9408a51ce4568e4ea3df8285f54ed99266e65c93ac4665e8570dbd44eae5f1f6

Analysis

max time kernel
105s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 897KB
Sample260718-bbhhqaez5w
SHA256 9408a51ce4568e4ea3df8285f54ed99266e65c93ac4665e8570dbd44eae5f1f6
MD5 824796fe017d3eee2e4bc994766a1513
SHA1 a5ba1b2aedc74539b9b3a342365add8499a7a920
SHA512 5400e1f1d726db1d47a2bbb4ffb1f6085e3ff782115a7ff90948ff53fe3ed8520e353317b0af779c06553d94d50919bd1dbf9c0e9453f3e4c26076a0ba6c679c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWd:t/sCv7rTiw2RYwZCUsjwSTWd
TLSH
T152152A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3588-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c52d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3588-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3132-41-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9e-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c52d-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c9e-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-265.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-428.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-514.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-985.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1047.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1079.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1134.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1153.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1185.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1325.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1344.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1384.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3132	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3588	2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
3132	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_824796fe017d3eee2e4bc994766a1513_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3588

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 897KB
SHA256 9408a51ce4568e4ea3df8285f54ed99266e65c93ac4665e8570dbd44eae5f1f6
MD5 824796fe017d3eee2e4bc994766a1513
SHA1 a5ba1b2aedc74539b9b3a342365add8499a7a920
SHA512 5400e1f1d726db1d47a2bbb4ffb1f6085e3ff782115a7ff90948ff53fe3ed8520e353317b0af779c06553d94d50919bd1dbf9c0e9453f3e4c26076a0ba6c679c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWd:t/sCv7rTiw2RYwZCUsjwSTWd
TLSH
T152152A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0ee779528965a76cbeb2269bcd5cd10e0121e0a930ec18e5d40e28e087d601ae
MD5 29184f7342957a319a4b5ec13d8c3691
SHA1 f66c2d67148a190a530eca5a0fca48f27bcaa22f
SHA512 d376ace2e499a9e70c1d824787847664f35f26632123aee75433d116070693748745d8963e707aae670fe998185e648eefd61cd0b2060ec721905b4e7dc8712c
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwSTWp0Le5ji0hmxNrM:x7iw2TfPji0Aj
TLSH
T1A5654A17B6A84661E073D074C5E6964AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 911KB
SHA256 a1c670152dce8664c1e23fea93076be7c22042aece32a9beaac351628c72c5d4
MD5 39c6b41b77e74a1a43a178bfa0d60c5f
SHA1 67ee8f22f7ce6c1e1616cece0df03210660ee065
SHA512 231f78d119f17f3648b1c6a9aaae3e2d7bd1394c294203d30ba615a24d6637d7572aa552b9bbf9c1f594967eae806faa6f24b35331a45356ca9de515e9a3a718
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTW7a:t/sCv7rTiw2RYwZCUsjwSTW7a
TLSH
T10F152A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 945KB
SHA256 e422cee10cbdc7f1f2e956c16f8cb3527c777ccc83d6490c01f4fa30c87915ea
MD5 4bd0787aeabf135f4ec1e7b7fac50ea8
SHA1 bd3b41d9ade562f939e947e771ccf1eb15193927
SHA512 04ffd5e8f6ffe82288f88064ec2fa58ecf039ec3995ba20510dbd3b4efe5119ed56748e1f75d21cd59749e307ce5cb88db97a5b8ba5f7eb06903f0eeecf582dc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWYb:t/sCv7rTiw2RYwZCUsjwSTWYb
TLSH
T12A253A1767EC4895E467653089B58606EB76F8561B30C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 920KB
SHA256 903600da8750d9d5130e0efe25e3f0d4719250263c61d6b478f10ab1b9c85be9
MD5 4e5c74f41383bbb25156da878cf47ec7
SHA1 c96a8ad16f4508819e30ff65d923791492bd7eb8
SHA512 c996dbe52e8df23e1f58030d7a529b55dd16ab50f19ecb6b3b3879cbff0dcc2ca9d5c7deb90d98010e51b79f3f7cbe45d5b650be9c50d7e2a55b05c93d1d9ec9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWa6:t/sCv7rTiw2RYwZCUsjwSTWa6
TLSH
T1FF152A1766EC4895E467A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 920KB
SHA256 7ee7145793f9216f2d37fcff96dd42b3f1068be40274eb0f29fce7a15883abce
MD5 f9569b5af5096109ae50be7ca00458b4
SHA1 f29c6f343e7726410f26d8907cb431ed33880f29
SHA512 8e0978d12cef921ffbbd7ddf6d083caaf48b47cac28815c2f47747797048ff973e60e46807899ce6c9c16960db2d2a51d9eb159b620de9c2f7fcaef8730b3168
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWSN:t/sCv7rTiw2RYwZCUsjwSTWSN
TLSH
T147152A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 920KB
SHA256 a866be8c2da639604240dda3d2932770b7363937e9c1cbb1e8c29ab4bbf4d7a2
MD5 65dfbb0337dd4e1843eb31993246aca8
SHA1 48d51fca01090eeefd393afd6c03121aa5c017ad
SHA512 1e90101c108168c1746d95944a02aebe51e2aa93606a977bfea7d67aa31006bb613a1b9171eeffe261779a7a08fb0087a00845ac81ddc0c87fd4e54371c5adf9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWIf:t/sCv7rTiw2RYwZCUsjwSTWIf
TLSH
T172152A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 920KB
SHA256 a53c18958a3e8c41ee460b86bafff8dd5e1895dec5cadd2f620552c5b486860d
MD5 6e14efbd24aaa62fd2277863b76ce67c
SHA1 db558aeed05bfcc4562db6b70d4646d5e37a4184
SHA512 097aa6a7a9bdb7afe680ff17486b0e0de4694c9f00a1734db644eecea604a2f28d56d554dae64e24a110567d8972a8af93139292f09142ee88569cdb431b5224
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWio:t/sCv7rTiw2RYwZCUsjwSTWio
TLSH
T18C152A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 920KB
SHA256 03eadbe5bb226010a13268226c0ac6dadec9478cabfbd108f49fecf1c42a2c15
MD5 0c5e99cc1c88b25f7517f05becfe48c9
SHA1 99dcb2ed4ed75463ae69cf7366db330665c58927
SHA512 ccf76a986136f3b0b19a59054c95f2bd9873f4654ad7dbf9aee44587a2b5fe7d3ed35f655f541d479ea26e5c6e5b76035d19c3b75984b7d165656e8dcc5fde28
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWWu:t/sCv7rTiw2RYwZCUsjwSTWWu
TLSH
T1C5152A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 920KB
SHA256 7d34f6aa046916f403a8421d825b4bbd5738e33516175e7942d1166e052e6bb2
MD5 b38cf21095d5c2969f3e531d966e4ddf
SHA1 7880a23aa856212fb961e8dae800dad0dd6d25c7
SHA512 1cf7779a6a8d54d58f17ef83f318af0b9c8b6bbf3fd479d2f40539c2b19cf2034469eab5b41c94cbe59fd3e1bdda6d69880e26bb496d91f48db584873308f8bc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWK9:t/sCv7rTiw2RYwZCUsjwSTWK9
TLSH
T140153A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 920KB
SHA256 2af290aa69a943ffffc8a13830ad85fde57047ca11f34be6409a86c3cb8a20dc
MD5 b326cbb664bb645faf5525e09d417b35
SHA1 3afdad4d77344ad93e288831a1df9beda75a75ca
SHA512 cbd15eaf4d97d9249f9c2b04fd3a6e94bef82de02d49923399165e7e85bc158767628071f204b943bd8baa015ed17131fab34fb759b590e9a2c04096f39204e6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWKc:t/sCv7rTiw2RYwZCUsjwSTWKc
TLSH
T1ED152A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 920KB
SHA256 e3236c02962bf1cb31b079d1db22f0cc55f090b53c44381957b40eadb5422afd
MD5 0d700390322c7ec184c6c90e455f1035
SHA1 31dc61ab8cc1d42f94eedb78961a38943818b7d4
SHA512 75298094b4b9292c5d2e17edcdd2c4e21a3b26396f1a6bc6632a72986b94a29991d764ec3b8871dc7fb717b055f7bd4204a3d19634ec125d0199c719da334903
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWDp:t/sCv7rTiw2RYwZCUsjwSTWDp
TLSH
T1DB153A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 920KB
SHA256 582243970ce927f57991d4d5c7bfdd464529b63bfdc477053e08c3e841fc1197
MD5 a536fcbf12747b531bb480957236ada2
SHA1 4e9920ce65905096e08c30a5bffcbc191c65db8a
SHA512 a5c0e20f6e44286a5c3ac76ecac3011108e309110c08fad3a5369d7b5127a965a8e8a23f2a521fc982469b561e512df1acc1b4866c80b635844c4e139f64c1d8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWk0a:t/sCv7rTiw2RYwZCUsjwSTWkN
TLSH
T13E153A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 920KB
SHA256 79410a528333ee59029151b9933996abb518c1ecf5c8213d9357829d056240fc
MD5 fe6cb1b98cc496c3413701c67d62d23a
SHA1 3569faad3d7f4322efb63cc6e7092bd919a97534
SHA512 1e9215ba69ae0d3db4d7b6de1b3b424e061e149ece5e22023c107924d60603fdceef3ff695c25cf8bf2748e90e0dcc2578c989ba35e98fdfa6ba793e938400f5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWMF:t/sCv7rTiw2RYwZCUsjwSTWMF
TLSH
T1F7153A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 920KB
SHA256 30f3e89717408c0d8c46ca13b79a448ad6caca90bea3d00c6dabdc7f16b7c3dd
MD5 e6416ba5b6eb12a124e6ad079656b7fb
SHA1 b5d91bf56c0790428b5edc91feb9db8a49b7ddc1
SHA512 88bb727595665729ba6a2230422ff17285c0fe7ff8b6e26a4eafbd83f9ceaba6c3839e4c9e61bf06fedbc8a529ed74dfbff0279c4a6cfc9efa9163c83f91026a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTW5C:t/sCv7rTiw2RYwZCUsjwSTW5C
TLSH
T14C152A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 920KB
SHA256 f2c8c110d3cc83047d53d4e85f863008ea2a30f9f803f325d21c65b3b1f5cb73
MD5 26db4ddcc5e0c16af273e19909304aab
SHA1 a073bf67e9d5d34fe2ee6bb730594c60de52a880
SHA512 7d9d7e4f60b3946ae4dd28e0a48bc104cb2c227c8bfe48d249b87890601e953af5cc94659634e9f0dda6efa1729d7674cd1661303c01f15876eef5e27ce72d9a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTW6w:t/sCv7rTiw2RYwZCUsjwSTW6w
TLSH
T11E153A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 920KB
SHA256 469f0b23662eb70f19babe42cc20461a41607cdf5e40b7e89e45cee7fc8243b1
MD5 b2259058f9cb0522a222f89583d5edfd
SHA1 0c4d7a60a1c62276a796fadca04511c3e819b494
SHA512 b391fc4443a6dc779d7d7d10b7e22a5d52024a2f984a42e26ff7bd4f704666f816f5b881977b5c2eb7a95f5caf930c03a96f342055dfe3be9f29041469948707
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWBT:t/sCv7rTiw2RYwZCUsjwSTWBT
TLSH
T1BF153A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 920KB
SHA256 e5228412c1e3699af74e4e311022c4301a98311a1156e2402769268913401a42
MD5 32d31707bd0f20e2cd5aa6c9f4f0a595
SHA1 e195bb2d56618f74c3ca92a563d0751413fa209d
SHA512 9991f56c3bdde1808e5ead7b073e7129eb7774df609f8c39c50cc83a06e3058a2042fb9196039d6d44e22851c1dd1151b1ce7bdb2d726c9f8a88a7bbc3618c12
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWvu:t/sCv7rTiw2RYwZCUsjwSTWvu
TLSH
T1E3152A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 920KB
SHA256 03c1b1f383b4f35ade42e1e4a72affcc6f9766624754341045e528b5798aeb07
MD5 6bbfcfee66dbbe10e27a37271f8d9581
SHA1 58ffcf4ea4390795bf8eccd5ab8e3450ebb2c2dc
SHA512 fedc498d2fc11e3c371ee9fa6a46c9673b5d791bf92031c4465304e5ad4c8fb34f4993e296fd4dda3a0426e582f7296d4e18b6f59cb0c91471880b78948ffefc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWTb:t/sCv7rTiw2RYwZCUsjwSTWTb
TLSH
T1DB153A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 920KB
SHA256 4da64ce0cf822de42b81790f8ed63c762a2bd31406960ea627875b3a1bf0dc27
MD5 766629b3f4384026d8e61998cb306c92
SHA1 b6a7d7e16f023a3fcc2ac43dbd29bf8f4408ea63
SHA512 729766a421fc0181e683736f98dccfc57db5a7a295c3a362afda248a40f5741dd1170f2eb2e5303e4eb85cf3b7fcb0b748d13b73c18ce07853433553414869b1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWnf:t/sCv7rTiw2RYwZCUsjwSTWnf
TLSH
T180152A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 920KB
SHA256 769a3e0c98fa7a0e9f6b01913213ffacbc6c8c5ae629a51d7556268d7058b2d1
MD5 b367df490dfa6c612b529cf65b7d609f
SHA1 ca35edb56c8828a59394e7353a4b90f8642ea9e4
SHA512 b983bab317772aec1320cb90bb86f1609a133f7786478c86b161cc3eeb50145946485bee15d0e2ed14bbad398943451b95504babadaba5da2789c82d1a80d48f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWQK:t/sCv7rTiw2RYwZCUsjwSTWQK
TLSH
T1B8153A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 920KB
SHA256 61d854dc882ac3d268da911c6b91a62eb26f5ecfc0127462fa1e1fe65f0d236a
MD5 cf2679df249e026e3c3fa891acdff466
SHA1 04ea42caab7375e6078bcaccac7cc2e19bf52031
SHA512 5bedab64a434cc56a4e862524d152136b36d4831674a9ae824cbe5b8c3bdaa03cd00faf531e985709f2897544bfa038b034518e01cfb10b45999df95af437772
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWNk:t/sCv7rTiw2RYwZCUsjwSTWNk
TLSH
T114153A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 920KB
SHA256 ec12b2534baf3627eb8820d0388120b8695620ec00e3bc12c2af1031b7b4eb03
MD5 354342d4a30a1e2280a586062ea0cad3
SHA1 ecbceb28a5b5011f3a67bba903c5b863170639b2
SHA512 feb61297257a9f6d9e9de5b34e3fcb8e97d0b456fcc94b73bdd89400c5ef2d4e4ef44dd23c3120b4020a6e9e2a895c16526a97c62a1eecfb06c32fb48c1e43e7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWS0:t/sCv7rTiw2RYwZCUsjwSTWS0
TLSH
T137152A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 920KB
SHA256 489114d51ad6f2f8367604b34b46ee52c0f94f90cd0037c4af8514bdc3cbcc91
MD5 c54a6bf1251445c72a36987f48d9d5ef
SHA1 78cbb32e36ca3c44a141bde78218af7b588133e6
SHA512 287768d2a3ec2df430f3c9c7b62e2b82e128d043fb295ecd08945333857fcf832b54a3772ba275a5b12d04d56fd424e4722b9afd3b1a4004e81ef670d28cf752
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWh70:t/sCv7rTiw2RYwZCUsjwSTWhg
TLSH
T138152A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 920KB
SHA256 e7e898e2d77b8eae921b80b9bf6c466fafb79026995337f3ca4852ff81202a94
MD5 94ca1f3bcf3c9ef9ca19e23d36f3bc53
SHA1 dd8d800bae1589e31ac28b01700180bdc28ab744
SHA512 9758e62f2cf59a43030242a96067c8819492b74767f4567ceda4dc8a846ea51cc309241c12fb44bf27f2b56135e0410c4a3f6135f9e451c0a35b9c9eddd4a4a5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWIr:t/sCv7rTiw2RYwZCUsjwSTWIr
TLSH
T10C153A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 920KB
SHA256 dfbe99d76b032506f3429139196f654f120329ffbc25a0555eb4713cdcb841ca
MD5 cbff2adc52af346f3f876cfbd4c531fb
SHA1 9ca66bb920c577b333c7cce5379192056e3f78d8
SHA512 b02fc7c65bb5138851f5c81f57306ced527bf2e0cdda0a646d1936fbcbd29ec27940cc7ee91669212e323ac1929909f6e2e7b96d80b6f8b407fe29bd05c31d25
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWmn:t/sCv7rTiw2RYwZCUsjwSTWmn
TLSH
T107153A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 920KB
SHA256 8f7e3ce0d23bd75042766f05171194dfb420231646349f9f392de668d05c67d5
MD5 87f2e740ad3ec6c56a14317702d6761c
SHA1 e43c0c616dcec304725d9920beaa2cffd9e619a9
SHA512 d8a253c9f913c5917406b9d6a7c6876ae129b1a1378f4aea342445a4b569ff50d02b2209ceb5b96af6002253d5f876e218c7c3f27e5debef399df80c1d76569b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWsx:t/sCv7rTiw2RYwZCUsjwSTWsx
TLSH
T163153A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 920KB
SHA256 f56a644229c076e8f4d9f074be3a1dffabcfac02aed78c66c5ef2655c99b5385
MD5 fd4a081a3fddbd88f3c8a5f0d531fbfd
SHA1 19b191d0d3ac6246eadb5f80f1508fbad7db3669
SHA512 a63b9fdd697c10894559c96aaf6700342dfed8be9500cb1821ebe83976d5dc34a5b1ab27510217d3f902f7f81954b0c0b4bb5a2d8e9b083822f75dea912931f9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWmA:t/sCv7rTiw2RYwZCUsjwSTWmA
TLSH
T18D153A1767EC4895E462A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 920KB
SHA256 cc7abb70ca5a252af3be41ae705d3be907d81cf80e4c865fd801b1782205ac99
MD5 7d13c59b2e1cd616476d9779d51c2f83
SHA1 8ed4bf359d8743eb528d2de584cbb8f3162530e6
SHA512 5ed7eb4bf8f0a9515c129b8c846b3ef5afd2052f9be116e76d854c7b1baa9289f8351843d168be99fc62736c385c284c1e61d035eed0febcaea411fc734ec458
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTW/9Q:t/sCv7rTiw2RYwZCUsjwSTW/9Q
TLSH
T1F9153A1767EC4895E462A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 920KB
SHA256 903c1d6c279853316b8032f1fd51feff5304fc36a16f5469e055aaeda747984b
MD5 828fa9e83fa74ec7fb55d51e1f26701d
SHA1 2d5a38d279e3ffea59b3e6d3bb12f432feabda28
SHA512 b927fab6015ee38ff4b9177c3a241c362140c23cc1ca220cbe2261c1555cecb5dbaf9083d78adb6843d52f97c9e0a9e66d392eb72ca899e5b04e4f8b79e2cfce
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTW24:t/sCv7rTiw2RYwZCUsjwSTW24
TLSH
T11F153A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 920KB
SHA256 6d03c7cbc9a3a4c2eecce9672ddb23d6a9042bc738a5155192ba840000e3e28d
MD5 b3c99eb3f5c316e75083b9214b73b38a
SHA1 f750f7bb6c343f98059e533ef3c8a74a0d1ef3fc
SHA512 89cdbcb002f6d3fd638189891a764ec470e349d7e34ad4619299807e90cfe87fcbd0fd75d169cc43e7529db3f665b825ce1da6ad91b2e01880cae0610341e396
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWlu:t/sCv7rTiw2RYwZCUsjwSTWlu
TLSH
T14C152A1767EC4895E462A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 920KB
SHA256 5c7367ae98e16e7a95787e1b9c044ea567741dc3b50ceee9df45b10efd8cbabd
MD5 d60a63cc9a9f56cd1b4b09b65fb7e13c
SHA1 e4a3f6cea1e3373f464c18a06a9ae3b310db0098
SHA512 ead7c15129d9547e4e87fbf630882a25a278c813dba12d731882fbb2b45f7f73a5403901ff7ddca67130f13e5a7617c49c25188adb60f9d41aa6903a6a0a972c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTW4j:t/sCv7rTiw2RYwZCUsjwSTW4j
TLSH
T14D153A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 920KB
SHA256 160b658318d6a7219adebdcba8b6421d682d53ca3d00a4d464a7fd55b94cee97
MD5 ebd45f768730b0a18366aed191c44b9b
SHA1 c6e0d3d206e4ee5966a83557bb0f5d9e02a6138b
SHA512 82aad4244ab01fbe2b405a0922e78c02623610f961b7b2759518e9a881927a79654f3f92e9bcfca24329e65dcd36a12eefadd6c4481c4310be4e606008629214
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWJg:t/sCv7rTiw2RYwZCUsjwSTWJg
TLSH
T130153A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 920KB
SHA256 b3781415e9cefc6f46f6b382a4050518118f823d241168916bdb73dda21a0c03
MD5 3a623cbf2ec1b70a98eea5e20f546804
SHA1 1ff3ebeed5b2443095ad42110c7f7d2191c08503
SHA512 278f349ab1d527187cbed513b167df958aa9619ddd5783c2118e5fc415760e2f19a55c1c977327d2f2d3044aedc9bf18df85eb3f22d34a9e90c404363d7176cf
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWQI:t/sCv7rTiw2RYwZCUsjwSTWQI
TLSH
T1D2152A1767EC4895E462A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 920KB
SHA256 03b7340cd5e0f9d017e215f031ef239dfd0c828ebe65b7ca7cbf8e56276b4815
MD5 1580ad196536214e10f80d8a3e084e60
SHA1 6402c353acc119f173ec753a5306904ee55027cc
SHA512 82a55c3f41e938c18a87f73dc9a44fa3edbbbd4e84a9b2088466769824b6360c16a6511e3b4ec5639a51a53251976ca3a60ee3f8b4ce3b6c7226737b859a6f78
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWSo:t/sCv7rTiw2RYwZCUsjwSTWSo
TLSH
T1A9153A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 920KB
SHA256 c279270accdd283e85482e0dc31b9ab03dbdf6be4f5e065c279f1db17bd908f7
MD5 0f368385dbbdf54c80c8d409aea2b459
SHA1 a17342246a33fd1f70a63a43036e7b77dc7e353f
SHA512 66275d510cdf1674e57015f341fb277772bfca30dfaae5ba36d00d8abc34d84a7d01edf753042a8281ece6217ea40d3f15a74b82fad04edbd6b00c38a5941de6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWJ+:t/sCv7rTiw2RYwZCUsjwSTWJ+
TLSH
T19A152A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 920KB
SHA256 c5cfe14fd315de9ec37e0a2451da21fdff91dcf5ad640726fd666f34805ab8d8
MD5 743b6a14fc5a5721474140eb4500e478
SHA1 862731c31c82e2aa1c01f29d7cbf65807c5af428
SHA512 fa4c53c3ec844c3a8fa927258b2507b0e0aef0396660fde3cdc099e4c3e44aed731d69ee57f5703f1da2a2c3fef34e0ed447b03ef20fb0b3fd4079a9cf332707
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTW3Q:t/sCv7rTiw2RYwZCUsjwSTW3Q
TLSH
T125153A1767EC4895E466A13089B58616EB72F8561B31C3CF12788B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 920KB
SHA256 767c0ea50f5d0d8ed7fd11d95d1b62a94e65d9d232e7fb45fd3633e5aedf983b
MD5 c50b506dfb8119a9e7e18208ccdddf48
SHA1 e9b8a3e9d39f475393ad0e44bea6096515cb284e
SHA512 ef91b9b603fb6c1474337441f46cfa066683b90010ec2b291d00f9757f72b6879a8d412bc66594f82d6b0961a8129d9b9096534f1679afb7aedf6241c274015f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWMX:t/sCv7rTiw2RYwZCUsjwSTWMX
TLSH
T1B7153A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 920KB
SHA256 a3735c7e06d437856edbb732b00856ab944f3a39415724420b085f2ac4a90326
MD5 4a24ba8b14e495be4b17b0ac525e1a80
SHA1 fd1798d1c5ebda226435a0b3fe3a41d0c76125a3
SHA512 c25c4e52beba8a6de5367d0ea0147f069a0214f8d73324df960b31f137b6b9e5f650463c13c6c06ffc45d13fa0e39a7d3741d9aa1f483eeaae14619908a4a218
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWqL:t/sCv7rTiw2RYwZCUsjwSTWqL
TLSH
T145153A1767EC4895E466613089B58616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 920KB
SHA256 e3dd557865ad674d855d51fceafebaf5f6a3843ee4a519f0820432a33fd8b952
MD5 9c03a3f9b7ff46d5bc40feb5a688ca22
SHA1 598685a94978fc83c56c8e4386abecf31203b06d
SHA512 09ba3a17e15e24bbbfa197f4445b8dfcceccf14c1ad1f244ae896adf829be83f1198520e407d53d9b122376ec08ba98febdc82af828666f2cc865ce2dd5e32fe
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWOFC:t/sCv7rTiw2RYwZCUsjwSTWOM
TLSH
T1A2152A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 920KB
SHA256 e939705dba70c61ba9bd074f853b8c104bc04af3724965db3ac97a7c21556846
MD5 724556db02045b4ff8962635d5e4cb86
SHA1 86aee0971a4fbb1da43c8eef281dcb30790b68ab
SHA512 415fccfef7f3131df7429bd07578274027bce09b7ac8552b763a1043eb0d89f699f88e95503690a47e97d0c0542ff904de6d6eea4f95a968c583b158b45cdb93
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTWXh:t/sCv7rTiw2RYwZCUsjwSTWXh
TLSH
T15C152A1767EC4895E466A13089B54616EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3132-41-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3588-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3588-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads