ee2adbf60a637b85d83fcc180959855d135b27b0ef35f9d5b6827d5aa66adbec

Analysis

max time kernel
106s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 816KB
Sample260712-trkl5acz8m
SHA256 ee2adbf60a637b85d83fcc180959855d135b27b0ef35f9d5b6827d5aa66adbec
MD5 b4441ae95128654135780c0415e347a7
SHA1 fb4febbb65ea78b1adcdc61ca6cf1aad6528fb6c
SHA512 d6fff31013605a25e6fe8c15b903e6bc4830702cf665a6402d4dc2046080c7a2992a50e073491cb3b7a5edee3f891bb549dd47c705a9cd8210432b92cbacefac
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj696:t/sCv7rTiw2RYwZCUs696
TLSH
T1D105191766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5cc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5068-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4884-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-432.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-513.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-709.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-771.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-802.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-845.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-870.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-937.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1091.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1154.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5cc-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-226.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-432.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-494.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-513.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-605.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-630.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-709.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-740.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-771.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-802.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-845.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-870.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-898.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-911.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-930.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-937.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-956.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1011.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1054.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1091.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1140.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1154.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1187.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4884	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5068	2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
4884	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_b4441ae95128654135780c0415e347a7_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5068

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 816KB
SHA256 ee2adbf60a637b85d83fcc180959855d135b27b0ef35f9d5b6827d5aa66adbec
MD5 b4441ae95128654135780c0415e347a7
SHA1 fb4febbb65ea78b1adcdc61ca6cf1aad6528fb6c
SHA512 d6fff31013605a25e6fe8c15b903e6bc4830702cf665a6402d4dc2046080c7a2992a50e073491cb3b7a5edee3f891bb549dd47c705a9cd8210432b92cbacefac
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj696:t/sCv7rTiw2RYwZCUs696
TLSH
T1D105191766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 a448f4ad694272be5ab958b322da79039bce678be115c178cc365368ae63494d
MD5 968b0bf15813a7ce7cf96943e5c95a5d
SHA1 554fa7703b4236b9df4459c224de1d9ddd9a4425
SHA512 be1879280dffaaea4087633a2a30c16734d4dc0fd13033da8c65df0bda674b62442fbae63fc4944e43917c5649a257b545a3d63983519d05a2f2a2340dddb6f5
SSDEEP 24576:t/sCv7rTiw2RYwZCUs69K0Le5ji0hmxNrM:x7iw2wPji0Aj
TLSH
T1F0553917B6A84661D073E174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 831KB
SHA256 a77da73a46acc52e672e15e388c02c28b6b8c7f8957914db6ad6a7db3057f61a
MD5 5819a070c6311f2a2849a137d848b7b5
SHA1 f6e490488f7a7eda993173047c511e5adaf3de93
SHA512 20ac912934f921476d8a6d5a43c5d52a2d91fc37f90e234d0a654c9062974d50752067febd434081520e27659ed085a0753febdc42e44e0bf974226f45e3ff5e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Ea:t/sCv7rTiw2RYwZCUs69Ea
TLSH
T1D905191767EC4894E5A6A13489B54606EB72F8551B31C3CF12788B2D1E73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 864KB
SHA256 438d803204ca9021365a0c4a613423e358ab302e9ae68b211a9352b462f3a548
MD5 ef8ec037b4bc2d0f96157921360dc417
SHA1 90e871a9f414da68d726b557a29c88f6a9e31a0f
SHA512 96c4a5f28dfaf03055377a38f981249dc9bd164a0894f0da0029f43e7ead2b364a07a475b73c5da5a87632091a12d0b2dfb41508aaed15095b8e4e55140a1e39
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Pb:t/sCv7rTiw2RYwZCUs69Pb
TLSH
T133152A1767EC4895E4A7613489B58606EB72F8551B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 840KB
SHA256 522c1ade4d3a39a1354a876cb5f19e12c7693a5b34acae256dc345b913bccc52
MD5 f789bd68811128c62d635b44545f1766
SHA1 f13e484d883852cdc06cf7ea8c61d72a347da454
SHA512 337240d9248e28228cc6211f32853c4a960aae148f211f42ebe10bd880cc3396a5d28a9c92ef1172557acef63230c90f7559d5401a3433530e2c30c88944307c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj6996:t/sCv7rTiw2RYwZCUs6996
TLSH
T19D05191766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 840KB
SHA256 8a1a8b9835d38e71a8f1bb0e1ea75b5c0abf61f5ac25dc033dd0b9d01d49e8fe
MD5 1b7790bfaee96331566e51839c238107
SHA1 4f726277eb1d945adaeed0141170d8d235902c2d
SHA512 d0b83844e95a4ec41260391e62209388a09fd2eb04ada2f577ea16fb909153c747f79279a7d1d909c3c2be58624c7a914536e6b32611e1f716b6b1b458d02776
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69TN:t/sCv7rTiw2RYwZCUs69TN
TLSH
T13A05291766EC4894E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 840KB
SHA256 2ba9273066bc99eebe57a5801fa894d16a940cb7062819addc1498ac8ada230e
MD5 2ff9dc3142c989526370d9c7228cf018
SHA1 4dfd6c1ce4650b52d33598e33454accf57b776ff
SHA512 cfd22f42417ac185a47fcf79f202d9648e8290549acbd84cbad2fe32482abf604db8c24bb6b1fbee5aea85f03c1277b9213784673e6f7069886891563181a4c7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69hf:t/sCv7rTiw2RYwZCUs69hf
TLSH
T15205291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 840KB
SHA256 ad754609c0ea45f7749a68603bc3990cc94f948b0f1334aecb1a1c5b1676230f
MD5 5e7e1ddec275308462df0db3f84208cb
SHA1 70241883dc011fc6a74a5f33e60c614f7bb8dc95
SHA512 d57140e0f6405a1b5075db2a1a615832e83905b03f4142cf2c3c971ac4292f5429050ca830dd9ad97c4faaecd6d48921762938066733ea6e425d3028b99302a9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Do:t/sCv7rTiw2RYwZCUs69Do
TLSH
T13F05291766EC4894E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 840KB
SHA256 367e78f8eda122b6cb1648347c763ff33f680bb33be641b1b36c2bc7b231a897
MD5 080e39593e06db56d97cf4e5728ce32b
SHA1 9fd68b4c8972f9128c10c9abdad102dd697abc1b
SHA512 4af46857aa9abc1ef11a3c54d009d12ca16ff7d127990881b68d513b6121588a523c45dced4acf5f0fe47e8a7df001d56cb8c4946bd9c4672865f770dd4c8a74
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj693u:t/sCv7rTiw2RYwZCUs693u
TLSH
T1D905291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 840KB
SHA256 b2774e4508931dc2906628f506a763cd6b7214e51e5da8662fc79632c12b7514
MD5 33c17916e6620bc6dd6734295557e472
SHA1 2be02a1d8aa35d4b36ad0e9f2f2b03dec8b407ed
SHA512 4d33493f4e7c3d248e4c066152c87a53d11d797e86c3161529938e42b418b4a8b4f646f14f1b5ed153497bd5481f47955438e1d80ec02c23e08d480d7f32cdb1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69F9:t/sCv7rTiw2RYwZCUs69F9
TLSH
T1A205291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 840KB
SHA256 5302fcf1f3e6ea19b0b31169a679ed04c2ee668062883d770f7aa75d4531a049
MD5 f06f5df24a6c1b18987903a8522a17f4
SHA1 ef609a66135d79309d784230b229d7050d2b064d
SHA512 7fea67c7e79e96092113645f662e178f01d08eb644d9d35ab030f3947690a355124be8afae0c6e4d6e5d82c2e1f12977c0641926c79e8c67ac586b519efd17b6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69hc:t/sCv7rTiw2RYwZCUs69hc
TLSH
T19505291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 840KB
SHA256 7fd0e3977829189b5178919266ba12652b517080eddc30c96ff3d8bb3207e6f3
MD5 893f312cb85f3e92ad852ebebacd8293
SHA1 4bd4c6b737c7fe6556ac224f713ff1bc6f9da260
SHA512 d4ed65b37331aa89fb20a05ad06dab62debac592d00ba9d609c511dd13a0223c174ee600638b677141a895c6c899f96328ef17567395e088598687a5b617b22f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Kp:t/sCv7rTiw2RYwZCUs69Kp
TLSH
T1D805291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 840KB
SHA256 291d20aaa694489619d582c3beab98961cd78b400536fd9e8091b44b1b7d2c7d
MD5 2f0c8e9b3003a0657fd34c98e8642411
SHA1 4c8f1f6fc1e4d31ca2f3b44ff5ad860cd32a5035
SHA512 3b8e0e13ad1d70b74c8abc8030c911e4ec5d97fa19c2fd0abb18e5d7935d00a6b6b7f82d097ce4edb06c280cab8b16de7596ff571e800a4fcc7f320d505a95d4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69t0a:t/sCv7rTiw2RYwZCUs69tN
TLSH
T1A905291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 840KB
SHA256 20488c8dd16db8b60fe7357ce7210200a40374a257b589a034291a5fe7d32d87
MD5 7dfba4c6c6974fd044c7ad9bc593de27
SHA1 88aaf97692dff7dc5a76531c3d2b4622f4a50b43
SHA512 2da06bb242a3c317b54cf1b8ac9772cd8cb3875545618e027183126a8a9aecaf7c043ee3f86e54f1ffc6a57d47bd639ac6900e7fc5cdf3e414809ec9fbba8d45
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69fF:t/sCv7rTiw2RYwZCUs69fF
TLSH
T1CD05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 840KB
SHA256 a980d9485c23b5754ea52eae6e145e17c542380c75df8b784e99f121940d4ed7
MD5 002be6c1543ad3b6f53989caa930252b
SHA1 cd4ffd13ed531195d3a330a19d0d2e7bb9120c5a
SHA512 6cb2965fec60fd94549910e479cf96f6a09c48c567f6b64aa58325317d41f56669a9dfa5f0e72554d49d61259ec8faf013088eeb665ad5bb892b13b880ba1b51
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69AC:t/sCv7rTiw2RYwZCUs69AC
TLSH
T13D05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 840KB
SHA256 66c276f6cbfab05d2b2284fc5ca7565176b48fa3f8f4ca0a8ccc1ce832ae00a4
MD5 34aff4a2cdfe1f8faa3f6f3dd67c86be
SHA1 718112418b7a594935421fe718d6bb2941003585
SHA512 b3143efac473641170849edb5321eea7fd64ddb8fe9334757c778d7012016336b7f2d44485234801b218bd9c7478a49718fe1e8c08741cc8bdd135b627c2258a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Tw:t/sCv7rTiw2RYwZCUs69Tw
TLSH
T1DA05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 840KB
SHA256 c885d5e25e0148fc8bb5d7e82dcb0ace06114f694071607489b881a946e3cc3f
MD5 dbbbec16d17e6ebc1efbf919ad0e6ded
SHA1 34b4932cd19fe6b6aa7f276708dca061e6727db7
SHA512 b948ad0606cc798d6cc43ececab156a786b15b78b254c3e78c6c41f44e5e691dbfc3c26ab1d87793cbad19c6e057514f2736957e55fcffeef6648137c7c2284f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69aT:t/sCv7rTiw2RYwZCUs69aT
TLSH
T1B205291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 840KB
SHA256 1b3553c24f48a73dd4ce6df4a134cdbb4f48e22846e7e2985640b47a2b46abae
MD5 fbb62faf16220f2251c35e158fd298b5
SHA1 b1d3e2b283fbac85ab7aa0618cec6ffb18922a08
SHA512 7cdd5509a2b6b657aaee6a2de3c6d6326208f3968b5558dbde4fedee6bdf213b047beb94f49b4084b46194a3ad78f08e3ff60c789755d3c707acd504480a573c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj696u:t/sCv7rTiw2RYwZCUs696u
TLSH
T16705291766EC4894E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 840KB
SHA256 9c106ed229747363145f305d139a607301973fbe1a2c7a2e91f42b837a5955f0
MD5 eda3caf9158c723a59e7e36ec931336d
SHA1 855d9daab939d4b701f0c8b1081c818f462e0e70
SHA512 30002e38a6e4e7cb4cb6eec8bb6e46738e454865ed0980aec92fac1a1d89ce5792c14fe11512e510a76820ebf57cf824fd90b982cdd38fce8d5a5dc057ae7cd0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Eb:t/sCv7rTiw2RYwZCUs69Eb
TLSH
T13105291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 840KB
SHA256 dc039d396440a6a6a07c1acd1fd2faff6cce4f7d1518f7c84d3c0d6b4e3f4e15
MD5 790c362d64f44849c6d27672764e9b0a
SHA1 d11e11367b3562807af44eb5bb38c553f3c6b853
SHA512 c08e31695800d4631529e0984d6cb24ac34bfd870453c0f6176b92a88f356a12ce7cb79877e8cee3460b9b76818468c60e921e8456f44cd83df36a2d190ae35e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Kf:t/sCv7rTiw2RYwZCUs69Kf
TLSH
T18D05291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 840KB
SHA256 4c9e9e63e08c9e0f146770e5dfc8afa3b908f28ccf0150368c051b85976e9c41
MD5 0b8876af9de1257dcc09edba13a40fbc
SHA1 9f9792f440cb03f011a2ada5b35379bb6a997244
SHA512 cb1f21a52f60a869922da64897fee5977fc5674a7425dcb4776dd4ed21f1e5b2bc015ea51e5dd736a423062c5976ca367aafcf92c83fd97ff7776d33be923964
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69XK:t/sCv7rTiw2RYwZCUs69XK
TLSH
T13405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 840KB
SHA256 77b6a5384cde3e60c193b239bd46011ee25337227f14404ef857ff652a6079c3
MD5 7cee008bdd3994faa1190fdf15663977
SHA1 017ec564e73a43abb01362ded371b18e6912dd6d
SHA512 c3cb8c295af67838b9453e3208b9c65957fefaca9676741fe4f5faca16fa3597b3101408bc91fe266216264aa769f949c7aef0a0e66646ea44462c1a2a635852
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69gk:t/sCv7rTiw2RYwZCUs69gk
TLSH
T1AC05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 840KB
SHA256 579c183808627fa566594322cbdcbd21503d1f4fffc50dbbe42c2edfed2d034f
MD5 460c21a67acbdee84641d67d73bc947d
SHA1 9b942f4aceda85257ce04508cb88ead27d346b65
SHA512 1144c6a561391981e4bddfe373723311f3fc8557d4bd4b0386fe4ffbde75ea72af955bd095c9b47d7b00ea5a8e043798e846965bdb6845b5d0ff2d4176a40931
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69R0:t/sCv7rTiw2RYwZCUs69R0
TLSH
T1CB05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 840KB
SHA256 afa811d8e7a93a8d383c741d3a25aa9b9a3717285802c42926ef7b2fe2d03ad4
MD5 fb744ab8adac572cfb432595fe7cd77f
SHA1 31a2929f56970d3a38ff987c8bff67680ad785e9
SHA512 c6f745159a4d08d9cdd11b3e4912d08500ed14df6e635a072c1c1782fd96fe177f836b86bbc3681011bd37c30d4f30e9ee389247eb470dd1a3eae98a42726706
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69E70:t/sCv7rTiw2RYwZCUs69Eg
TLSH
T19905291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 840KB
SHA256 93fb6e0b6c209fda07cfca3e5ed46261df9e34470576624c1cc40bbd73affe68
MD5 af4150d05a98699757eb9e175924cd2e
SHA1 212c9b3db95c629b673ee06ea82f6f861364d63a
SHA512 c6de1f08042cea07b37b688fdc20c1e0893fcd657c548e76e85718460bc860e2c5cc4281bc486eed9c044f38550b24006a0361bf104e5637b351b605b03e0f5d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69hr:t/sCv7rTiw2RYwZCUs69hr
TLSH
T1EC05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 840KB
SHA256 33b5b36b8872abed6f6f8a72a7e0692e89d0d829a9f1d7b4e35ace93e3e7e301
MD5 b4de434af0c515e24a4de69bbc9a3b50
SHA1 26652010aa958d8e9208a67ed54b8eb7b59ff780
SHA512 710bc27484244b8e662db69a81da420642778268807a3c926c1dd47c05da2eb4a2c40760ee3caa207059943c50b9f401fb22978a511cda4d5168e800e9ddcf5b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69jn:t/sCv7rTiw2RYwZCUs69jn
TLSH
T15805291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 840KB
SHA256 c5b84eacb790cf5975305ad782671b924094905d0e4fc8875618f0fb5fcb9463
MD5 9ea5f9aea2a158712d1de3e31c950c7c
SHA1 589337e2ce7163d9a90cbb8eae18d8ed84e7ee32
SHA512 d83f37a8390feab8ee95ee1520965d5f96968db29a042f9379f734b049dd08f6aa1cbc588793aeea7422e783ca5cae58256bd7db2c77f1f24133483bdba2dc32
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69/x:t/sCv7rTiw2RYwZCUs69/x
TLSH
T1F105291766EC4894E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 840KB
SHA256 3dcc6d5453e90b7f652d3264aa8108a05878c05cdc074d9c16b4a38064a76e4f
MD5 2c2a2696318c6eb047613d99646afba2
SHA1 975af3e584cc0858e75c716fa30932724ecd8b66
SHA512 cfe2bf31654ec759a650776d1f34ce1226b983236689a9e91b5f886c37257a8d24599b281a45ea89c0521da7e717940da870ec202f1feb5115e8fb3897ad09e1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69lA:t/sCv7rTiw2RYwZCUs69lA
TLSH
T14705291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 840KB
SHA256 d00df07f07f474964112de605391ac7435007d90b6e8ee27f929b9447c7b3cb1
MD5 047666bb50d638cd4b5ae5b04862bd8a
SHA1 a34743a933caaafc761509dc20f36d625f4b183b
SHA512 a42dd4da227eaa26c2a302013d384fce8e0902e9d8a8d8e87d4f3e2626638f510e439bada0a26946e66bd7f7422e93f78be5f3e172d109a0bcb088e9eb76ddaf
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69e9Q:t/sCv7rTiw2RYwZCUs69e9Q
TLSH
T1B705291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 840KB
SHA256 c106fc2890958ed1a077aafdc6bc9ebffb6a64f1c492a5703e473dbe4de3a982
MD5 7b7cc188a4ae8c6232a0fb48204e51b8
SHA1 94a5190f8bd8217bb50fbd3a0bd5d589a31da989
SHA512 429aba9da11630e8c2ab549feec517325dcb0ea2822115c8bc50d02b1d8609543ff6dd6b16b213451cb10dd4253778ffabe463fb957287b64a43cee2867d97da
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69L4:t/sCv7rTiw2RYwZCUs69L4
TLSH
T13105291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 840KB
SHA256 a9bd979d08f0c6e12195008625c8643000dee0a7076c49ebb1e7a75f5e17f4d1
MD5 e9e5eb6562c102c2ab2e56337d3f767e
SHA1 79168eee1af03882e064204e2f9e99c4e9b36023
SHA512 4c704b89d948d9a1529be2f6c2fde08ba4727017b83bb7decb97fb509657cc659626ea89e299050d3599cd166d156000953b7fce8051473af09c819a3a98d7d2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Cu:t/sCv7rTiw2RYwZCUs69Cu
TLSH
T1AE05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 840KB
SHA256 79db6dd10a2b85ba47c9b6727929560618de720e1b5dbf032593b2b8ca915f15
MD5 4ef7373b9f00e4ac8abaa499da6e340b
SHA1 51b54c7deb087e84f749acbc514226baf5af3caf
SHA512 4614c205d743aa1e3a052fe1774fbbad0959228ef4f0f70153589889ec1715d7799ca411fecb9d25e0766f025b181f71832357c7bdd2df340700828821e99c01
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Tj:t/sCv7rTiw2RYwZCUs69Tj
TLSH
T1EA05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 840KB
SHA256 909c82fcd32c5c48fbf8a10e99cf65c47d4bd7ad5575f8aaf0e11e02f29b8dc7
MD5 d3dc3a6f175286ef0600c85a56a7ce7c
SHA1 f7b93335d2d742b2a702863de0c6128bbafc2715
SHA512 d1df85fb3f11459bd0be20bd490d005e3d8239018a69d02013c2bda6417e0799c3428016b288f4b61e3b2fcb8fcff4f417b8b6b73c3c76777d3a1165e3ec9e96
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69eg:t/sCv7rTiw2RYwZCUs69eg
TLSH
T1A105291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 840KB
SHA256 1e96dfd93c04659312d2c34f6e7e562fed3cacb20fa740cbdc8ca2c6144063d2
MD5 c9a9d2acba2d33268296afea115c4714
SHA1 290db7f9a0bab6a65bc928ccfbba26afb71541f3
SHA512 d070a049cedf33488a0c2d8b3bbcf19730fac72b8dbb40d704e9710e0fb9e0a51c022c7d3df4722e4ad0b4ee6b4271716674dc0dcd7b609895f257a29d8570bb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69RI:t/sCv7rTiw2RYwZCUs69RI
TLSH
T15505291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 840KB
SHA256 a778f43cbfb70108e404e75eb0f98d3abef34ad9c68a749937c30ae4bcf47074
MD5 36d1e97b13c660b5e0be702198a65f14
SHA1 092dd4f25b5d4f1af56aa5f7df6195b32f067607
SHA512 5d93479d2a1ad4dbfa2234acb6a0591f4bea17b0494bc970a8b3ec4522a8cce8f445c77c7da5500b4ebdd8af426e16305ffd40202317f56be74b9da8e3d51f4b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69To:t/sCv7rTiw2RYwZCUs69To
TLSH
T19B05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 840KB
SHA256 eaa260aeba9babc22558a3df5e4602dd30a541f1d278c8031245e329cc3e3e93
MD5 5cd1c10e7192460001439f73fe849c45
SHA1 ad2a03d4428584a7934397d3737967bc5548c410
SHA512 614ceb6f822c33d81e9497fc99938807e2e731a13143ed6f710eab39d5057a314ded9ebae2630ceacd7d523cb16886442de7ed1b0362eeb8438dabb38a6f7aef
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69Y+:t/sCv7rTiw2RYwZCUs69Y+
TLSH
T1CE05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 840KB
SHA256 f7f4fb01f62e0149057eece2fa623bb2c588bf3a0fb60c346b4a94baa36f4729
MD5 595742abf30f382e227ae54c6af8b1dc
SHA1 7fc2e6b9591b461eeaf5fa9596a0f3510660e474
SHA512 81f5413fd96c9c71e8ddd465b44b80ec87e1d7a8bd3489b715261d0702f57220d650e8f65c83b66c816ae16b8eab6d34195b91828af354ca29a1cf1f97b9df11
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69wQ:t/sCv7rTiw2RYwZCUs69wQ
TLSH
T10405291766EC4895E4A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 840KB
SHA256 df861fb29ef7d2236ce4fe7e636532ded22e3f11f946c2ddd63ce2daacaf75ad
MD5 171870d7f3b1f431623bf42151d8f0b0
SHA1 df781f4f2675d40a7890562282529652a3f213a6
SHA512 66440eaf58c544ad887d3c8e587a21dc0c1676c3337e2d1fe0a078a3ba3f1fd64204a46dc80b6554e1769bf376deb3238b2851031e37edb6c9750509b0243207
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69ZX:t/sCv7rTiw2RYwZCUs69ZX
TLSH
T14705291766EC4894E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 840KB
SHA256 edc7d49f2165535038a2ae05f14d13f4448661fd52935463878883d7565af31f
MD5 2d236c7599208967850be76766851648
SHA1 050580a2458e9bff7b3fe30c73eade06180c215c
SHA512 87b75b1ee011c5c4d56ce52cf06f522d86437b9de96a7fe4ad5f6f1d0b61402a07adae3446ef8f97a02dc1a85ba006581fde1798609e53b69bf326c898caca5e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69zL:t/sCv7rTiw2RYwZCUs69zL
TLSH
T17D05291766EC4894E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 840KB
SHA256 5b46121b9f1e3fb6791847971462208beb0fe2669e7a2fe26e8855bf0ec9e0df
MD5 b5fdc64b0fc477a88434cb7a9689678b
SHA1 9d211bc2fe025014d52cfb9850736f20c5af210d
SHA512 c72bd3ac9be8213e92f10a14ffec0dcc2d8be5a468566fd93c13df1f88e50556702c4f63d68cdaf934dfc7e14770d5e05454fbfceeb0056146e8b56af36becad
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69ZFC:t/sCv7rTiw2RYwZCUs69ZM
TLSH
T16805291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 840KB
SHA256 d3119377ad6ef0a4a5a8a53436d8ab5cccc4dc53eff8a1a24ba68db46c297b37
MD5 38cf15c1dfd2d7407c758bd9bc4a151c
SHA1 d75aadbbbc8b9e00f5ce96987fb99bc6a5b33322
SHA512 16c2dd3887f83d532c361dd805f9ada8e03fb81b85b5efeac9afd0f97c4608571d45f47668d569312e774249e229105016735538daf7560bea0c6edc0f018092
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDclj69ih:t/sCv7rTiw2RYwZCUs69ih
TLSH
T11D05291766EC4895E4A7A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4884-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5068-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5068-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads