3dd39676213d6f5a10ed8d12ed03e868ea45265a03425257f0852f6a36a19e41

Analysis

max time kernel
110s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 869KB
Sample260802-3geskatdnh
SHA256 3dd39676213d6f5a10ed8d12ed03e868ea45265a03425257f0852f6a36a19e41
MD5 eac653daf92e8735d7f056c7916df196
SHA1 8f235f5d9be7de71def3555eda40d05026cb2d47
SHA512 f834df4faebfb14542c7c3d621e51060403f56bc1550d3e4c836fe26115eff7cef666b972a392d4d7d5d29d341408300740f4a2fff7a87ca53192994c09bcb95
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7if:t/sCv7rTiw2RYwZCUsjKBif
TLSH
T10F15291766EC4895E467A13489B54606EB72F8551B30C3CF12B88B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/3472-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b871-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3472-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2376-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9e-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000900000001898a-205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-480.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-505.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c000000018a6f-596.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-688.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-804.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-958.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-983.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1102.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1145.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1190.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b871-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c9e-60.dat	aspack_v212_v242
behavioral2/files/0x000900000001898a-205.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-480.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-505.dat	aspack_v212_v242
behavioral2/files/0x000c000000018a6f-596.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-688.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-781.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-804.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-850.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-914.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-958.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-983.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1015.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1059.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1102.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1145.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1190.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1323.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1336.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1361.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1381.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1389.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1404.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1405.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1406.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1407.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2376	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3472	2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
2376	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_eac653daf92e8735d7f056c7916df196_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3472

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 869KB
SHA256 3dd39676213d6f5a10ed8d12ed03e868ea45265a03425257f0852f6a36a19e41
MD5 eac653daf92e8735d7f056c7916df196
SHA1 8f235f5d9be7de71def3555eda40d05026cb2d47
SHA512 f834df4faebfb14542c7c3d621e51060403f56bc1550d3e4c836fe26115eff7cef666b972a392d4d7d5d29d341408300740f4a2fff7a87ca53192994c09bcb95
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7if:t/sCv7rTiw2RYwZCUsjKBif
TLSH
T10F15291766EC4895E467A13489B54606EB72F8551B30C3CF12B88B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 dba649f52d2f8564023c763c83a7ac5a300c09c6feb30608bee6f7b23caf4764
MD5 0cf5e6d868e14a97c8a54702687f7ce7
SHA1 9126f64e3cb7af3b6e26ae95083a0ac642bd0cdf
SHA512 07d7fb59203fb5c79181a959d03c5dbae97cff3ee9e92f9e8f80ec33048dc039d151517d8de2fcfc24cf7d2a6de9e5b306b2a20c994a4b1ee80f031f152050e0
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKBiv0Le5ji0hmxNrM:x7iw2APji0Aj
TLSH
T1DD653917B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 883KB
SHA256 c39ffaaf6abec0428b459a995c67662dcb2237c0014bd37af135437418d4b8c1
MD5 b7f1bd30eff56e223e64884698fd16e0
SHA1 6c40982886b4110540cc06bc3ebf2afff3c218e3
SHA512 f648a7194828881046d38cc1500436f8451d57b27153911aa5420202be6225fa27c46e9972e9b25b7f172befcde1c463c734e61623ce77dce32aabab27eef137
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7ixa:t/sCv7rTiw2RYwZCUsjKBixa
TLSH
T1C215291766EC4895E567A13489B54606EB72F8551B30C3CF12B88B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 916KB
SHA256 368c00697012aa6f3d5641bd6537edfbdf602ddf70416cf148532e8e587ff426
MD5 2f8da696af21fb4de6042743d011fd88
SHA1 d032aec4224f53e2055d51a3211dd126f12f73af
SHA512 5a2e100d6c5970a31de794c9a5bf840683ea353249c05b93343f12841c8a820749027911a7802fb1a7a74a9537face0774e189a778de18ad19f229924ab3559c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iSb:t/sCv7rTiw2RYwZCUsjKBiSb
TLSH
T1DB153A1767EC4895E467613489B54606EB76F8561B30C3CF12A88B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$
Size 892KB
SHA256 fea433e93b4b8de0e9ae2781241622921cb4dede2db29f1797e54ce4cf55a68d
MD5 cd261d76120a012452266f96547d4450
SHA1 e7074c293358b535cf71379e6e9a048bca09fa7e
SHA512 6b45286e1d7843e4c7759e3bc1f19b1c9cf00da0aeefb19e2cd7a7feaef461c44835f5e51c8445fbb97dc74c26aa6a216672f2cc2820a5283b5bf0cf7719fde4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7ii1:t/sCv7rTiw2RYwZCUsjKBii1
TLSH
T106152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 892KB
SHA256 78f9707d15cccab34366911d893384350cceb41efb48c65e9839ece53a6c5fef
MD5 5280217794089f37aa121d8a272299e5
SHA1 72a2ceafec4563d022a054b174562571f5763f19
SHA512 319c11a67fefb5229f073d82c7147a0b93494bf94ddb7836aa1e6d57b8e933717cf8409bd8b3eaabf35247368e6f3717c9f82b986b588848a3124c21d40c8210
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iI6:t/sCv7rTiw2RYwZCUsjKBiI6
TLSH
T1AC152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 892KB
SHA256 06fc78a39fca41c3a6ef2ddb90a2cd4e6c7c9387a89b17de273f086a3eaa6ada
MD5 1270769155e0f20787685fd07e19e8e2
SHA1 54969811a9b2d957a2f2e6f1319d94f9bdc25a30
SHA512 5a02db50474ae27e8b3ef96abf648d30b86d1c627b98846f3191872944c034196819b08881763294f6fccf2e4916f9c41c45edd4e0d8837430865d8dc826752f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iMN:t/sCv7rTiw2RYwZCUsjKBiMN
TLSH
T1C9152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 892KB
SHA256 dd89677d84814419d2eef190ef120a70ed55f95816260c9d383d0460e6f0674c
MD5 47f8ead5ec62b130610f76d4b1172da9
SHA1 80b78de8aa9d15225df2bc40dbce821b4ec2218a
SHA512 e923169b8b27120e51034d2ac58b0a776ccaecf1ea442f05f20ca40b2f9dc1e4191d40675eb96eb91f31cdf9546135cafa86f01a33989b79eb89df4edbdf513c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iCf:t/sCv7rTiw2RYwZCUsjKBiCf
TLSH
T1FC152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 892KB
SHA256 b3f2aa06125d0e67f6b253e07f3859a86edc4df2893cdfd8a289f58ee417f5da
MD5 8cedfc5c9896795a5582cab155b82437
SHA1 168fa1d44e12a6de01f12c817b34b43c18f67d60
SHA512 bb628cda4a2170d4d56d56974be362318f17535b1c1c9d40f3acafdeec0632a441b4aa735353af921343632b9e43109ea643ffc980c24741c068584e08816036
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7ico:t/sCv7rTiw2RYwZCUsjKBico
TLSH
T1E6152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 892KB
SHA256 1f701b1ec55ab86023b3c532847aa2d6d5b88af1ecd46d919a4950fcb58e3c08
MD5 c8132d19ab75e3d9689905d205f9abb9
SHA1 f3cb7da8c91282c628eea6eca1364ba367eb6430
SHA512 272b336a5ba1b60e80d5db558ced0e3df5b9554cf9d3a81fe6d8f848b2f2cecdaae9f20f88a4210d66f7b84677e5181df9965f0681012bc6da189ad114e9b8bb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7i8u:t/sCv7rTiw2RYwZCUsjKBi8u
TLSH
T19815291766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 892KB
SHA256 10973d35fa56597633c6964747c45198d5344096ef7504522bc9a587e2381d4c
MD5 cb7908a643376dc96d6183a59cbb418b
SHA1 24cce7ee45b2604d2f92ed8c12e752840a94ae51
SHA512 52ee8d97ebf4a19d8665ec5c059cc42e4adcc7599d8be23f91e94c5287927a7f00e7218c2d5b1b87161380c2810aee88ebf1f1d3ef8c6eef12678b92717a645d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iA9:t/sCv7rTiw2RYwZCUsjKBiA9
TLSH
T18D152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 892KB
SHA256 15025c4801c35a60c94e46781eddb96ff71c290b3fd249a19f8e750b69b3bdbb
MD5 48e407ece740e20f9e869a7e79db908c
SHA1 64e4f31d0bae20be948a20096df6349fc3524e0a
SHA512 9018c304d431baf95c92d8a40ad4f132350f813eb12d800d740bf8f68e5030ccc09a40ae01b545485680cea238188e023bbe6f7a85a33d1dfbdbf9c1684a8ecd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iIc:t/sCv7rTiw2RYwZCUsjKBiIc
TLSH
T13F152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 892KB
SHA256 b293091a34eab3b3dd83f96e8f6a0846ea7580de18c143ba16b1efbb2d0b5f60
MD5 c08fba9c04595bd160a0360c1a86153e
SHA1 014acbacac0341166db2e7a2482b09cc8a2bdf99
SHA512 ddbf71841dfad068c2d6acd751bd4278a60f4b222ca8a3ac795c7d5af4bba26abf4eb5f7d89fa4a10374da787a5834cdcabc4feb652b0ddbb808ed9728b16789
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7ihp:t/sCv7rTiw2RYwZCUsjKBihp
TLSH
T11B15291766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 892KB
SHA256 9b227718a7a839b29d825dc8c5f8a6394a8e4d1bd73122280a44b6f4a83542c7
MD5 981d667fbd3fd5f4bd25f217374711c1
SHA1 587026c42836de731e35134b1f4ebb6c67a461c3
SHA512 74a1cb3e174dcb3973eb8e1ae2028c48cb79bdd11ecdda0a73889cfa2cb41e2f29d71e23d8b6731574477b4047b95d261a55316986695ed2e8224d6652007529
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7i20a:t/sCv7rTiw2RYwZCUsjKBi2N
TLSH
T17615291766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 892KB
SHA256 b0d57ebcfa9f615cbac0e85149ca8f7e562517fecec1f375bfc03f7dbf9d0840
MD5 ebc8f4dab53151eb922a15ef29e7278a
SHA1 1f1dd4e23b7621afa5757ff49d8822e3d21fc156
SHA512 9d6fd011dc26099b714a8ad46cebb9751fdc526a398f4ad57146fd5f82acf1112420931c687024821eee4bbf559b3bd4a12bac1c94fb178351d4c70065df3fb5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7i6F:t/sCv7rTiw2RYwZCUsjKBi6F
TLSH
T19D152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 892KB
SHA256 8520f83aaadd61c51f80b89f3a668e89b9f826be55e0755bd67f1197949d3784
MD5 5e240cc34754e3fc0009bed359bada1f
SHA1 be8593100bd1c43da03385b37f33be1dc64a1ec7
SHA512 e372443f9616946190fa878b9ece65e669f20933bc89cff4b08904e3f0ddc33a73163b36d1d06dc7dcdf5609ea7fb6f90ede1c80679c0bb999ac745b48cb02f5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iPC:t/sCv7rTiw2RYwZCUsjKBiPC
TLSH
T1A515291766EC4895E467A13489B54606EB72F8561B31C3CF12B88B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 892KB
SHA256 3ad03c10be0cec7ef116b574c5480b1d44d7a714a623983355aae8c419903cfb
MD5 b642aa01e90ab8d90f32cb9a18398464
SHA1 6236c3b7bb49e398738ef00ba9d212b42a0e6cf1
SHA512 52baaf10672ac5bccf99c2db2577c5c54f5718ef0bbab8db7db6c0ac14095b156ebb566f69ffb2aa16532915fd0dc2b29858f9a40cb310d16002cb94b2ae4179
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iww:t/sCv7rTiw2RYwZCUsjKBiww
TLSH
T105152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 892KB
SHA256 64815f08843484dc4e0140b7591089f5b9093d0d3a46b2760c446a9956ef7ba3
MD5 434286a578f5e4e7d74dd746f6559397
SHA1 ab1056d9adc74f5b7c152376792f8a9474fc32b1
SHA512 d3373c8a5ad444a0d1d2611d14090dfe9265bbf75d43af4e25d26794e25dd45791c59664b7eae2b0c0a6c6f9587b98f7cda92caf0991b279fdf70b8a12c45820
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iPT:t/sCv7rTiw2RYwZCUsjKBiPT
TLSH
T1C0152A1766EC4895E467A13489B54606EB72F8561B31C3CF12B88B2D1F63BF07D38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 892KB
SHA256 35ea981e32f71dc03f64ea56f68520b63bd8878e9bcf604a283bc4c2b4d0eecd
MD5 913226092f9e98ef5af46f5a4994c324
SHA1 35830185b7e064cfaeec4eba38c07d53f33019e9
SHA512 b12a2d1fbbc2187b073290972868597055789a6a973400a6cb7913fa09c96ab2bcb47da1c9d2d70182c2ad9d144b29f39b082a4347ef7a4dcc59fa28bbb82f22
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iJu:t/sCv7rTiw2RYwZCUsjKBiJu
TLSH
T1BE152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 892KB
SHA256 2196cd451979752b6d36e0f2d8bda87fcda6cc588446bd36b74645cebec0ab5b
MD5 9650c00b76f90aa2c912de81290c05a1
SHA1 33da41aa05f8442e5a6a1815c2e82dc6e9ea00fb
SHA512 7fc4c27d6b7451a0baab614cece6118229da637f1c2f515dffc46bf9380e51b8c8dd19db464e7f9ee0e280b7506a1a4cbd0fb89ea9a190725266a450b512bb32
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iBb:t/sCv7rTiw2RYwZCUsjKBiBb
TLSH
T126152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 892KB
SHA256 35db27767b4978a3f5284d1e7bf31eed91754f34ffc87fb9902fd79ec7abaa6b
MD5 948df373a9cbbab27b8d268285f7e789
SHA1 de4fe848b7a90730cf9d26c63dbeb8b2225aa1a7
SHA512 2668bc8ed27d1bf97f6ef0b207cb293fc6f013062b0667fac19dc61550633a80af6271a942e27f5be50717678c8853f6669a7bc4eeb0445e4438f74c87974b0e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iJf:t/sCv7rTiw2RYwZCUsjKBiJf
TLSH
T1C415291766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 892KB
SHA256 c92040fd005cba6398ae66da6a217700002cce3bbb2421083f1b4745c02a38eb
MD5 b6a7eb634d9ff910d823b0ec38f5ce79
SHA1 1eea405e40d9ab03b5d41b49e90834b3e6bf8fa5
SHA512 f3e7197c0d5475282b48a6dc38eae48dc5ce8e67dccec84a5e802afdff9d4188ab75f72f8b67ec44bfc31c2994970f4cac116eb33491d1a31a7b33d8dadf78b0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iyK:t/sCv7rTiw2RYwZCUsjKBiyK
TLSH
T1D015291766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 892KB
SHA256 f753d66fb9c2aa205944c1258cf502808f032a7ab769e404de7517056bd7592a
MD5 eb8f1a0514f6a27faa2aed295a70fef6
SHA1 920a6187ddc6449c5d44f2e4ebd78c5ae03f04e1
SHA512 a6ecf90f5d8236e80289b748870c32c78d032e3c2c50c66284ac2af6184c1fbef8b990b1bb5fcdf623baaa1ec0770870af1eccaeee37c9d6d697763bcfcd3c2c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iXk:t/sCv7rTiw2RYwZCUsjKBiXk
TLSH
T10E152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 892KB
SHA256 3e24c18e2a55b7f757d76c9f24736f57db779769d249b0015d4937177ae381bc
MD5 20675f3d0b023ca20f3ca4d43b396c4a
SHA1 2cd95c27cff6c5e3e8288f99103024f7191cc755
SHA512 9e5748c621cae2207e04fa4eddb4eec5368261d20f4e19acbf28c6717cb9794534fae67d43cb711a36fd8857c758026e4c381c37fe4c59312294968cabb9cef5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7ig0:t/sCv7rTiw2RYwZCUsjKBig0
TLSH
T15A15291766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 892KB
SHA256 feefc288fb397872e857f1e4eae8745b18314cd96120f07a44c15ad8d3b73ff9
MD5 f511b923faa8f5b79a2f52e85d316a19
SHA1 8e73f957e460fee90198cbcef3a9b68c7bef64af
SHA512 4bacd46d38b424bdf43c8341591cfb9b5486fb946e1535d81c02fec8da32f76faf08a4aa6ac62d2224ba87d1459a9040c71de61d1128284d491a32ec46b9cecd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7i770:t/sCv7rTiw2RYwZCUsjKBi7g
TLSH
T1FC152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 892KB
SHA256 61fc6e0fc1ba3c1dff5d9d8821f690b667fd0856003ce01dbe487af5937d2559
MD5 b8a9cf926d0734b3ce2fca7c41b073dd
SHA1 bea6e03cb6c525bc9225ecc6c2c3ba0ac1f89cca
SHA512 b1fbac3e5fbafba34e859250dc54b1f7150a3faf6ac8cf39b7a8171f4791930ce0ea6e09b4f105a77e73354bb5f7a288d19d58bc3d27e9b83cea5a4ff00cf290
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7i2r:t/sCv7rTiw2RYwZCUsjKBi2r
TLSH
T17B152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 892KB
SHA256 9b41625e9c881b2cfcac150c48164969b3edd4b1beaf0549030922a90ff60608
MD5 ac83ef329b8f88f0579d98c3805b32d2
SHA1 a80cf92b76cd0059736a5f8a473114f2a7b64aed
SHA512 816aa03e009bace359df4f475cfb518bc926df214bbc7373d1428504bb3392ef01a71518c544da7ae6ff02dcbfca4fa58022aa5f503ca448170ca644f35cb6a1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7icn:t/sCv7rTiw2RYwZCUsjKBicn
TLSH
T13A152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 892KB
SHA256 a00a8afca48b6b3585a4afedee25ad7eef2e714512b16970f96c6b98ca7c0f39
MD5 5b8022e7bd67c171aeb93f4e359642e3
SHA1 141584e39a58b4b2e48062630590856f9bab3640
SHA512 6583b8766238ca8c622663ca61428bd5bbf6174a34e952090c72bf6ce3324058c1f2386f8653f6b714159e1d3fb41bbfd0adc0f1439ba2423e8b01d672b388d1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iax:t/sCv7rTiw2RYwZCUsjKBiax
TLSH
T1E0152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 892KB
SHA256 67537e627955d00e5d80ef4e259b9d9891192564a070010e8286be669b2537ab
MD5 e7ad51fc908c13eb31eacca6163d85b8
SHA1 a0255f6c87a5203dc69c7fc5c39bf0d77636cf86
SHA512 3a3ed632ec422083a3c09a3712564385296f0242b85d04249a901f8323a9e0e5f9c30243a02fa3a3da95027ad9c819ee2d49f7234c569fbfda64425e4c6a3b22
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7icA:t/sCv7rTiw2RYwZCUsjKBicA
TLSH
T149152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 892KB
SHA256 4cd88aa458658edaa4be761e6f8e2dd5797dd702f6978a39f402a136df1e57a7
MD5 c22644d0f34a7eb37e85d7db9c2074ff
SHA1 429d897d5141b0cd573f29601ca0bf85a7415d3a
SHA512 80098f4ffc91cfac82277bbed5099c64d9413ad27d2df3b82cafc5dc211a1c110274cf7828f717fbbd569479315e03a1deb26abb2fbe89339ee6cf9e57a8face
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iF9Q:t/sCv7rTiw2RYwZCUsjKBiF9Q
TLSH
T146152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 892KB
SHA256 594ffeeb37c292b91d44a494cf149eb10b5287f2397d05e4ed68f1749c022a7f
MD5 58b61a255366f3e21b07fffff1467e8e
SHA1 e723e606bb3c768e386947ac809e936a61f91e7c
SHA512 9783de874e2aa8dd3905f423208554bd1926c9892d7951a44e3c5c62c7d35f7d911af5802bbb6170a5fe1fc0f5158e4f5f77daefa4174f8a7c3551476d992e27
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iw4:t/sCv7rTiw2RYwZCUsjKBiw4
TLSH
T16C15291766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 892KB
SHA256 a1626dff2c5f57ec8a223d816b1e2fa9bcfba6b764af7a3a066a064fcc9de400
MD5 555faa6514180c7f17195561e0e19753
SHA1 95b6e6ea56754dec5234c0fce4f769713d49ad48
SHA512 afc02378bd0a2de9bd211243c95b0e540e14cf8d9b6730ae6d9177058fdbccf94575b40ae9a3a511fb40af46bfbffd50e82d9153bb7e696cf96218ef6223c59a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7izu:t/sCv7rTiw2RYwZCUsjKBizu
TLSH
T11C152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 892KB
SHA256 8da7ccb1538f454a17338a32330ec7a92403ad423d63cba40811af38b34a1454
MD5 b04d6a44d5003365d9188067c75509fb
SHA1 df378271035ea8b6e45006a334522e7d784d4194
SHA512 2ab3ffa9d870d727637a97b0dff6204dd3647c2e164df6c81da226006f6a7f05dd1c9823901ef366aea4cf7f3f1a205497bc48d1972631ea289ba0e76efc0eba
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iuj:t/sCv7rTiw2RYwZCUsjKBiuj
TLSH
T13A152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 892KB
SHA256 d24a86db168b499de17b18926ac1ccf9a6f3cccdd5428bac17cd3929dcc9141d
MD5 8df53fd97fa5646ae5a2eacac9aef667
SHA1 8434036231d59dac91a0c054d235eb8b7f80afb7
SHA512 16cb8e57c2530d41d33d11eefbd04861c485daf6a623649fde9a1796d6ddba7a05f3629d594d29c9a3183fb1bdde8b753600ac9a4be6bcf51ea28b4d4ee54c80
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7ibg:t/sCv7rTiw2RYwZCUsjKBibg
TLSH
T184152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 892KB
SHA256 080c1360497357cb0a49436870cb7dedf179a2f49cfaa3eda308067f2ef3784d
MD5 8d9927ee59f56f47d3dcb045f42ae8f5
SHA1 8bb370ac19e5b1312b37b2b2ce272cebc3805f08
SHA512 4770cce87e21deae8fe8b7f7d7e3bb5b468b91cff298605d213f27cd1bc949b63613b8a433c82b33ffe0fb6e9bde5722a7556361c0b96aab6193b77433dc247e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iGI:t/sCv7rTiw2RYwZCUsjKBiGI
TLSH
T1A3152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 892KB
SHA256 f1eb974e42490a9961c8a3a296ee5d23497ab04ace357e4f1ae0b857f422fc3b
MD5 f709cddbd9ee7fabe39d476b8df808cc
SHA1 64f519ad3e1902c0913925f03125fcf47b35da67
SHA512 d2236237401ea95e02ee12244f2ff054dcb62f19406f7bca0918e1c2da3b9806cc69f6efff83d5cfb7d2191c96a4076da45f52bc7c0f96d59d0cfc82dbf4cbdc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7i0o:t/sCv7rTiw2RYwZCUsjKBi0o
TLSH
T169152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 892KB
SHA256 4ba1890de78b8963a42689f24ad8e2bc3bdb4c82c976ad610d6ac27226118f0d
MD5 7fbb37338b1c439016ac7a2ce2f4aeeb
SHA1 1217ac057b5f1adac84648bc3974828e0eb1327c
SHA512 3feccfe5e6fe2918547191d46562aa94b3d8b07e71dbb08a2ea4e92af9c93fab9508fe0af89d89a211dee40899c7cfc3334d66b617c22357ee160839e464696c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iX+:t/sCv7rTiw2RYwZCUsjKBiX+
TLSH
T146152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 892KB
SHA256 c7349294208e5acdccc5afb91bb72af9926e413498e8a013ec585ac3159dd079
MD5 53009ba760f3f77cec7b0f72e961d9ad
SHA1 2c82e6d1d6b05fe3fc4b540f33cfc2542339186e
SHA512 faba87cd6a4964ffc2755c3d72fbd35766371073530dbe94ff8acc545a846a2395d1d7a18b4657dc0e7b47e24c65c0b38801b147597765e9589ad005ba911652
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7itQ:t/sCv7rTiw2RYwZCUsjKBitQ
TLSH
T111152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 892KB
SHA256 57cd2ac0ea40ca2a3d18df95aa23b2130c3f1a0daead6617ab68405b4269c435
MD5 2ae6b753bbbc4a21bed407fbae7f4150
SHA1 6cdf5ec3793e2062f85ed8fcd5b479db7d1a343f
SHA512 27fcd125d66ecde48f87c536d548c970eb3e1459f0f8ed5271057e2ee3a0588a726c406c0cdc517ee413f9cbe52fa00aded0ce9957778c014965fef9401e4331
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iiX:t/sCv7rTiw2RYwZCUsjKBiiX
TLSH
T104152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 892KB
SHA256 5490ad060417a0b426affd04c821ea41a28463284a3b596a71b65613e43f51e9
MD5 578d377b7be6df7c70cf064868090287
SHA1 31d7c9fce8517f64662b92b990d13ef9822622ba
SHA512 442582e74b6f22dcde1391346b59a914e266553be9bcfcc2128a286e6b36c5d5e91bddc0bda3b63499ebe5040fe7b0bc487ab3848c319284d496e39c4d5c526a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iEL:t/sCv7rTiw2RYwZCUsjKBiEL
TLSH
T122152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 892KB
SHA256 20103b42018915cc009ad15fe24fb87b6e1224188f47908015587c5e7fa24915
MD5 8e49046a768ba853f9850265407fcf94
SHA1 80b68350d40ea61540e6754c0ceed5030b1e4658
SHA512 2dd5cce2d53f29128aa8a4fa8591480d25e4d14bb775781a832009c03c6a4ef0c330f799172fa0a68023a989d9a2c2a6ab9220e913d23c1ca2b2262dc5e696f8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7igFC:t/sCv7rTiw2RYwZCUsjKBigM
TLSH
T17E152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 892KB
SHA256 db3e43354c919d5153dd1ae67cbe9224a257d2626e25ed9739d7b25aff89174f
MD5 eb8df5f0bd4ecd24d407e780b909a425
SHA1 22d027fab6290fb2b96aad135408315624f8c837
SHA512 11c02378cc402662e9a9ba608ed480134626dc1a6c3016526e057007e1d2d77822fb01189a70ad46c0dd47c6ac09c0c98ae625c364520e69d642d4cd6912c6a7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKF7iBh:t/sCv7rTiw2RYwZCUsjKBiBh
TLSH
T11C152A1766EC4895E467A13489B54606EB72F8561B30C3CF12B88B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2376-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3472-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3472-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads