7376ce3a3c9e20ac54a036063739a8b7e9763228c5f82791f402efdccc9eb412

Analysis

max time kernel
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 918KB
Sample260801-aagpcsttcy
SHA256 7376ce3a3c9e20ac54a036063739a8b7e9763228c5f82791f402efdccc9eb412
MD5 40087e0675e246077c02a79a1f17412d
SHA1 27b815d8bbc21b75f470afca2bc4fdc3dc75e30c
SHA512 846da0bd2f37181ab1889e75212f4c4aefaa556fee00a260f6f8d14a20d5537e98039de433472b8e3462398d57b17d5b0262f415ed4cce94cb2d8a5fa87598e7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsie:t/sCv7rTiw2RYwZCUsjKpJsie
TLSH
T105153A1766EC4895E467A13089B94616EB72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4216-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4216-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2728-167-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-666.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5e3-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-9.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-666.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1318.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1332.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1358.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2728	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4216	2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
2728	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_40087e0675e246077c02a79a1f17412d_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4216

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 918KB
SHA256 7376ce3a3c9e20ac54a036063739a8b7e9763228c5f82791f402efdccc9eb412
MD5 40087e0675e246077c02a79a1f17412d
SHA1 27b815d8bbc21b75f470afca2bc4fdc3dc75e30c
SHA512 846da0bd2f37181ab1889e75212f4c4aefaa556fee00a260f6f8d14a20d5537e98039de433472b8e3462398d57b17d5b0262f415ed4cce94cb2d8a5fa87598e7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsie:t/sCv7rTiw2RYwZCUsjKpJsie
TLSH
T105153A1766EC4895E467A13089B94616EB72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 6789dea7d366f5310c4cd7779ec9b6e2c9e2dbebd08833b9ccb36b2f1e4663f4
MD5 4379a761aef7bc69c6ce004b2bc469ae
SHA1 cee9ab9f03b435e31dadda876e6141dff2f7185f
SHA512 808a62a20a264290d0e9751da9d9be8c8ea88f23f220bfe6a3b97a778ffce287868b0aeb56b7d9d5bedf0e7b79fbb308f414b2f64f64a56a91970251ff1397db
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKpJsiE0Le5ji0hmxNrM:x7iw2OPji0Aj
TLSH
T1A0654A17B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 932KB
SHA256 28b833f9dfcb5b380844ae00f0ef3e45d3d66a6d81b478de82425278f8d0e7dd
MD5 833db7108d3e2401eeae077959712225
SHA1 31a7fdc9a0e73c60e294c6f741eef88ec1fe3198
SHA512 cece8f43f7fa9fb8fc2bf7f572cc9b725f201055ee4bd92072ebe392da0d4308c8791c27453c52c2172630e5a8ce1630876d74d85c0cfb88b58952dc4e4864c6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiua:t/sCv7rTiw2RYwZCUsjKpJsiua
TLSH
T193152A1766EC4895E567A13089B94606EA72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 941KB
SHA256 ed741aeb3f6e06e046859faedc9ceeeaa96572b7a2d3ac04b9beb50e3bc6b1ba
MD5 4ea3a7aed502b464f908927b2f0b0e11
SHA1 e9c4abb7c65073500dfa157cc88a6a1c5cf2db10
SHA512 0f090fc718b365de184758e3dd79f2905e50413cbe4a02d25c59938993f615b1794e056fecc2e43afbf22e277a2d81aa80ba134d473356bbc15b6fa896a14628
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiP6:t/sCv7rTiw2RYwZCUsjKpJsiP6
TLSH
T177253A1766EC4895E467A13089F94616EA72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 941KB
SHA256 b731498b1a9b2e49b2cb6361afeedadacce8a1c5933baafb11b35871e510a39a
MD5 e8e0cdb8221ca6afd0f5c2f85fd78765
SHA1 173996ad2eac5685fcc7a62f466bdeb1f5229cf8
SHA512 7adc510cc601e847c5a94b4f8ae58fbeab9495ce54175580d910e5e69a7bace593776e7eb59694181184a5047516762dcda4545ecebfeb43b7d083dfd5d032a9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiRN:t/sCv7rTiw2RYwZCUsjKpJsiRN
TLSH
T14A253A1766EC4895E467A13089F94606EA72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 941KB
SHA256 6ba0dd61e8cd29fdc1160461bf916062426f45b192e3ed35d9704979703f48d5
MD5 6ac43c9649e61a2d9208a2264abe5bdc
SHA1 bebe01f2a4ec5ad9940ff2e72cc4f05885a032d9
SHA512 f354b9be57c50b6e77ae162529fa95ff8e72e1550afc9719632a8b4801b52fdefac7fa1dba112c16c09464d628436a3cb0de3ab8ab63ae9f4e97bd8463836c0a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiHf:t/sCv7rTiw2RYwZCUsjKpJsiHf
TLSH
T12A253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 941KB
SHA256 71324611b71c1f8ff82751d04a626f3e0741f126563efe8fd65deb05a1ae527f
MD5 267fd12a9dd846989212d20dd7cc3153
SHA1 a5f0d5d5557a61305eac3e752baef011fa244c5b
SHA512 27f64de5900ae7bb73b6a45815a385b0c028a97f1cb87f948868f614c4c4dc55e12b9d81a93b91513dacc4a472fb37c7de7354f9860115a524eead9183b05cec
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiJo:t/sCv7rTiw2RYwZCUsjKpJsiJo
TLSH
T187253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 941KB
SHA256 6dad5421c9fbe06bab061b7362f69e18af741ddbd12a58073f9c9623f3ded6db
MD5 8bd7f88ba6e2f8bb844d46290d639c26
SHA1 f65f87222081e303af6a891478de8e4679f3eba3
SHA512 4a4af70acad0ed38c87c422726a8594648dd5c2746105807bed708b5caeeab49940ca61df4d782828aa315bd0ea9f1a1426c226ddcf83a5db0a710bc9bea3e10
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsi5u:t/sCv7rTiw2RYwZCUsjKpJsi5u
TLSH
T1BE253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 941KB
SHA256 b0902332f2954575b69c25f47510290780227764abfd779ddab7c0beed985ed1
MD5 06e8e895fc4b357a8b7c3ee91d195027
SHA1 4ececc2575afaa76905b2ca29e706bb681889681
SHA512 07b9c69712e74ad0ab1bb34f1f78b9d377690f2edd86f6d4e3befa1ee9e4727e11d05fd8c9936952fe7746ac6298ad7ba793252f280ac7362a8f232247a51d66
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsif9:t/sCv7rTiw2RYwZCUsjKpJsif9
TLSH
T161253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 941KB
SHA256 e81a7f2ad0d1cd35acad6658d224e39b8dcfd049472445189f2835a3d3191e80
MD5 d1d0161ea2575f171fcc2a7e4b65af62
SHA1 c84d04a1449f960cce2ee2fd39506807e5ed8ba3
SHA512 eb565e29965a1e3b72231ac1121e4616831ae9513ea8caa08876961d2da82b63f0ef0cdd35ef99c6d3b0e81158ccdae4d6b2f6d98455f5dcec2e6ef41b96e3a2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsi7c:t/sCv7rTiw2RYwZCUsjKpJsi7c
TLSH
T1F7253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 941KB
SHA256 773c68a1042a2c4eff563163039a56362e222d4cc3503258486e8dcfdc774e0c
MD5 fa76f2746c1a3288b579a3dd55216f1a
SHA1 7e0d050915d98943ca17e9aee75766fbe1385d9e
SHA512 5a01f8bb09f206cc859ced0d1865dce0b2d5ef4d06ae5f2afe3043ab9dbac8bb3b83c8bec2fde84346cd90342ef7cc93b248e9d60a5b1b365b3f539d2e50a057
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsikp:t/sCv7rTiw2RYwZCUsjKpJsikp
TLSH
T109253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 941KB
SHA256 fa6410cd35d8627e4885785f54e8961b9963ff12a3edbb8065341ce361e2c217
MD5 550d0650543802238808e8f44734b54d
SHA1 c56c8f6c35fe95f17016cf2c1eded95199a1b2f7
SHA512 37255f4d32d333e148ee1543fc9a605409f1840c8a93b4efa2289bcd1676ae85e27acde06e67c28585c0340585820b289a759895847430b9344ef3586b7184b7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsir0a:t/sCv7rTiw2RYwZCUsjKpJsirN
TLSH
T193253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 941KB
SHA256 f9fd6801dcc57e12602c4c0113e619c54036ef7fb6d48c7c82a5af753c67d16b
MD5 27614a9e8c8af4c1a7901d3ed072f2e3
SHA1 897fdcbf6745d679b1e2027f514a2883e4af43e6
SHA512 bc2d9ecded440ca66dde11249e63fdc701f36c79a3ddebc64deb22b9f1eaf438ea7790cd2bbc1fc7a32bc10cc2ff562f0b4540e08e0180ad27f61d5466410b40
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsi5F:t/sCv7rTiw2RYwZCUsjKpJsi5F
TLSH
T1A8253A1766EC4895E466A13089F94616EB72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 941KB
SHA256 aa8024d908a6aa82902ef828c731e8e285f2322e0afd765791bcea0535eb7e78
MD5 60929213c3fcfd94fb9b9ac7e727f01e
SHA1 117d22ee12e636a4a7679097e96dcb0c0ae91451
SHA512 ee23c2606060b9f8c638ec2d6dd5d3ef3e15bf55976dad1841105c3e6559fc3ee17e2ca507d37da35e867fb495abb5d652e55fc537e247781eb1cd4aaaa16fb5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiSC:t/sCv7rTiw2RYwZCUsjKpJsiSC
TLSH
T143253A1766EC4895E467A13089F94606EA72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 941KB
SHA256 57d2a23eb6fa3700eb67d1c9df0b0adc9a37dc46c19e3dff6a7a15de10eed882
MD5 9413edd937afdbbad3155085e03bfc1e
SHA1 cc67afeb398b9136186ba57eae170859547d1cb2
SHA512 54f2235bbea107565f6cc6ea3bb0bc6bea1ac06eb9995cc38720c931cc525d70fa908cc1e1aba44c347d6f1404bca45abbaf6e2d5b61d8b8a63ee6705ffb752a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiNw:t/sCv7rTiw2RYwZCUsjKpJsiNw
TLSH
T1E6253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 941KB
SHA256 f8aa467f45c34a6cccc7d0acc70b5018e7ea877d1e4608cae01b588f2a8fcd9f
MD5 c64a3470dd8ee09d342d8033b02d3ef4
SHA1 3a8e2243dc48096214f9bd4234c4a0e9ddaeb465
SHA512 028df9d3a37a101f7d1d985d92251f49d026beae3d9ff3a54d72b473c3ee007c30f817212f3e7fb5f6b9f81fb660feba3ed22822a1b7bd89865d836affd2e126
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsi8T:t/sCv7rTiw2RYwZCUsjKpJsi8T
TLSH
T1E3253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 941KB
SHA256 6075ec0693d47aa7bb27f7ca60ab2312fe571c4b8888542528e579bc09c7b195
MD5 110c05764bd206316901ade8a1bd3a47
SHA1 e81771b4f4ba11ae04dbeb91d2bcb69c88f93267
SHA512 987a1079ecfdf7d792ea889cd3a91fce08362d935f3b479f1f2eb0a4b8a46293a486b2a1aa4ea812dd7317a6c8afb95b0d0061e97d9a673974a45c5b15c4341b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiQu:t/sCv7rTiw2RYwZCUsjKpJsiQu
TLSH
T10B253A1766EC4895E467A13089F94606EA72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 941KB
SHA256 6340296006b2a225dad901f9bcd4ab486f95bc335ec94d0febb0f82cad14d48d
MD5 bec701ebd00f9c96e5710dbb7e70a4ab
SHA1 06cebdc886cf94590add214ced355a4d3c274073
SHA512 42c0f411b191aadd9107425becb4b4843b5744bb337cf078e51ce6b4eacdbefd8fedfe9add2b3a454fc42c9db0ce971e563a72dd4bc3b328ab2c066ed7de6414
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiub:t/sCv7rTiw2RYwZCUsjKpJsiub
TLSH
T12D253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 941KB
SHA256 f0e5de9d2390fb282855276f3715004a4396c2213a7bbb2ae1e871a0f1a8e97d
MD5 d5299d2c0f5b64137820bf02e677b2b1
SHA1 149ed8af1d2160fe90774ff4eaf9a69a52154097
SHA512 9a51ae6495de24788a2b1468000cd1476a5551fa543d64a5384ab054bccfdff182c7b9a5b6df31fe2395bcb491e0489b90b7e63304d580b1a5305f27671e768e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiYf:t/sCv7rTiw2RYwZCUsjKpJsiYf
TLSH
T155253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 941KB
SHA256 1025858d005b6b92d3d324792d93572b24839121639b8d0562b2305a84edff3b
MD5 bc5277abc7d6d04eab3615e09b2ac1b2
SHA1 c42fdd4e2f77ccb0c3c79a97aa225e98ca85f785
SHA512 51a655fc449b5a11843aa3976135e2b112d6b577903465e35cda9a34ed9adcdb29f09b765d87dd900ecc485a5d97daf8856bcfc66d65132a8307b5e29d9491ac
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiVK:t/sCv7rTiw2RYwZCUsjKpJsiVK
TLSH
T137253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 941KB
SHA256 34637c1f9c715c50b45fc1894d128a5dc1299935cbfee6ccfdd90df3057efe6e
MD5 1c1f03b8656027055d31c7738188a82f
SHA1 162cfe8fbd470c20b5b13e52f896e7253021c8f4
SHA512 235c44718017e6d360710303ebdeba8ae69ab353d643ee2cac4ecc499df18f706a51d551856bdd4afea09c0ff9b190b5b12758593f88c5ce1c0f192576796225
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiWk:t/sCv7rTiw2RYwZCUsjKpJsiWk
TLSH
T193253A1766EC4895E467A13089F94616EA72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 941KB
SHA256 aecf1f8237995a3776226dd15a860ad386239afa258965d53b9973539ec2cbce
MD5 b7143e41ca49b3b412a376d8802529ce
SHA1 6147c868d19a3945da71c4214d9f9355bd49e980
SHA512 d31b02fc88765d28377e37c36c66e7267fdcfff35dc4ccc777b288c868d04f977ea5d871ca081aca5034acea444e75140a09b907237f85348049efc8ca059245
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiz0:t/sCv7rTiw2RYwZCUsjKpJsiz0
TLSH
T13F253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 941KB
SHA256 c4c21dc85aa89cd95f61f4b0afe7848dccdcca77c1bf45d964f5b43df6446a2a
MD5 1fc3dabb485d7623e909b9c34738b93d
SHA1 abbd3168ec67b51ab2bd9d447cd16dfb639e985a
SHA512 075485d92d282c3e8241da4624a2ac67c1248c978a10872271e747b98e6ec416c797df15d1711eb2d9026731a8ae9cca4761ce42c9ffdbb43e90a4869101a9a9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiC70:t/sCv7rTiw2RYwZCUsjKpJsiCg
TLSH
T1A5253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 941KB
SHA256 367dd88d8293e86262f2dbd1aa224551f9638eb482f78bed29f7f31f8be5abb3
MD5 5f55c7cce643be684e05a4e21b735563
SHA1 e628eb426e7a2eec2461ceed17b824d2dffdeb65
SHA512 2c0caeb0573593233076982fc1cc6e8a003142aff98792e963a978b72e3379396f21f0cbfd978377622dafed170cd4df82d2f22151a9618d32b477c9a469f9b6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsijr:t/sCv7rTiw2RYwZCUsjKpJsijr
TLSH
T14E253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 941KB
SHA256 b2b543f231915e337f592296e3d69be1b13fe3e6c5c72f92cc34872bf7d1cd6e
MD5 8ae37666dc90dad5a19e23cff748edcf
SHA1 ae148dec3c12e7a7cbaa7cf8bee02721c211848b
SHA512 9df93ead54488624d88b4b9e7c8e4191aa6c059df8a58c5570f96373b2469aa8e1b2c4466cc4dc560c4b68cf46c1f7f8b6475f5a628d533d22b871da76f2f208
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiFn:t/sCv7rTiw2RYwZCUsjKpJsiFn
TLSH
T1E9253A1766EC4895E466A13089F94616EA72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 941KB
SHA256 f0f88c301d078fd3f2b90767c5b9595d2fcf839d8cb87f21a15cfea8a27d6451
MD5 1d277a6fa8a2270f764f73f105230331
SHA1 b51d384f88a629941c0c09a4f3cae156dc453c3b
SHA512 31e980e99f3c2e04247077983c8309c3f7d0ab00a477336dd8987e4a8f75d5aa9e14815693a7c2bec695d9b5327bd02cbaf787f0b0b9b42dfd57b470804abe98
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsixx:t/sCv7rTiw2RYwZCUsjKpJsixx
TLSH
T1A4253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 941KB
SHA256 553c86ae5ccf9450ba2df53892c3347f72499301026a6da01aa46b274d5ec2a4
MD5 074bcf2c8c85be4d08a04f9df6319153
SHA1 0f5f15a6a92fa90a65ecd7776421d472c8986a7c
SHA512 71eb1ce09caba7d709adc0688f42f41023019c4249ca85a4a61e6c50f91d46e231562e0f4e6ffbe2dc70aef409e413887152e78c7ca3a35c36660993698fbbd5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsifA:t/sCv7rTiw2RYwZCUsjKpJsifA
TLSH
T1F3253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 941KB
SHA256 60fd5006bb1617a467b7fd85bc456c8b367cf22cd2fc59732896b9628dc95985
MD5 a27f8afff8b74a35cf518280130bcc25
SHA1 6a5c5cb3375c2fe00172fe5a61997bd004dbf463
SHA512 6dc0af370c5612a276327cdb3b5e86f2c3216f93fb7136e840bba59d5b171d87a312bee5d38fb47db57f613341e50c227b5a5e338fb5b71408ccdce0d5a85511
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiw9Q:t/sCv7rTiw2RYwZCUsjKpJsiw9Q
TLSH
T196253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 941KB
SHA256 fa44a0d2b3be159f869b642246017b1b5c51327b7892315720b507e206249993
MD5 4fb31d1f4d862438407b0091f112def8
SHA1 bc103ea714cf738b5b6b3e0085048f1af9a17b9c
SHA512 7b3f99b2f365b52b282394b48243a543f7a290de405322671f15b3a87e95f7bacd3345a4c1be59c43ed8ace4d4cb45da51c513035d8d0cbf9f414279552f1dea
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiR4:t/sCv7rTiw2RYwZCUsjKpJsiR4
TLSH
T132253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 941KB
SHA256 cb1fea6cf4b37fb07eaeaba9f59392381e98645a9b878f8a0d557718cbab0397
MD5 f834e4c45588c69b6a344b3c928c5d49
SHA1 38abbfcf24bf217b2a7e822c099ac3ec52bcbe82
SHA512 e76746dff4613c7a1a84555c2dc9b573331c6b58c4a6fee8605d603d4fd491998bb59958cbcdea81b86619037acaf43301d9f573fd9a700ad616310a73afb935
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiUu:t/sCv7rTiw2RYwZCUsjKpJsiUu
TLSH
T168253A1766EC4895E466A13089F94616EB72F8561B30C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 941KB
SHA256 cb3f206f48b61201b650b7e9409f289539f1dd98433bb7f69d5737ff66131af3
MD5 f6454f9a7870e71177c32329487e0500
SHA1 3effc079de406010b12f4d34973f1222a6effe1f
SHA512 a4a8f068b483c62420fc3c1e31221803e6d802691ae67f3e7fa383e0d8d1086550e82563a51d1ffdc0ff33372281677cedef919c9a47031d9fa20d89cbfa9162
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsilj:t/sCv7rTiw2RYwZCUsjKpJsilj
TLSH
T1B3253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 941KB
SHA256 0453f27da3ea08e0de1dbadc5cc38543a83c76b6c35a3b1e99fed5cf88cfbfef
MD5 562cc51fa13709bb3d671f8242885e41
SHA1 98ec66f15df11c1adb7de2180a0b3fec24557d18
SHA512 de4bca36e6a37b580d66a5ee13e6ffc7783fd30cfcb7e564431be1a2e0703ed1944e227b7f44895b34e4c6b4e53b4e2200d3a50e0c643a748951f58d4b722d3e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsisg:t/sCv7rTiw2RYwZCUsjKpJsisg
TLSH
T151253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 941KB
SHA256 f65c8e5cd34497ec26345ef204d716b64ffebb13e01b860f21c7cccd2c937bb4
MD5 7da5e625e5a9b93aaa43390a396efe71
SHA1 9ab062b9a341723febbac71d7b0ddb1d8b968816
SHA512 ae9cf6a4826d87390160310858262b672da752482e540d8eca3e06fe693c4304485b66aea9d673a6def837a432f6a140de3db7057577ac0971afdfb00384c828
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsizI:t/sCv7rTiw2RYwZCUsjKpJsizI
TLSH
T148253A1766EC4895E467A13089F94606EA72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 941KB
SHA256 a0b63a250d151bde592c22f4c62b764e75c94900c2915f1fa2c5f5cc9f9f8947
MD5 cf203c46b31f2387d5dcb7b338244178
SHA1 9ad8cbb168d4370d69cd651ecb32a2400cf150d8
SHA512 e30a5122eaafd72b135b54669bd6ce0bdde3d97ec7898e6179f39c0ee614b92aecf41984e70e894c5dc086f242f39ddd5eaaa1a9f5f47f50e59c16642420f045
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiJo:t/sCv7rTiw2RYwZCUsjKpJsiJo
TLSH
T1AF253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 941KB
SHA256 d3e10748ec1a1dc0c993f372dfe3a4aac2af02498d4962945a76e71da17edfca
MD5 2fc8d2d7651f1b4d582e8940bd2b15be
SHA1 5b5814692fda4a996d42ec795fb7677797f97e15
SHA512 da40169998565c7fa80c5458fb7408bac2c004f6bfb757195161ec0b10c7ff2bd4af3eec8a656426b39eb8d834acff9959c07f25c1b8ec78df9d00f524a2ee45
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsi6+:t/sCv7rTiw2RYwZCUsjKpJsi6+
TLSH
T12A253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 941KB
SHA256 c65ba05edba715be8675be16f7c8af79477d65bec7a14f4eab29a51210e5ab14
MD5 bb348aafce7065fe30499ab79fc1b675
SHA1 22550a7bfc67a429b559f7a7fb404b336b5a3cba
SHA512 b32c2c77ce0d304885996af5ea97c69fce3c92ecf2d28b50e0ce8f126e546e7ad2f519e12eb1468a647904fc8cc9eb59cd9553f24dbfb5552a93936f72aca0f0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsi6Q:t/sCv7rTiw2RYwZCUsjKpJsi6Q
TLSH
T123253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 941KB
SHA256 d61302f0b0e3a2b6b44587dbb1a41b5976e92cc8c05978b7b8de118a9701d96c
MD5 9071ac9d8f29ed97c43abff48e822e1e
SHA1 0a8bbd01f4111c367b91431f46429242595f6605
SHA512 200a963d3105ee0c8e102149258f1380db414153e2f99eab2fb10289ab8711f43682c5958463086a26055c48fd5a7d2794e119decd50b7e0dcda911ed0a1156a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiLX:t/sCv7rTiw2RYwZCUsjKpJsiLX
TLSH
T13A253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 941KB
SHA256 907c259145b52547181edd730e575cd9b5900d344cd7f18baa683c6ef40b9a59
MD5 58900b85c31d9f7bcc12256aac2694ab
SHA1 4e0657a9902146d01405836bfd28822558852eb1
SHA512 2eb36573582f2d69dc75d77b3320e66126ca191cd456c6bab9f59d16ce413a59c2e2c19abfae490c3dfd73f8d29bc9e1e23e99b226a3867cb0e0a2698eaff979
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiZL:t/sCv7rTiw2RYwZCUsjKpJsiZL
TLSH
T1B5253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 941KB
SHA256 e2919bd32cfb7796c0f529963c421974bbb825d2c07dbccb82ab04ce4f4d373d
MD5 4376e845c36a5721c3d4712056eceea6
SHA1 104e6bee212130c2471a6c6467125d174f07d3dc
SHA512 194fb997c3233d322c8866204c0f645170b4335a9596c34443275e244a32cfaa95f01f3d8a145030761ee84f71ea02e229b265e791830ad9960a15682091faf3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiHFC:t/sCv7rTiw2RYwZCUsjKpJsiHM
TLSH
T1D4253A1766EC4895E466A13089F94606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 941KB
SHA256 9ed134c825df64e240e208afb48cf01e438121257ece77f3cfd8adf8a5527463
MD5 2e2566e35a5b1cce638734dbb50230fd
SHA1 c422cd9c0c8b90bf6dddd4b2e6afa42676c81ad1
SHA512 07c3af3126305757ecc4fcd0f03bdcdce420a491dc55ab7cf9d65d63e56a12385d7a5274c3306b977cb8338b94e20bd5dfd1f1d15d724a58e8fcf431bb21f2ee
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJsiwh:t/sCv7rTiw2RYwZCUsjKpJsiwh
TLSH
T125253A1766EC4895E466A13089F94606EA72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2728-167-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4216-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4216-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads