de71aef813f6b0a8300d22beb28110db8b088df259ef923976a58c498b8815be

Analysis

max time kernel
116s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 904KB
Sample260628-2arccags5q
SHA256 de71aef813f6b0a8300d22beb28110db8b088df259ef923976a58c498b8815be
MD5 5ba47322a295ed4245a6add6f24637e9
SHA1 604f2a00571adf5da2cadabc912ab405be5a36b1
SHA512 ebec7714a2edae5cfd8ad49f02e2d8a24ac732a276f38c79b3e2a93d8f1930ed467e0315952a14e5d4a23e5ba213f4ad3ab0a7e70a315e92b0fe9492f32bbfff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tp:A3k03kHRJi56rh
TLSH
T1AB155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/4756-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c597-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000000043d-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4756-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2000-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2fb-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c85-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a28-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a2f-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a5a-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-243.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-250.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a57-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-834.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001d000000018977-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-942.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-961.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1016.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1160.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1192.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1407.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c597-5.dat	aspack_v212_v242
behavioral2/files/0x000300000000043d-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2fb-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c85-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a28-203.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a2f-210.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a5a-229.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-230.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-243.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-250.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a57-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-332.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-483.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-796.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-834.dat	aspack_v212_v242
behavioral2/files/0x001d000000018977-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-942.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-961.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1016.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1092.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1160.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1192.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1253.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1351.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1405.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1406.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1407.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2000	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4756	2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
2000	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5ba47322a295ed4245a6add6f24637e9_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4756

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 904KB
SHA256 de71aef813f6b0a8300d22beb28110db8b088df259ef923976a58c498b8815be
MD5 5ba47322a295ed4245a6add6f24637e9
SHA1 604f2a00571adf5da2cadabc912ab405be5a36b1
SHA512 ebec7714a2edae5cfd8ad49f02e2d8a24ac732a276f38c79b3e2a93d8f1930ed467e0315952a14e5d4a23e5ba213f4ad3ab0a7e70a315e92b0fe9492f32bbfff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tp:A3k03kHRJi56rh
TLSH
T1AB155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 274f1a4e4e1a9039b215125a77f98716f78affe4cea915dcb3cc04f6882e2671
MD5 fccaf12c89d0e2e4b87f4c3c9362f8f5
SHA1 8ac562c0e735cb8b0cc4e161efb21e2fe29b9956
SHA512 3cbfcdf7038ff7e37a35fc61186a195f059721e7061e58327c69882c8501c69299b97d8693335088937755870ada0cfde6c401f9aaca1bed1794d4a994a8307e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TV0Le5ji0hmxNrM:A3k03kHRJi56r9Pji0Aj
TLSH
T195655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 919KB
SHA256 b7d20cca09064f9f26f2314f1505ee3f85d44750d49f3be9600864b53a3c6d5e
MD5 2d3bb1099a1d926ef65968d70c323749
SHA1 a9c2c5de37852ba59ff49baad70ee2ab7f45f4c4
SHA512 7179ce421e99a53eb947f3455bec2ea55a581c916990bbc1a72c2723c81d6df2622f6725879b1476695607c24a44a98f34855fc14ae9eaa0796914bab37bb989
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T3a:A3k03kHRJi56r
TLSH
T178155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 952KB
SHA256 5424e8bf6efa3f72b58a4896046d4894dc31965364c752d3e5ab4c0467fd2391
MD5 6d74930d59724bcd9854348a30b5f442
SHA1 efa0b8af7ae0922ccddbf8d21e13ccdaf701f95d
SHA512 206fb946121668de2aca967fdcbb267fbb6c1a8e39270ead5759bff23e88a2b376ff7bf55b7c1a1b1ea453691f9b55f62191f9dc1416c1c349afa03f6998a81c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T0b:A3k03kHRJi56r8b
TLSH
T123256A03A6980FA8D11FC1788A968622E7777C521F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 928KB
SHA256 a5f569f70de7236bcb6746443b7e24451727dea33a015a361ef5072521852e64
MD5 47f076327d44e06ebe05b379393d545a
SHA1 1ffd03cea131a346db2195aad62ab2c6257e901d
SHA512 c2c37beaffa3f338f7abac8afdc461414927e886bac6e5714f4bccbfd2926ecdf5c9524b75cf3002f7287e042b3bdd57c96a58f0608c688842bea490dbe81b96
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6THZ:A3k03kHRJi56rx
TLSH
T1E9155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 928KB
SHA256 88381085c7e9eb4fd8f3380ff3e2ab1ab3b32ba512a31c5a32a4b0c57ae28357
MD5 33195db361e65ad3b59c4c8d88902764
SHA1 cf56fb86adec552cb944ea7a59285dba282456a4
SHA512 8e4f25e7102577ecb546d37a6c3e7d194210f5a9f394f2a3730920d6cab95586c19859d8e956b2ae11597ce49e01926937bf030919b5e05ef98615079c3f5676
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tc1:A3k03kHRJi56r+
TLSH
T11B155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 928KB
SHA256 a3508f842632643fab809077a7c9a5d682264c2b86d5057f0f015baba8fb6321
MD5 3d59e484406b4d0e34184c701e70cc4b
SHA1 6a784b17df8426fdc6f22bcadad31dca5e39bd78
SHA512 5f8f1fb499fbf97bab305adb1bc447273e80812b82cb1a5163e2ae14623dfb1a6ae78c60bd4c8d43bbf4bf938d78df8e296848456e73ccb3106942a4d0f1d33d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T26:A3k03kHRJi56rZ
TLSH
T101155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 928KB
SHA256 ef010e2db75e20c676fabe24a53d976f499658d6b282354a6f84b67668dfec5f
MD5 ef138c2b84fa8fb20adb9589ad383376
SHA1 bb51086c9359c6f31bf52a7a2d9611608bb79154
SHA512 5875f84d6ab1e4d0658c880a2ef37041c5f6a53c59ad70ead02469653ebc9f1a7268345418586823bc137a2aca23442501ebfe852cb828e455b714c09ba62f4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TmN:A3k03kHRJi56rA
TLSH
T1DE155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 928KB
SHA256 ae676d03b0fe0cba00fe0da344f98c3863aab4bfa7ab45cc12ca19474613733b
MD5 b198efa1fb25ca057231b490868cd9f4
SHA1 326559a21818bf7c4f7cacf2fee3a20ccf92ef4a
SHA512 164125963c549af2e10deda56c5f61634d3f32317576a58605454c87d1c001c8ea72a00fa710d2585ce57924b4e3af9d83732571bedafb00ef47e39b5d374c25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tkf:A3k03kHRJi56rY
TLSH
T14B155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 928KB
SHA256 0aa2fe77b062d5ec01ccec19e68b722c88e251593129888733a42f6ace851250
MD5 f9b7ed67f337d967a9c796f68c03844e
SHA1 2cd62fac1afc30f4f57b5e7159102e559c4095e7
SHA512 fa28e95fe32ffa363db7a422e705d1e807e05e5ef445015c23e99a6a63581318d285122392c63ed02976cca4bf7fb48abaa3bf0f386e8b7798f32abe89d70611
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TOo:A3k03kHRJi56rF
TLSH
T110155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 928KB
SHA256 48dc04d53b97b64617b0158cc04f1d6c4f8f4cfb26fcd0ee8be71661673b9bcb
MD5 fd6bea771cc3574a8f4c74abbb44b554
SHA1 005c1618664c155c69d806edd27b5a9f51a5148e
SHA512 56a6b6abbd5e119d3ef518ffa07d568f055957fdc2044d836a40221bd8dab836ec399b62b03d8909dfa8281e2529ee7f420c74167eadb4cfedadf72ab6fd18cd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tiu:A3k03kHRJi56rn
TLSH
T166155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 928KB
SHA256 0b5880c78341ef628c08ec7b33bed90d64d4a2da46b6df867f9ddf8aa1ef0f8a
MD5 3b7572c35d9c4c8e10b39062eda5569e
SHA1 3d3d372a059a5a55bf37a697162039b2bf11fb52
SHA512 7bfaa522366699de8bf281b25328933d20cbb4aa7fbae4c2a5c53ee08c62ce66dc3d6007b8c48d63f768ec9b45b121281431d0a0dbd148066cb21558f0b4065e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T29:A3k03kHRJi56rm
TLSH
T1DC155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 928KB
SHA256 6e48e8669826cbbdfdffdf1868fcb4eef8be15211b5d96f55aad9a472d63ff24
MD5 2be48fbc564f838bc8cf506efd1e28c5
SHA1 f57fa28939706be2ee25a31f07ba2e2104ed0e30
SHA512 17a559c495e57cc965652ad87264dc3c8fbfd15151e037aedabc9542af01c887161e9b0f6ee666d4676bee2df641e6f234cbc704dffabd80445dafeb441aae7e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T2c:A3k03kHRJi56rL
TLSH
T1F4155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 928KB
SHA256 a38ab44dedde4d16e4d376c864d1c98abce1de4283ffded6cb8b793c38315420
MD5 9f420ff525b3925425ea06f8c232f906
SHA1 61c5a8ffe2ee9e48e8f42a97db68676e9f172103
SHA512 597acbc8b38d5438e33da03250bbbfba428e288f2adbdb1734eb7d56dd8461e380bcbc8014df4d7ef38e7e4452d36ba39a7a8791dae6611b3b787ce8f6a558f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tvp:A3k03kHRJi56rp
TLSH
T165155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 928KB
SHA256 8d58e32384d34395724f2e20a406792dc387fa7f87a1184640b9546ba59b0ce8
MD5 3cf48c71a463e226c887b3cc7ff56f32
SHA1 690156b9cfe2e9dc8ae7d5c45f56e6d5968d1d52
SHA512 4638baa8963bd73c79e2bbc9f5a8acde0e23ad590f0299a462727b3fcfa3b8d463ef399f61fe671e6e70cfd2e6784d38c4a79fca1e62681d790cdc583f5dbff6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TQN:A3k03kHRJi56ry
TLSH
T145155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 928KB
SHA256 79a3be97039732e43c53063cf64ad786414e5a89ae3aff693bddfb1641fffa45
MD5 19d76547a1dc6e8b4f154cd38d7e3b1e
SHA1 693ade8e85f5b8a3410a1dd58fec1be599c2c30e
SHA512 dc3c34de96659c4274880361db9ceb508fd9aebec416fecb3e10edf17bf2be67a166ec45cdb1099f62a50ed308ef54986d3739c9e0bad5f9c0f3ed69d8b69679
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TYF:A3k03kHRJi56rY
TLSH
T1A2155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 928KB
SHA256 e8efe3d1eaf4854e3021b74853bab73582449e126dc3a58b8cbaef733a33c70d
MD5 9899fc25542a87e96881e07685b6c415
SHA1 693a8eb8fc3d033300c6e4c1ac88e3e1001f3ca8
SHA512 85c3913ccc9f5a528b3904ba0925651afb1b921311385e5b1696e713d7371db9e83a87c1a1d1b75de7bb6135d38da494b5ad854575f974f325943dbfe95b9f71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TNC:A3k03kHRJi56rs
TLSH
T10D155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 928KB
SHA256 2a84816607e621e7d8634cd9772d607bd549aac85e212197d4e7ff67e6bb108d
MD5 fa4abcae7527cf61104ac2acc58cbe96
SHA1 b047baff88a21a41df5fa700651e5da26c512690
SHA512 49b9ffdfedca538ecefc5328da38e38ec0e46e2107812cd2e6291f47507f08053bc62dfb0dd85437907660f739fffa9546e3b3f261a7968ad7ccc699e9550e65
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T2w:A3k03kHRJi56rh
TLSH
T1BB155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 928KB
SHA256 ab7e7628c3bf6690cf507a027aa2fc890fa34043ef6264d22a57c1389ef780e8
MD5 2f2c04e45c3a2ea5865bc6e66806bc78
SHA1 482bd7f7d3b586c09af026fe570f0611390f03ce
SHA512 8e1804daa5983528c2a55d55b4b0030802e79caf8cebbef742d1a1991fb4545a4eca769b310c704f091e7b2fcb36c833a982e9b2949a4688eee5216cac7268bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TlT:A3k03kHRJi56rV
TLSH
T12D155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 928KB
SHA256 0933834bb8f9317107fb1ba0c17b7c856e6b9a8605dbd65ee60b6b6137d02e4d
MD5 0c8470de449b6184f1df46e8f37e636c
SHA1 181451d52a074a74dc22abf74ac15e4a91d48f9f
SHA512 4a8c03db6da46d0c9cf218e67227b61d0c79b0bee8d1f38d17ee7160e56d18364e243749d7c10aa66839db6e89c2a1a1adddc8e72343c53dbb5f0fa9de76bebc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T7u:A3k03kHRJi56rK
TLSH
T1CC155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 928KB
SHA256 958a504b61f678d1a4a3dd8e2e80a9bac7025804b87831d0487ecdd2671ec192
MD5 2d14d46eb71c392ecf6b289b058c5e82
SHA1 6d681497b434487333bd45a7f976d49c86ab5f72
SHA512 ff09c57ab1ee92ac3c81444905c3bb402b2b521041eca2e6bd9dd8d12f3618183f58abf0257219f806854b8c6d97eeb9d0aaaec032553ce1458e2c5b96826093
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tfb:A3k03kHRJi56rr
TLSH
T1F8155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 928KB
SHA256 4b70fd632561f083f65161dbace384858f28abe6cc618648e80ebae1ad7ada62
MD5 652898ef78663f0ad1260f46d31c7798
SHA1 b965c071c5523a0c8d62a2b624d6e551ceccc8df
SHA512 5c22dead779d108b34838bcbb26a195bc70ec34b7fefead9be562af379f1ea98a5657e1e822d3af9098021c409644020fee095d50b96221178cf7aff7b9fa3eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tbf:A3k03kHRJi56rz
TLSH
T191155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 928KB
SHA256 bc77578f94cf8ab1ac87c1c950e5c29e18f3c7c486d9e6681f823a78f517bdb0
MD5 79486bd760052de746da9ebaa1a30702
SHA1 08d17b9a3fc290a216144b74e1a79821b4db46ea
SHA512 05b31844dd3b6f55fe23c3bc50af8e8fa61bd59b4435cecf1f5d22c516f130003be2b68e54310da10b56aed7da1eccbdffe2fc30f2abadbd206863cb1a248b09
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T0K:A3k03kHRJi56rj
TLSH
T115155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 928KB
SHA256 132747567d92c7b24b9992865d332d9377788567f9d0690f0aa6ceba4e9749b2
MD5 42b39877eb6e5e63ed40decd1a5db82c
SHA1 eb910d58d8e617ca250327cab09494bf02fed88a
SHA512 ca83a78434a81dc3f146245d40fa62d4fce1ff5fe67e68154df55be29a3f71406ee9f1bbdf6e8ef4e1fee171a22b732df5a8a879965572bc1a8ca4898762382a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tpk:A3k03kHRJi56rO
TLSH
T172155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 928KB
SHA256 ee37cfdc9acc28a1a3fa5c203d09f298a105bfafd84924205d7b097bc77f990c
MD5 ec528fdbda4d61332be734b01a1048cf
SHA1 b7dd1a29d0e96cffee077a4e4915d1ef77fa3aef
SHA512 675d8a6f0c77fef960a7e9168090c7472e21380fe6d1ac09cb0f0e242754a93803e0466c927b7896c85c4d3eea9a05b599edfe847435976aae596e7819e1e53c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TG0:A3k03kHRJi56rT
TLSH
T11D155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 928KB
SHA256 baf0d2295d795e1961aee25f51f9f04f8212524f88b23a1980aece90181b899a
MD5 15858b5f56fd3dda93463c5c92e15194
SHA1 1420e6b4c35de88e614c3365f961d70e74d6d6f8
SHA512 0c92480439fccb18d2633c0107b6b0265de57fb228d1d5aa4a5133043b83e6ccd627d4a1694825bbd6ad833a9f91cac17792739aea9a0927f502e47b0feffcb9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TVg:A3k03kHRJi56rW
TLSH
T1EB155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 928KB
SHA256 d75d42b2157c53cb74b3e48a1e26ee3a48a9386bd0ca8eb801471c18c3e1396e
MD5 b9860a733142ab94d32283cf0a4ec0b9
SHA1 73bd7a2e5e76dbe29a672d2f7d9bd9f810de0258
SHA512 f18c15f2197f15172079dcc4b63b4b834018242c969f820b499c09a5fa3102fab882bfa13da107b7cc81bed4ff0944b9977ee1e16462a15ab18010a667df18f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tkr:A3k03kHRJi56rY
TLSH
T183155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 928KB
SHA256 0a874e02dd97f0616dd54d4d76cc8060fd3d9939199760d6665b664a6a40886a
MD5 b974e51e0e28f38fb84fbe6860e88719
SHA1 1cb86d628d832388ba620cc2a2ce1b6d1a58b4c8
SHA512 71fdbe8f2ee9e9b2ad4e89b3afb3e1ec1af2ced93f15daee7b84e21243eaf9fadec912736350fb74f12934cd5b453d6e2798feec23e0f274dc91b4f9e91c01c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T6n:A3k03kHRJi56ra
TLSH
T1DB155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 928KB
SHA256 3b8b5e6628569469256b03842808ba5b8acea0f72f1584b7e0880f2f10b6af4a
MD5 af0f06a7f5b024a27cc099cceb158f1d
SHA1 3da4f128b8eafaf768becc21d728610862f6af93
SHA512 0ee3f49827fe23294cfb693023afa969366c3a329a1f5f0362e70acf2005da38f9488cf47da5c9cda187caf0c850005f78eeba430c1acf8180b21fef2bab79ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TQx:A3k03kHRJi56rY
TLSH
T11F155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 928KB
SHA256 9c161ac3b6c867bcb187c0b4a2a69eea10ab25bfd1337aff1e4b256994f1ee06
MD5 c7b5903f9ff7f8b101b25fa821127e3f
SHA1 3718be3f2b3867acd3a3a407379eeab83dbd0e45
SHA512 4194b9ec0c0c951a5a0528d9f35bc03abaf9240d0e53b4340cb2855db75314f7b4a52cecf7795fd37153dd6faf1ebdc7fea79508d4d2c1302f09fd379d09f8f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TSA:A3k03kHRJi56rb
TLSH
T129155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 928KB
SHA256 313a9869ac0b5f518e7e5d0325bc67981594137f68b013b03a7fc33d5d823c2d
MD5 bf06f145ebaed520932c8751ac1b06a9
SHA1 5238d7271750a648a860a5e69b4168ba17701209
SHA512 fc060f376ec00da785faf6d14647a0ab034647d0a2e7cd0d7ef0ddb13906ebc8aa4d3b42e90d83f4b1e1ca451ff21f9851576f5effc17914831d18901280aba9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tr9Q:A3k03kHRJi56r2
TLSH
T10E155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 928KB
SHA256 c1a3b0b926cb55e1178490eb93503bd3fe87a44f0663e617fa8abf35ca2c6b00
MD5 cabd5f75b550f5cea2e5493b00a08388
SHA1 6b496ee431a6ad0b8f43586852761fdf739acd50
SHA512 4364e9a245733bd10ecaaad909d623a7f5798347eae0310e6951ebb0d155a7587f292ac4e15ad2ba8e00d59cd3dace17186fbb7df88dce021759f9a79361ac25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Ta4:A3k03kHRJi56rl
TLSH
T1D2155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 928KB
SHA256 3828ac774ac7df95748864d67899c48f9a80f24604358e440bbfe59e54ee2bef
MD5 5f0e861761c5ff558a01a9e846628738
SHA1 9026510fce4e7e800c0c370b8087bddba5e179c2
SHA512 89e4d2e379b9d36c4ca5ee16377355b9fc3fc7a43c19710ca1c0013e8638f2184f3ab6f099b78f34f4457645ad1c34e004b9aeb3cfdce9a9127405e9e023d523
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TBu:A3k03kHRJi56rQ
TLSH
T1A3155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 928KB
SHA256 35d197bf6dd1fb8b1fc202c7268c7f47b80283524183ecfb3e4f3bc726a0d18d
MD5 4780b4e1f83d640b699f0e34ac7b4e01
SHA1 3921dc98e1fbeb508879e80186611f73aae7e450
SHA512 80ebee3527d5da5d8134cb5e3ee4d6967ae97cf8cc6dae7c8ec0c74be4c8dd703d7450caea6181c0dc2f88adeac8c6c5c69979a851b68f74f24a49e0cdc56fff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T0j:A3k03kHRJi56rK
TLSH
T157155907A6890FA8C11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 928KB
SHA256 5e49362e62cb3c80da2bde518e0fe93c02a75699acc007aee183fe6ee30dc15d
MD5 e27e763e1968cca7373b320a70e583af
SHA1 78862b42149e307793036f9e2d93a3751fe5400a
SHA512 77ac3453a88a451598886970f9895a4e9ba032d06aa1540ed98f3cebece727d2f41e1c8980c9aca096ebf4f4a535af329845029f11c4cce23a1a742b62644852
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T1g:A3k03kHRJi56re
TLSH
T1D5155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 928KB
SHA256 94e2b379c23b828d689681afd4909ecb2a00a932cab9284f5d359e4cd3a57149
MD5 88a1b6533172b0aa92f22d18bbf565dc
SHA1 da11338f5fd951c366c3180c3581e89d91ed2bce
SHA512 189b53073610f8c83350d7812634979fefeace32dcc099bde393cbdb4a6f10212c2bff37717a059bdbd1c13d45e0b34ceb64862cdee9e3ef86d001187f2f8fa2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T0I:A3k03kHRJi56r3
TLSH
T1DC155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 928KB
SHA256 0bc4077b77c1afead21b29dc8594cb13ff9e1a996ccaa139710ba66b24a1a44b
MD5 1e398e441bc00716fa019bc6847c5fa6
SHA1 768ce401517eaf08ea5135d38c6e4a3758ab6472
SHA512 e6bed211230ed4025f4cc3899cfaa819335336f3b08a8de71ef7db7ea628b7645fe4c8e89a96106f7ba01354691681ce03da4116bbe73439df66c8b28fddf591
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6Tmo:A3k03kHRJi56rx
TLSH
T1F5155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 928KB
SHA256 c1dc3f94d995d0c9ecdfa8a3cf9cfd565730c04aac6547df2be828000411f079
MD5 b7d9b1c154c6595530f805b9e6a0a0db
SHA1 9d7cdb3402ae1d1b540416b495074896691d6946
SHA512 1beb37b75219eeebf6701478156a45680a046a60d64b1e85f14db93c55848a16ed46443fdcf3b860416ba775940ab77bf9edbd318005d94420708a5cf62d7fff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TN+:A3k03kHRJi56rU
TLSH
T1C5155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 928KB
SHA256 ad19b088ab603c7fb21811384fb9d58c01d7edf02cdfb9e9e3cea5ac6dd10803
MD5 41e38be38255764f3efdeb1862264b6d
SHA1 15c5eb939f6d2a37f206474114d5ba30460e24d5
SHA512 132964fe11382e305f3dd96f34a62d501827a58fb3094cd1069fe22451a1224cfc4a3eb60647a4ff83f39e66e956deea022e11e6a083d3eb61956728e818be5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6T7Q:A3k03kHRJi56rc
TLSH
T1E2155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 928KB
SHA256 7178f5aec8687d6fdec55504d46aa35b9d353263f64f99b014482d25f4bcccd1
MD5 05fce2d5df8605f7b92123a781f6ae39
SHA1 ba7d3a6fcf9dea1ad403928b6c35b5709edac90d
SHA512 af543df60b3a0cb27e1a0e53efb145f0e45dd04536e682c5c660a3f9eecdfd80680a251696b0492653c93088d40fa2bb430b6adc36dfcf7d3b0c2bc34dc901d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TwX:A3k03kHRJi56r8
TLSH
T117155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 928KB
SHA256 627cf6a41499b33d3a70ab871d428c5632afed788dcabbe170499342d64edbcd
MD5 2e8ba1e50c94c2edbd0b08aeb70ba89c
SHA1 c7d387b9e92364d19106d1456fc9ab61ddceb48c
SHA512 a0c62d21a863ec0525f47d6c61220ad11aa9e600868b5e452df2b4e2948b5538d1dd6077b8fe0dabd9df8a26bb9bdd018b1056ed2374adbb7f6cbe9fe93e759f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TGL:A3k03kHRJi56rm
TLSH
T1F9155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 928KB
SHA256 09149276f6bf834f183a86050faf45db76bbe3d2cee8c8835693fc64a951fb86
MD5 6761f0bf50d0d6ad40bde7d2a636cb5a
SHA1 3db9a3a9a54b1b573999eb7e7feeb4bed4491e62
SHA512 7f95b7a526600f8aaeaae0e9512213ba4b544cf5e29f5993975d19aba66515f0a736d68ef2aa6ee0d21d2c0031b3b4e50642591499db95ca2a654bb617a5e771
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TaM:A3k03kHRJi56rD
TLSH
T1AB155A07A6890FA8C11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 928KB
SHA256 eff619ed112a09c3bcaab46639f8b513acd6c1fc3c433164a5596d45d83d7f24
MD5 0afd8e90104dc0decafc5a42a35e10da
SHA1 46978a435fc547252a7902cf00b96f613a169014
SHA512 9faf4eff9d843c462499a6feec5ba2efa923b4bc3857b400d41abca52dbb140d29c613713b754fe2b4091ce05a1c108e54aa772194816e98f26c1d15baf74a70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHo6TLh:A3k03kHRJi56r9
TLSH
T119155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4756-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4756-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads