86c944b8b0463f6bfb94cca76e73911499ee7c055731abb93695e65e8679dd3a

Analysis

max time kernel
105s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260801-2dfd9ayxcw
SHA256 86c944b8b0463f6bfb94cca76e73911499ee7c055731abb93695e65e8679dd3a
MD5 073c2743c30d32f8996bdb409db3128b
SHA1 e6d6b122ffedd7ff735059479f113a7cd19b7790
SHA512 5713772efbc56a1d16d7d7ad7e0f2ec0e6cbd85749fc5db8a7bf6071b26c8578999d2cb8f80399f0ebd8b4443ddf8ae275d18802639890a11be6f0c8d35c08b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/9:A3k03kB56rs
TLSH
T1C4157B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c525-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4148-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/248-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-682.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-946.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c525-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-261.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-442.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-576.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-621.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-682.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-737.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-786.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-823.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-854.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-873.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-893.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-907.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-920.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-946.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-976.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1037.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1062.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1128.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1149.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1175.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1219.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1328.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
248	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4148	2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
248	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_073c2743c30d32f8996bdb409db3128b_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4148

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 86c944b8b0463f6bfb94cca76e73911499ee7c055731abb93695e65e8679dd3a
MD5 073c2743c30d32f8996bdb409db3128b
SHA1 e6d6b122ffedd7ff735059479f113a7cd19b7790
SHA512 5713772efbc56a1d16d7d7ad7e0f2ec0e6cbd85749fc5db8a7bf6071b26c8578999d2cb8f80399f0ebd8b4443ddf8ae275d18802639890a11be6f0c8d35c08b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/9:A3k03kB56rs
TLSH
T1C4157B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8f98b442f7dd1b73834894f4e61bbccee828384ff1cae4d1a8db49cd350ff457
MD5 4954afebe3512cb89de8219df696442f
SHA1 8f041350e7eeb38d82bd626a0b1c3987af97916a
SHA512 e10c88327fdfa4131015d77c5af1ffee505acd88507b42a334b9e3980d751c89b966405a7605336305f58ca40290dd572547d833373d8a5ffbdde74ef928d321
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/J0Le5ji0hmxNrM:A3k03kB56r0Pji0Aj
TLSH
T142655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 b59aef4f69416e8247d30bebfc9999c77980cc542d771accee4a2575cf92a60c
MD5 c2dcc232409e1148ecbe3efcbb3d553a
SHA1 61a3c803f88059a40677adf8a3381c501db2955f
SHA512 32d45148d586b53ad657d231e41fe25c128f0fbb51febf4f2a5d41b9e99bc0ebfc696a69595d878c7c6634d6320396a14ebe63761fcef83754218e09714cb438
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/ba:A3k03kB56r
TLSH
T1E4257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 10107884a615a8bc83b17f17a49ad4682d3496b07ed5a2069ad6e4ef9f483e24
MD5 f59faeeafd3994c728220e100c48cbb1
SHA1 100ad3d51cca86386050355bbc706470a2c05b7a
SHA512 caf272b29a4e0155696268f29024c408d2f1bafddde062d53a6181f9445fb01677fc7d8b7dc0a07bb63227209364b7e073e52d7e559a98f939f06f1f48996df3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/66:A3k03kB56ri
TLSH
T1CF257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 c9f11eeace8f0e81fc40aad1aeb1221281ae4059bacf7877167081e2ee2f1b96
MD5 ca169a4af01d9717bfe7f0653ecc24b8
SHA1 1f04cbd5eaefd07d9a7d989893ac7d855db78ab4
SHA512 3fa9c0ca257332dc56283939393230f64806eabad2db016438ee38e01216c57fda886c85ce7f4b789aa50f08c0968a04127b031dfb229a2430ecbfa08d481a07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/yN:A3k03kB56rL
TLSH
T103257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 146bbb4efc888aab42c8a8cbfb9c637a02b1b7c8fda13cf310272c83d844f373
MD5 6df48837c462aff444d288bef7a24627
SHA1 7af75796a1c8e4942a1144602c0dc35eefef2738
SHA512 02fb7d31b813fc6485ee229b43ae955d61e33fe4fb3e6f93f3f1246ea00fe301801b2efb95a648cd0f709f0591c19db2db1105765b04cf3da714be53c3a4e88b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/of:A3k03kB56rP
TLSH
T154257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 3dbdaa1c01a2920a30ab6a5169efbb655ed3469091d2acd840d4dd4baa1d37ca
MD5 ce1f0a3177c3832047ccc0c1c893943b
SHA1 c92dd7e43cae8d9a10a434afed9b689a1b97f179
SHA512 557150835d4aece1563a6782948561bf8b4a9ca8e4a06e502de1b3ef5b6df9f624ea0202294d8be6cf3c13fa01d23789275225c00aac101fecf2ed89265475b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Co:A3k03kB56rG
TLSH
T10F257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 2308b25047b74108e2431e26a8fb312c45bd6095b3585eda11e806a9aeb9fde0
MD5 94b30ed71ec8892b34abd683019fea1a
SHA1 9376b9fa85788299f2474c355cf42d3a35b67a84
SHA512 6248810a1341a6251ebc9f0574f0c43a53241cb6f8bf50726ab85afe1bbe9769eb4d951e236ef95aaf33efca1369bfccfdedbc7aa160df17ee9b711d51c52ea1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/2u:A3k03kB56rQ
TLSH
T1A9257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 027ee3e7ff275ec31aab0ed5707095b08f020781b8bc2cc5e8395e38e60e62d2
MD5 326a1e250438fe3e3cced4b151689658
SHA1 316d065db9907ae36e5cc08231b28db3fad0706e
SHA512 b1e7a89d814c19e3ef403d140800c9be6559972d22831a982ff02c4209565b74a48470c500737ac753a55179d923fe52d7ff2c66200bbe2afc87930c7aaec819
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/q9:A3k03kB56rl
TLSH
T123257B13E6850FA5D00FC1749A954662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 ada63af326b36d1121fd5c59faa2f38b4b8f0da33661ba74c0eddab61ed3661f
MD5 6735f9c64cbb43b6d735f472a4122056
SHA1 9a1bc0e381e08db01d1c9c151fb4493cfd166730
SHA512 bcae26f49b7e1984863b2179b1cb11f5c60b103a44d876ff3304bf8db2bc53b9fa4708e85ca91d81b0a499ea703ec7cdd0010135e7e22c6da4ca848a00b33921
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/qc:A3k03kB56rg
TLSH
T10F257B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 7966fa3fd8f9dab62242a631058e94aaac4468b31752c730fd97de03eb1be703
MD5 505e765e791ffbbecd754a844d64fa33
SHA1 dee12dd9665423bf5f18e1b9ba0986536fa7597b
SHA512 e01a6345d25806ba88de96a2d3a187433b6a9bfb453b9ca7fbc1a3ec7adbc0240f0b9159822d0d9f3a555ae2e4b29acf8b2f364bcb2f4cc33d297bbc959565e3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/jp:A3k03kB56r2
TLSH
T156257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 655bb73326d8d21ca0ea6da55381509287775c87807f45f67a5d2d33ed23c1ab
MD5 03974deb6dc72d2562816c300005b0d4
SHA1 4e7c1a3cce95d61f2f953b1354879e81680530bf
SHA512 5fd6942d3c3ad0704fc0012b10d8787a16fea5e211125ad171df84ef2914e4c9a6ccc91099a4381bfb0e3f7daaf3569084d6cf4fdfb665e7701547351d43fde2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/EN:A3k03kB56r5
TLSH
T1A4257B13E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 225230a313fc38a7c1fe32ba73b5104404f52e52efbcda70b8f9b387a9b1f6dc
MD5 9ba5266c1bbeb53ebfdc8e23e09be3b7
SHA1 121175ea8363c0eb58152110026d9c941f85598f
SHA512 aea82e9653b334e466587d77b99fefe9b6c38ba53f0dd47b31fc22d52b7931159b3e313cff893dd5e34981e7e3544eb7a2b168cccdc7cba7ef8f3db794935927
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/sF:A3k03kB56rr
TLSH
T13C257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 c8e48ad20c8230721bdc4047e450ad7e399a27e79dc6201550ac6748acfded4a
MD5 25ac0254925e20a4781d8694ecc9ac92
SHA1 62ad2001dc29de7ed0d7962d1381bc9d27a85859
SHA512 487e9606143d526635261ceda9b6880e9b6055e5c0fd2ed6fb3824dedeb54243b1beb399879a8df4b84939c390e0f5ac8449f3fc6547a320d8341328005017d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/ZC:A3k03kB56rH
TLSH
T15A257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 3feaa32216517f46ea1f3cdb7e6a79c85541b26488b4790df3f9ef34b189c8a7
MD5 146aaa679c17010bcf143289bc336e11
SHA1 277fd1ae1da2db30ee09e1c211fa9d52a2ed99e8
SHA512 2389d6861f4d28b501cc47a1ec03ca94afb9af92e44eb9d2104943caaea125927035cd7a1f53e5b9eb13006a9d6a5beba74479b3b322a89c5195b8a15edb17b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/aw:A3k03kB56ri
TLSH
T1CB257B13E6850FA5D00FC1749A964662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 2cbb1fd1f6bec427b98aea316a9b90966e922ba4a568e3eb8f9cf14ad8a9bc7d
MD5 71c7a7c3baa5cdf4555e91eda54b7339
SHA1 faf5d48905cd427445d13d2a612f076ab9cb5e1f
SHA512 346721246bdd3151063ede248db0e6bbbf1475476bd3ebfe2c28a3cb7182cff579199096284ae597f01291f6496c6b756b2910342c9bf52e3e6b9532d121449f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/hT:A3k03kB56rS
TLSH
T1A3257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 feae5fa20cce408a9bba07505edbc9113999ed07a5ca8b31899c96ecc1e7b9f0
MD5 a557b6bb204760bbca3f1b5a3d875d83
SHA1 fc1c7cbb9216012fc4c82ad7e06c4b81249fe7c0
SHA512 108c23bdb437118b8f95b3374510213197ef53588eb7bbca70da3fcdb237d6967543c43f3dad5fb12c8cb39cd498f34b4d330c08b8f0ad5d16dea0d8c3476976
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Pu:A3k03kB56rd
TLSH
T115257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 938e8587ec386c4d989cd86b97c5183eb0dbd815b49e9bd9329c589bb2f688d7
MD5 e362aa86c843f8454107c861cba76e3a
SHA1 2db32619d5af3dbd2103b9c1f1d967db09707e34
SHA512 56b611f99bcf30959d22d89499c84ccf41e000ce33725364bf59f7cd137e47b8663cf17863a3d348eed4d68377e7c02f6f7aecbd12551d07640d9c7ad6490e18
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/zb:A3k03kB56rs
TLSH
T1DD257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 66a2d5c205e7353d832ea2af838c388eab91f75fe4588794de4266c19fc31296
MD5 a65eb87d45d4644c84c18717879918c1
SHA1 cde2f95041c0762d0eec2fa831f9392692e09586
SHA512 c8c889b3aa59157d29affb233c84e7d56aa6a4cb11c43409baef7602f527224949d485f12f0d51534cbc8020bf44f9f2a8cdb6099d9bc72e49fb97c142b60c08
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Hf:A3k03kB56rs
TLSH
T133257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 9ec6a97cc854ef6ed1c0927d60e44ab6e134c4661745ff12eb0047f298b864b1
MD5 7dd628dea7ba25e65465180b6c60f47c
SHA1 a6a395878d96a36f58f55112faaf982dedf757c1
SHA512 794a9be9b42fac57860efbed78a07372e5d573945f2ccb28cca61c2204c705fbf83bf1d868a05111705526d80855bca08da7b8286ac04bd33278d3e27f02b4aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/wK:A3k03kB56rc
TLSH
T12E257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 b230645807c436a04f0ef1ffb11d31c69e22e96bc9ad7977b01afee9dfedc979
MD5 b0636338f9b31ef8ff68044244a4128d
SHA1 803908ada89749bb1228a39cbbab1e0a216f897c
SHA512 e2252cfee07ef52861447962acc063d386e55c43257c4253d8ed11220331c47a54d0fb9d8fecbbab6028f3b2142e6bfb3ad83dd48be8b3ec67542a13aace2d36
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/tk:A3k03kB56rl
TLSH
T1BD257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 d7474ad7a97dd6083bada74ec10025b0227df3e15e0412c24c19fd761f9cf89c
MD5 6738b94a92f58bc8a406217471735f42
SHA1 1c6629ce96f3c081544079e9500d0b9149a518b2
SHA512 7b6f4ecaada41086c6808b32047a824bd894a8ac9640fdc78cbdf4ea1162d2e5fad4bd2890b60b8d92d0d3f684cb5dcac932e469a76a42d91447b5b167d300de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/y0:A3k03kB56rY
TLSH
T1A2257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 2f25bf6f4b39f9deefd9d0823d9f758afafbc6bc7db118c1b70ebd8033f5c615
MD5 fd74b7ecc0dbb10da03cffe3c8857b80
SHA1 fe97b39a8060821c152ff787291b2f3dbd21a284
SHA512 1ded8d39aa0b480322aa58b8ae94e4c8caa93eb7cf49731d8427cac30ba9d25d360833be9c8ff74270a12db1c509adcfba167f8549e71757407a640d0db1de57
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Bg:A3k03kB56r9
TLSH
T189257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 50127fa330985f67661f9b37687adac9c148aad9e2ecaa9c9cede66cd3864ba8
MD5 afdbe614fcc474698f11b17c086fe530
SHA1 cfba8574d906754a7e6ca4fbb050d4f265d8af44
SHA512 83a37886c70ea45f2c5813a50aa5c7ccf32c278573b2d3d56966d8682195f209f059d8190d393c732ecead21dbfbc3051121b56f865584cda182fff1d169ddf5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/or:A3k03kB56r/
TLSH
T1CA257B13E6850FA5D00FC1749A964662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 b8a1e9837c2564343d99e2989772291e8ebcef87b93631a623b2d80277b90d89
MD5 1485f734f82f717a4e5dd786ce57bf09
SHA1 9ddb1c1bec5bc8f98ce205cab819ca9b0c6ec03a
SHA512 37f287b783265c15a2f74d8dfbe5ea369bdb7fd095c568599f459cdec010f331feb3cf46c6fb85dbf7a63e2905e126fb57b06e846ca990f45f41f488b7cfe136
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Gn:A3k03kB56r5
TLSH
T1B0257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 0bca07a99161dce1fff713a7a657799bb1148887c1b17eea00dd943b3caa4df0
MD5 57820163aaee485b69295b82082ebe2e
SHA1 1fb67eb155356533019d927622f8ccabce95bba9
SHA512 0df664a41d41b428d968b1d18cc0f357b06e3a8154ae191a5518904f43b96394b03df1fe971592246f1d16c4b1d6cc7be39a87cd167b97807f0c0aa7fc058775
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Mx:A3k03kB56rX
TLSH
T100257B13E6850FA5D00FC1749A964662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 d2e8ec34c379748ba6551e4212e98ee0ac9e3e921586884d90d5b6ac4e958ff0
MD5 79df3574e132ec06cf28d219c5453541
SHA1 cc3d5e852f5c3c0403a0ae4f1db5efd921b93f6c
SHA512 369efcddb69b75dd6924d3bfc568fac2419fd229f89fad109405c5b95c89071cfcf508255387dff5b16253829d49e13cea107e6d416dc2ba069e287e39f6e1b4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/GA:A3k03kB56rY
TLSH
T1B7257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 b33a2eb6a8b1caaff25a0c21806dd2264ae76ff000a46821d77350797a766202
MD5 b83f90ec52371bb8f85f6bd9cabf2a02
SHA1 ad54f01ca64caee1dbc0074bff3dfdc671afbda1
SHA512 de717a6fd84e3e5c4270ab4f87e7f8c5b09e5339513bacaffe334c61e14ddce51981777bd43ee9844a7d66a8920efd6b5057f2b7a7d38861546d5c399784b690
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/f9Q:A3k03kB56rB
TLSH
T1D8257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 690b23badfaad88ca5f938aa770b61cfeade5ad8c38a1f018a67900d79bd40ba
MD5 a6fd0a2ad49bae5731d12938c2f39daf
SHA1 1c7467ff63fc224d33472a713e2ffba757c87a91
SHA512 351642a759d66e1af264d4db85323a4fb8d266c46277b794239e87af979f708fb3b8186af7edaaec2907ad0b801b4cec6e3df7a77c0939e4c3c8201d0b4b772e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/W4:A3k03kB56rm
TLSH
T15A257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 a2a5be2a8bc540f16f4f7b2bdfa2243a73a040b637c8493e952c79d201a627b9
MD5 eed1f09b47371643131022d7de59afea
SHA1 b41a4a002ca6e2eae1e9bbda8476d2042cdf1b38
SHA512 6bec5e5a73b0b6656e4bad2df5ca1103256500a6e5a9794507c67f59cfabd63c329633816cb61fe11b1478f79d299810a837ee39d9791cb03ff34184aae2915b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Fu:A3k03kB56r3
TLSH
T131257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 b562e2f2fa39c08b4edc7a4d3f7b0def99fab53fce6215a29740a8c8d31ebf2b
MD5 bae242bc87ef10fc268e5f24a0795989
SHA1 ef5ea5f0c0ad43da43d4bb740d52629000c3f462
SHA512 0ae5d5a6c36ae1324a1ddcb5cadbc1e7ae6a6e8ac82b77fb7dff4282a47f570c2e25ff98311f5e0002b51f95cbe35f215a29ca9dcac4f0023ae4f1c352f61397
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/Yj:A3k03kB56r5
TLSH
T10D257B13E6850FA5D00FC1749A964662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 a3221e222302dc0b521c5d2ad5e2c574d6a484c4b3d5c7fc95f18d690b4f3dac
MD5 a1e262c7191b54fda5e877dd385dbb63
SHA1 fa51c83cfac31774b69b79eb824ffc0ebcedd2fd
SHA512 d35be819817dd116f9dc5cd44e98c24d6978c540c6eb2c3c3518ffd6c04d4bba5918b8c9b88bfba39fb3914fb48e75be1576992e78f025041784cd8fc4f3b6ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/pg:A3k03kB56rN
TLSH
T117257B13E6850FA5D00FC1749A964662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 12d0a3a622301cf423da54886b316607695737c5d6db2144c63bb291e77c6594
MD5 cbacbc6a8ed53c8a0520c256a834dd51
SHA1 e064189144027d315d25932f778d1ade817ddb8e
SHA512 3979a2d3693feee8d791c891ce7557e7e1459f881207e643a2854c461b0a4719799d63ec47e3deb43c3c0d14ad13dca2fc4f94b8b82188907736beed613e5f66
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/wI:A3k03kB56rE
TLSH
T127257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 bebfc9083c6153027f56606972dfe4791b54a3157ceba9e4f1607624576f424b
MD5 274e9a0ca89e6f51d75d95b26298ee71
SHA1 6bfb75a1a488efe0d60cde68120a122542025dcb
SHA512 8bd2358e528ebc13add1ae3967372cc9922e217f7be5c21ab7fcf89bfc16c4a011ced93fd87a74fb215e1351230b7735c8a48c516aaa25f4240bd294f121812f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/yo:A3k03kB56r2
TLSH
T16B257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 a337e28734bfbf1cd2512d7ba2b3c6be9e6eccfe7254c92344bf87efa71aded0
MD5 14158385f7daa916417304cb7661f039
SHA1 2fc42a3bbbe2fc1af51e8e0d8fbff7e9869d5dd7
SHA512 3f8104911ed17be50aacbe248123bbe68e0ea01db4770364fbf521b4a1898ba2eb6985100d3cc4723d9d2e1d3b0446dfdafdf46b5ff2cde57817f1ad6ece28fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/p+:A3k03kB56rj
TLSH
T1A9257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 42e432d9619fecd64037253957c511da6184c839f3137398165b38d74908b8b8
MD5 087366da00f28b57a1576558dae9396e
SHA1 58b51adcbbfa3089db72cbb876861fb10c989f87
SHA512 35e37f41db7459f844fdf2be7e4719e8c5f7596297f31e9642f09a79d78b1e271122cd43539b461aa6079ad2ccb3c196db4efb281b25c09358ea98379f5f3085
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/XQ:A3k03kB56r3
TLSH
T1F4257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 f5a2a345f3db153fc296842e6b854e72ee2c67dbe6bd91f59852806ac3ba5e9e
MD5 49a40a2ef2f2d666efbd85d888615fe4
SHA1 62e4110d6425596dc2953d7ba3e7df69122cac3f
SHA512 c2071624e8ef3daaa60ae2454533d706f46fac44c6dacb693dcb37c2f067dd8ab1c57dd006a7012c7517b61bd6d4dba9e97922547574f7807c6f23f8ac87b2e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/sX:A3k03kB56rr
TLSH
T1C3257B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 3730669b8a03e3cbb2fc05e942b90efe974457d39f84563c06dc07db0d03e18b
MD5 a7f94c30e317de33a681df30005334a9
SHA1 874b78f7bad0468b119c073fb71e56b266fef82f
SHA512 c1e03c82f480032443822f5934aebc42fe529596f1cbf86395d1d4d36167ab7cd3df282f97df649ef106bb5381532c6a5582d8aa21b76396ee394be5ab031bd3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/KL:A3k03kB56rl
TLSH
T1B0257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 6ce2a9a55c75b658f529da15abca8332bc6786e825413c06c1242576d1dcfdab
MD5 75efaca124024ee9ab2b3b6a132d1b46
SHA1 8faf63159e58bfedf3860cf5d57fcfccc3fe8884
SHA512 0a43d7ce549a16e1b7c88366d4a04e6662df72a75f8344ea1d2f1a27dd9b6be77aee20cb18c73c626401028c0b9f11157043c68e4aa60ad2a1ec2ca7e08cf3e9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/uM:A3k03kB56rc
TLSH
T1FE257B13E6850FA5D00FC1749A958662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 d3e4d5502fd33fe9eebdb0cb0fdaad6652c9f8a87fc59da1088392ed944229ce
MD5 e5a503566e5c44429e85f5e3061af0e5
SHA1 2955fd6d817e4b5739e490d1e74c7c61e24612b7
SHA512 0accaeea4b58efb8a32a3405007eec9af5991d64450a2972064bc92097f640ad281a43d74da03908897c2f8866228195ce1d8d95b2185e3b72f66c6ee3e7e97c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXido/3h:A3k03kB56rW
TLSH
T18E257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads