd560a8dd889231d6a4ed8d3449c42517431d71a7ed0fd40f9477b1d42a84
MD5 387f6a6fcb19dc05f2f896c1803208f0
SHA1 4770cc03c04766f3b911fe179890ae7f84b5e3fb
SHA512 e322926fa03b8d381e090ede70afbef36da229dba7725521b3bc7da2fc6feff856b6650cadbc1b6f36823fcb44b889691769332df76d61c1bbb232fc00027d2f
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/To:J/sCv7rTiw24231hTo
TLSH
T1CD153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 890KB
SHA256 2e04c5ce981f7e3337abfccb2c0d1378d8e535bfd70d375f8d9ae03cf8d06bb7
MD5 e4dd400d704957a1b407c0cf11749f05
SHA1 88201ead028728177136a68c585f8211521dde1d
SHA512 5ebf5e82368dcf52de6ad5ae0c389fee218f434ad96535b69422083fd274bcfefa00019772e09204dc119992ac914aabac631dba29ac61540106da7df909237a
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/Y+:J/sCv7rTiw24231hY+
TLSH
T1F5153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 890KB
SHA256 3ecc258f710b8b8a70e05d0af4e17ae38410f11aa288d3c17a7c9038621b7157
MD5 0af54659f0570ea2f2c258830dd3be4f
SHA1 87fe3b416a62bfe0084805c30a545ea5781ad01a
SHA512 345e389a603b4e8b04bde4d71dce72bbb5ca0904450a9d749b8ac3770be719f5b16feabf7111fc1b64cb3cc905ec07cf2163198e25bb25c7cf49d9bfdb5054a1
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/wQ:J/sCv7rTiw24231hwQ
TLSH
T1B0153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 890KB
SHA256 133cebc200b5af7b8f51d86daf04bba73b9f3f23d1ed118e810487b695148fb0
MD5 2655bbe79677dacab243d4c3519039dd
SHA1 e6710386b585c70d93275b6d1b0e1a61168c24a8
SHA512 3743397497de548d3ad705e302a4bb9ea4b114c8d6d3795fa8352834390fa0821b1efc56a4a9a0780ae1d7547700b956103f71a963feb41fba4ad13f0eb3e83e
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/ZX:J/sCv7rTiw24231hZX
TLSH
T19D153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF157C8B2C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 890KB
SHA256 d76879214b420845ce9b99a24e565776584d50baa6109bf65a85affaa0d499fa
MD5 7ef1a75b055649d5837fe6c8af2896c0
SHA1 72e6138376ac5d588fdc8954d9327de2f88ae153
SHA512 39ec2c51444d195185c5546049c450e83f9219cbd1f4147e3cdcc1d3d817b47f1c86e659b0282f6ccfff26a9f6348d5965eea9ea0fbe7e9e400cf283a66ebbd1
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/zL:J/sCv7rTiw24231hzL
TLSH
T117153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 890KB
SHA256 19a67def972d915b1fb8fafa00683b20f913b6b8b6d6bf8e3a0a7f50e56fc867
MD5 81c73e33ff4a6bf855a948b2c65b8648
SHA1 9beecaca041971091c87879e03e734ea13254c9c
SHA512 3287cae0cad091e889b117be0bb4e025bc992f647bda3522b6da7b08e9ad4b3b44e4266d970dbb2293d29f5fd80de3ac6b9acf432cd1dbf2b5fb4b219565f07f
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/ZFC:J/sCv7rTiw24231hZM
TLSH
T1BD153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 890KB
SHA256 023e2a285324ea0e84b9adf5df9ed91828233866ec77e96fb8efcab0be5d99ab
MD5 9d6587dd96afc0224c8ddaa5922eb133
SHA1 82d7ed10d57e1bc4a74fa0a467b1d181a7f7e4c0
SHA512 1fcfdefbe69567e38e19ba02cef7de2be97d91a226180695e8d41dd59b544f61b295e9e96c0a3a98522e4704f7ee39c993fdfff90a7192891433220aad8e118e
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+EZM2iN/ih:J/sCv7rTiw24231hih
TLSH
T1BE153A13A6ED0654E6E266304CB54241DA72F95A1B30C7DF15BC872C5E33BF17A38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4380-2148-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5184-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5184-2141-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads