58fd60fac1cc18725b3855772e8054878cac44cd9aee8d6e34c7d5162da7684f

Analysis

max time kernel
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 904KB
Sample260809-tk2xtshp7s
SHA256 58fd60fac1cc18725b3855772e8054878cac44cd9aee8d6e34c7d5162da7684f
MD5 b6b75341d39f0c64fb3b199051fe365f
SHA1 3dc09a5fbf909fc7699d9f48d9505965d49970f6
SHA512 554eb6d9fe472bdf1408812bdf3443a05f68975d371f96cc5383420d7847b0bd82c98aa9d1f6da2eea31ad94d3936fd583216a88691e18b22b75399034507af7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG9:A3k03kHRJi56r3
TLSH
T12F155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1084-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c535-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1084-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4872-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a65-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb5d-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019851-421.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-525.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-845.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1294.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1357.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c535-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30f-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a65-226.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb5d-264.dat	aspack_v212_v242
behavioral2/files/0x0004000000019851-421.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-494.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-525.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-604.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-629.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-845.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-909.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-978.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1010.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1054.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1097.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1294.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1357.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4872	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1084	2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
4872	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b6b75341d39f0c64fb3b199051fe365f_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1084

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 904KB
SHA256 58fd60fac1cc18725b3855772e8054878cac44cd9aee8d6e34c7d5162da7684f
MD5 b6b75341d39f0c64fb3b199051fe365f
SHA1 3dc09a5fbf909fc7699d9f48d9505965d49970f6
SHA512 554eb6d9fe472bdf1408812bdf3443a05f68975d371f96cc5383420d7847b0bd82c98aa9d1f6da2eea31ad94d3936fd583216a88691e18b22b75399034507af7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG9:A3k03kHRJi56r3
TLSH
T12F155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 6d83217722473873d22ebb5bd9534e68204a2f3fe3f8210807428e4da4b11058
MD5 91e19c7aa2faa17decbea300741f076f
SHA1 c465c8818da9328d9f80655baa7bfa5c896cc8bd
SHA512 33d8870a5cdbf5de5fe357c9da8adbfc1d296a1c75583a9160be636f340cb50d08e1adf6f1263ada87b40d5a0db31839e327bfabd31a747445ddd7f1a3650473
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGJ0Le5ji0hmxNrM:A3k03kHRJi56rzPji0Aj
TLSH
T16F655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 919KB
SHA256 f21f0ec78c635afe97fba50f723c56b0cc0d54d4a16df3a53e4603ae31da405d
MD5 e071dd31f41ffa3ebb39268835f877a7
SHA1 573216841e19816949983534af2848fb709010b9
SHA512 3fb3724bd6dc55b7b97b690979e855027a851d960ccab9a849f426d8a262a7bc2ae40a6d28da4915cc1f8a535a6b707908c4c7fa945fc099d6f21d75dfb50e46
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGba:A3k03kHRJi56r
TLSH
T155155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 952KB
SHA256 abd36350dafb6a68cc6f07f3a90670d8f906c47373756c838facd7c798afcffe
MD5 2de54dfb905272c558ffa7b580e4f6b7
SHA1 8b11a1a9b0bfe3083085c6d9276f07f1ab35ba52
SHA512 054ca2de87b07ff98aa82e1946a45415530ff450cc1faed22376b7f4d6e3ac1ebbd041eaecdee69d177de02f853fda858aafcaa6747e3c30ba0fceec8db9fced
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG4b:A3k03kHRJi56r2b
TLSH
T161255A03A6880FA8D11FC1789A968622E7777C521F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 928KB
SHA256 8d3b389218a494233461be710db2aa64b84548a47bb9ca9247b65349a494e84c
MD5 72fc2fd8c3727aa6007a545608f84526
SHA1 98aac4a18e46d507ab9f73a2d1fff2c9f39673ab
SHA512 eb70c96eebc2735aa41b4ec3766eef58b196ba063c365abc9cf56de2e63e450687b94e398c815bd2d6ddc8d565e618cbf1093b555f61cab83e2ed93daf19afc0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG66:A3k03kHRJi56rb
TLSH
T13B155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 928KB
SHA256 7489b1832e6d27dc8a2c6867d294894cd4e253edf50feb7ce242d8d0ac5a8321
MD5 272f59ebd87072015f16776ede739564
SHA1 d41a28543e5c3ab8b029cdc92d0206617a38e9fa
SHA512 d8f3cb9ff849a9fa789641eec248544b45d5ce20c1c2c37d228f7f90b81e7eea0aa54d7635bbb1f19906c6a4c478c9833fc8808a9a96bc9ba6edc7f6e8903da9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGyN:A3k03kHRJi56rG
TLSH
T17E155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 928KB
SHA256 8c0fe7af497129357ca3a6e0b8220658aca32cf955999165e3fb4687f363c687
MD5 69709439ae1551e405d7251ca9f4f71d
SHA1 0df72f285f6238e8e69b927e4f647106a6a6f334
SHA512 3f901615b3a2621dac85737da03811bd7534902415df9cb962a6959d94ed216b2b155dca793d912077686e2c3eeb0847f20411cd9eaa8cefcbf392a2de9ac374
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGof:A3k03kHRJi56r6
TLSH
T164155907A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 928KB
SHA256 3e3e25852ead5f6512836caa70030c346a68dd1e16a5405088c3139c1a247166
MD5 94806802ab701513fa1eebc76d1b4a64
SHA1 56011ba61cd4d92ec905f470283ffd7a3c83abc8
SHA512 0348f4baa13527aa9db6e417048472bccd6211680c7a79bdd376212b7a797e0df16f76c884e0514399c1499b6529cedf063c837facc84e104a6f73544c27ca4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGCo:A3k03kHRJi56rD
TLSH
T195155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 928KB
SHA256 066135ad63ebcc7e9033ffb1fee073205c70720f3fbbc347404c9c3365bd97e2
MD5 21e221d9832dd96285246dc33eb45a77
SHA1 1e94635ed9cfa63aa7916dbdf692782b3d02a574
SHA512 14fcb4ddc27fd577d8905f30e790d33554dc757807bd09093d9dca9c41dc05b7c1e095ff6b4a9fab557b2986d88c99fc5ea31dfa51f549615a5d155f8deaf774
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG2u:A3k03kHRJi56rV
TLSH
T156155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 928KB
SHA256 03bf590358210f4be5e1e97320af4367c0a192eed51a54fad7a20c929b4c917b
MD5 21dc4243c598d6f4c0f47c7bfc811aad
SHA1 501f4768aa8e21aea44b2d9092baff26c4583f91
SHA512 0e2b7e506e4bbfae14fd76461b3846d6067cf77e44cd80508c25174b7656921222f11976224b07748442c6a87a37f197ecef3b1be3fbe12ca9afe86ab6dfdc17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGq9:A3k03kHRJi56rg
TLSH
T183155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 928KB
SHA256 76da5fbf4189136c211a889b36159165823adc7f6e060f4b4cd07f098d5bdb37
MD5 66481b9e25d8587ad962c2d42b2894a0
SHA1 84f10d95adab50f8df5d24dd29ed94d5c2cc412f
SHA512 6029ec9de31efebe80b9d743815dfce68428a9b3b3500bd9825a84b8921a09b5ef7e7bb1af9b8dc82877df11a141c59bf5c9884aa46cc16e2939459a76bab722
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGqc:A3k03kHRJi56rR
TLSH
T11C155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 928KB
SHA256 11cc44e80702a0dc0d4de16d4bf24c9f20bd0247ace70b1e6593609d3504f040
MD5 37017b9e04d31c1a8b76138b7720a7d3
SHA1 9630626dad14e65c1ba0a0fe85bd9eeff0671d55
SHA512 2715c2193584c9e5a64d68371d75d9abbc7f319eb80f093156622966abfb6b6529c289d9557a7039de961db24aa9d8b5dc0f438329e6a7d2650edb60cb2078ba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGjp:A3k03kHRJi56rv
TLSH
T1F1155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 928KB
SHA256 3a4e51a60ecd29934e0dfcdbaca1eb25fcbd17a5ca997d37577c2fbb33e0bd18
MD5 0b30edc703231a54113585cc9ef52a9d
SHA1 0792f693f156b031cd3e6a70b5267152489a4668
SHA512 87dccb163a85e7c7577c65a551cbe8a4387f70ccb8e2fca09a147853564c8e7d118cea80f06014c74c031d9c43d97a68d75b1f8cdde798b7e1869857bb32396c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGEN:A3k03kHRJi56rk
TLSH
T15B155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 928KB
SHA256 48a12530d6c86489bbaa7ac669662dba6f9aa764b98e2729d25cd2820b05540e
MD5 e54d3aeb6f0f8ae807dd10990f4e5aad
SHA1 0266d200abd99cddbf04fbf9f0f6fb9e099f3d24
SHA512 51bb52a8418a500408442b0338d6ae4bc746f6ab56a51fce3185dd20432a8955f03232bf249eff5f73ff9ab01ea910e0731c884ad8d35b2eb79fe8b12ae8e3ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGsF:A3k03kHRJi56rS
TLSH
T1A9155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 928KB
SHA256 c045d74d750d407fccf36c2b06546e1f0ed2af09bb979a4560c8dfc3fcc8b5eb
MD5 ca35241626d559baa8ed1c52266b6ab7
SHA1 c563ce2e235b12d76ac1be8fa5dc0f5694633bfc
SHA512 997681a7e4d15a4f258ea11569515f530cbaf4a03bf10f5769383c971c9492c35f41a8d1fac9970d96a8e17208d309734a93a5808a7f4b38385c2827db15c42d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGZC:A3k03kHRJi56rm
TLSH
T17C155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 928KB
SHA256 6e023445471b6354adbefa43db531f2b62a6c8b62df58c1244fcceffcb234127
MD5 c2a4556c441fa7d51015e56900bb172e
SHA1 1e767b69126f75ac699e642ba714e057ededb9c3
SHA512 e7752a98e6f1f3cb24e5ae1a024adb5e11afea0d659f5a4f664a9ab542dd10a2cb4be588efda057a4e401432ee980977d6e6392953b766525c04300484129bc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGaw:A3k03kHRJi56rT
TLSH
T176155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 928KB
SHA256 8d91ccd4244749e01ab0ef0694ebe49b853c66c421cb4e4cc11fa65f90d3eea5
MD5 20f79d46d605ae2781f8653f83e422f3
SHA1 f92d65f030b1254164d1e44850b96b3f761f0dbb
SHA512 4f42400ceec704600a5b11a850c663053c2216f42184dfec614aa7b284b68f92ef46b8d06965640c5d1b15a1a2cdd91b92d5c312ab6a90a878194d527fb387b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGhT:A3k03kHRJi56rf
TLSH
T1C1155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 928KB
SHA256 974913df1a762dca8e0f429c21ec6960e1c93d874b9e81b1e571a5aececbbe9d
MD5 1b99426b3aa16bd5d714169fb245711c
SHA1 7619b6d962c18ae0f6f43efed3aee1054946fb99
SHA512 526105349cc4d3d9c63c83f8a5e3b994d158a632753b6f6b15f10e26f6348cf4156fe5f568c36754d7931beee99f4fd0f78fd61a38dec1a241205dd0b5365d45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGPu:A3k03kHRJi56rw
TLSH
T108155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 928KB
SHA256 f50d89912dc24813c6851341dda5d1a938a5d948b4f0f775fcb5c18f1fcf0898
MD5 eeca3f19eb93483feb98b76c3c6efff3
SHA1 7279a7bc5fd7ba69160ef36bc7f3a4d84089e34c
SHA512 87fcdaef9516b5c2b1865eb38752fad52ab7f8c508b596f8508981deb552bc2cb7925f8115093e20df50a50d61b47362eb39ecef7b40644ceed3656e2e195cc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGzb:A3k03kHRJi56rp
TLSH
T1B5155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 928KB
SHA256 e0f970926781e1fb6e8bf49b9b8018fda65ed0df786ff00e4a9e3ce34dea9081
MD5 5d5aef4bbd5d448fdc807fa38edcbada
SHA1 31143d85fa7077561a047b770d9852f68c4d347e
SHA512 9951ba7a4ea6f04ca31d073315e533f5744023cc2b2f8ff97b9d1df00c9d8eb96cb507ab095054888ebdb5aac08e519e59b4540227940493d83f5bd3fb2c3d12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGHf:A3k03kHRJi56r5
TLSH
T15C155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 928KB
SHA256 0ee60c036d9ee47e8e10335a4ef04cdef111e735d2149cf09ef1ab098ab364cd
MD5 929c7a1c04fb95da0c08f710647f6129
SHA1 76b11ed3c9be21b64fa840f3b0ab2c7655263f69
SHA512 9ba0c2705a0f26a01ff5a361685e15c36f84e53e39e3050d6dd67b0affac4ad1d2dad9bc611655310a49b5ac9d8008b8875b4ce230d60954bc0085e9f2b4054d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGwK:A3k03kHRJi56rR
TLSH
T1B5155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 928KB
SHA256 a547aeabbaa874b34bd4571fcea6aea482e76958a31f9559f41b26940b9aa9ec
MD5 34b64e361f0e77c03b97fe0b2f2c5762
SHA1 4c5af38b5f6b0afa4886790e57941cfc60c83246
SHA512 debefec53bd5263518ab1ef0af33de2221203dd9318cd81279250f7f6ab0874367de36dced407112b890700ab8be4cc72013060f7a2914c94d1590054a6b6c50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGtk:A3k03kHRJi56r4
TLSH
T14F155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 928KB
SHA256 4783f602f83c0cc8db887445db69202aacc12fb93d03546c8687213e4fd9899e
MD5 4ee7e86eec6049c2b0c890ab7a11752d
SHA1 852e374366e7a0eb56018979ab3076269313b6c4
SHA512 fd0f93106faa125bbf27d913d9e5767332e87903a3f8d4b281eeb4702f4ead7e6f8e108ee36c4cf7e65dec64b429ec98db6a4ea50cd2d2f797234cfbf022f023
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGy0:A3k03kHRJi56rx
TLSH
T10E155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 928KB
SHA256 f84810cf97495ac002cac52d29b3f3b641d43a4e9a4155a244d0e2f0d115ba08
MD5 eaeee20712edc93ecc4845a69030e8af
SHA1 f4ff9d9e539063dfc4f0a9a512fa8cd64ad39770
SHA512 48e8c3a17ca24d3e22c67a4a2b8dde89346c955e2e8a05eeb491d72ab51c6a99cf3562a00b586f604694a96ffca5577eceb1f03594054d6383f578978200586d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGBg:A3k03kHRJi56rQ
TLSH
T153155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 928KB
SHA256 e05fce934f1bc87461bb3e5771c8406ab013456fc4110a0baa422094474c8bad
MD5 6b658ef145a34d3e4e1c344ef6fa61bd
SHA1 d1c0efcb347a7e97af7f07734bb93c5d8c67240e
SHA512 abbeb33e2cc4ed6f40322b0e6b8534dce973b952796a856f8eb4647253da287f1ee9221147cbdaad3708703725563276a3b6b0e92c20b95f9398152c1eafa6af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGor:A3k03kHRJi56ra
TLSH
T16D155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 928KB
SHA256 91b6bd44cf46c1f5325499e8bec2a183175f09732b4eeeba3595bc66be0f9131
MD5 061046df50dac2485666873445cce143
SHA1 5df0d4d4a33c8ef67bf265cf7f0427b7efef9006
SHA512 460955e063d0ac8111cbb61c1b15507f481ae5ace647520b33be223bdcdc0b3a76cd4d6903f5a60b907a3954223078dceee59e7b5cb1a180e8012f209c104e2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGGn:A3k03kHRJi56r8
TLSH
T166155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 928KB
SHA256 215d8c0fd650c5a5bde32d431cdc67a49cb3e11ed96835528a14a203f8fff9ce
MD5 53b20a5902727d836b6782b9a64184f9
SHA1 e109ce11e1cc185098ea664a28603f4846c876b0
SHA512 dc95a3c4f0e7f9d13f0240200fdd584c08f61f196b0f635c9fea6d8f4d34144a7edba309c9e9dc550510abfa3b4113a2730dc4d2600e596e874820d2ffa7a858
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGMx:A3k03kHRJi56rq
TLSH
T15D155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 928KB
SHA256 d6ff5e639afe60cfe73ee9b11190ec25bd0dc9f4b0c3e8fe8e1f3773fe96d8d1
MD5 af0e338627d1a99eaa8446a7ded1c191
SHA1 6970fb3236051b34a034a7ac9786c39606f9651f
SHA512 8885962a641db63d91712bbdc58f49f21fe44e602bb0dbdb68fdcf41868015f9120884a76614f9c369f67fa398074a9055eebad3fe766af8bc0bf34eab69b87d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGGA:A3k03kHRJi56rp
TLSH
T1BD155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 928KB
SHA256 b9718ac7fdcc12ddcd1fd9758e0fa64c9cd0f23d211b96e08d9f78c67d1df105
MD5 44f160a81c7b894085c215355174d712
SHA1 8ad42e5bf9a3395244371a75073b6a32816deb6b
SHA512 03d9d21e6e24480f469e32e75440b9b676eed433e2e02427efada26f7baceef08402313fbbf2f9cf41461fb7927c382043ba69d984ea683a0245676382a65a7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGf9Q:A3k03kHRJi56rw
TLSH
T159155A07A6890FA8D11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 928KB
SHA256 b5e065f6f51d3d2f9db5f3442197ff88815b068e1c5c767efb6722488fc0c28d
MD5 9ed1969dbef6f7325271525e7cd07918
SHA1 9a40924d9f24981a6e462963f5e9c57c3c69a3f2
SHA512 fa565f50479be0d581ab18469d74390a37feffccb204ed83764660cf720ed3872509979d730358aa1cf94d48ce5c00226e46d2838b0b8cdd3127f3ae661e8c71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGW4:A3k03kHRJi56rr
TLSH
T191155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 928KB
SHA256 dfa3ee1062af1f969583af20bc35ccad19ec32ea9764d942b265514ae72d90ec
MD5 fa22efa384dcf6185ea51d7bd26802af
SHA1 d56661180651159ea480603e17512ce0243a888f
SHA512 d897beb21cee1dbb9120bf974bc31c3c2559c04a27de765f267ec870b3e71e48dfca0b3a6f54870d04390a2240afc77c80c8609aebfcc9b1d825b94354473691
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGFu:A3k03kHRJi56re
TLSH
T1A7155A07A6890FA8D11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 928KB
SHA256 bc2a8355f9f7ca5cc7120892fbea9faa1526606446b03be85cfa9e7352b2d330
MD5 27e971c3515217cd619cc3ea59975a35
SHA1 b3b863daf50e3f6ff1dc304b2062d42f1365076e
SHA512 d36ceaec74d8af629e73a5a7b4d474abef5e12d22126be97cdd4bc80b2fcf32d5fe74516ca1623e801f763b68b643457cfe9cb1bfa477ff1a315ecd3daed4d4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGYj:A3k03kHRJi56rQ
TLSH
T1DB155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 928KB
SHA256 2fc8bf2c917d816d0ea9e74a7e38045efc68ee70495c3ca83c3c95fbd6ba172e
MD5 30dc78e1b255318d096ecb4f18f61abb
SHA1 e347c437ad5407a1c217cb9f601aca946a5d3b02
SHA512 af8b4440cf0ef4399e7708baa7764ea19ee992ca17ca6262ebcfa83f19818ef409a404b30f95308eaefc8c13f91d6234f037141812cc1ad7f399af1281b066e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGpg:A3k03kHRJi56ro
TLSH
T160155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 928KB
SHA256 1c92c6ed81f77e08d15d6860129ec8faf929c3ed7530f9701ce7ba6f6563e28f
MD5 bb0b462da5d44f81a51147b3361ef6c9
SHA1 89e8608c9a4a240f84e83719a1bb3fa2f81c4ea2
SHA512 c70dd469632ba7c3211b1a222484311d15d100f464121a578b3f759d5ea19bcaf471047d5998af894c58205cc0052e51fc0dc35d9158b7d0c86bcd142802256b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGwI:A3k03kHRJi56rZ
TLSH
T1EC155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 928KB
SHA256 d79ae19981a748f17232fdf79e754c61f66b9fec8689a278dd80f8185a31126d
MD5 be45081e71a1d99fd66b13504dccc320
SHA1 5b2c5df1f4d1d3f7ca9d99e0bc599afd6307cca9
SHA512 0be6a9170efebf11cb1058d8c5579211caf1842b35af520b3c3bd6a205885bd329a79366bedc2687e0aa77f0e2fa21d348a7134847e13432b991bfd265ff041d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGyo:A3k03kHRJi56rH
TLSH
T131155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 928KB
SHA256 b81c07b854f75df7eddc6cb4ff916241eaa079c6b92c95119e8263c5f5388619
MD5 e74a33ee2046a3cdaa9905e55443b24d
SHA1 bdc2202eb1ce888ee6381e66fceca076b9c6f9e5
SHA512 7cc4e2f0a9b71709ebb9a4552958f20b048b0ae9fc8cfab0897487d92788ba2f278e1cfaa95ac1d019a2a09b49c469661e80d26ae654b755d596bba85a458b81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGp+:A3k03kHRJi56ry
TLSH
T167155917A6890FA8D11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 928KB
SHA256 3ffc8b7295c3b59590536e777e7d6c375d49d8141b48abf07185368da55804d7
MD5 c7ca18d3c6ff5088abc0a404614145b5
SHA1 eb7c89b4d0ed76fad1529bae680f0ed9bff45849
SHA512 ebdd5f94ec157fe49506bb2e32ee82558cfc8e1329f6908aecd7787f09d72df63c8c3ad0b1686f6e3b1039db05804505142dbe02f41519000777b3c26fe04b33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGXQ:A3k03kHRJi56rm
TLSH
T1D7155A07A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 928KB
SHA256 3c6976e2eb811449156c9220559416fbbff6c9c9cca0314b4952e60798f5e2fc
MD5 80f6bd83b4e8cbe467182d5c66f1711d
SHA1 bfa902e7a83f7d80083463803e6807069a9cd5c1
SHA512 20b286148c16eb3c8020f322bb30326d230924fe4e54598fb504c1d343fa0de6c10d47ca6cf465b70f74da48ec15855967d3e5be681db93ede0543bf2ef2a939
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGsX:A3k03kHRJi56rG
TLSH
T102155A07A6890FA8D11FC1788A968662E7777C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 928KB
SHA256 357ff1a7786603ff1c58056216f031db499b2bba354ffc591d0c3139233763e4
MD5 6f2dc6d5baed54c8e9455550a5092374
SHA1 c3711dd049f1f5d4cc30742097d9a638a7c183c5
SHA512 3a091ce08c86350b5dfbff24d8d066cb7e20f57f321d5c0121273d758e28ed49f02632d5e9f490d74f22e29b7d9b7fe4a113699408cdb3ee5b348f9a4452ceb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGKL:A3k03kHRJi56rI
TLSH
T138155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 928KB
SHA256 daab029b260a61dae2e23a2deadbb560de6b395d462226fe5addaea3321939f3
MD5 81a6c92f2f2efd390b98328ffb9b315f
SHA1 55d5e64c1c4515a2ba1073a7a5e626edd5961441
SHA512 15091a39aa649a9c64bcfc2929e3a9b964258cb91cdf3b116c14aeaf3f2f095be2cd122899f231c78a316ddc1ce2cf64912dea1fe97710281f1d7d5847fb50b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EGuM:A3k03kHRJi56rJ
TLSH
T155155907A6890FA8D11FC1788A968662E7737C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 928KB
SHA256 546c791db4edbfaa2c6c910f208006f888ac73a5286832bc7fb7477d46197b6c
MD5 f1fefdb18a288a2f7943c19718667a8e
SHA1 fdbbab2b8cc1925b8c9af038991f7375986352e9
SHA512 52c3db489d55fdcb688452706bf68f9b63c16ca3fbabe0fa09cd947c7f55ae31eacbfe9fb4fc6610883ce98d969175f165f543aaa9b0a6ce31620b6c6e3b847b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EG3h:A3k03kHRJi56r7
TLSH
T1D9155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1084-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4872-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads