84ba973ccee653a33d0f1f5b714e2115ac8b887fb8d2f299815d1fd8b338a0bc

Analysis

max time kernel
105s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 904KB
Sample260809-tvtzza1gpd
SHA256 84ba973ccee653a33d0f1f5b714e2115ac8b887fb8d2f299815d1fd8b338a0bc
MD5 8f0280f1d7fec7853fe07f5e69e24a24
SHA1 badf5b229181e033b4808799bf29441eeeb0dcc3
SHA512 83ace675524347106879c4ff27ae2b4f6c3a9556b0bf4fa0d74e7a83ad84b0c77d5d44e0f17d083076942190a04638f4383cc4202c2da4c4864164577ea774e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/p:A3k03kHRJi56rU
TLSH
T189155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4900-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c561-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4900-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/464-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-553.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1125.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c561-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-225.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-262.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-443.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-492.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-553.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-609.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-641.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-726.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-745.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-794.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-843.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-868.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-887.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-894.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-907.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-933.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-953.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1002.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1045.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1076.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1125.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1150.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1175.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1220.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
464	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4900	2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
464	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8f0280f1d7fec7853fe07f5e69e24a24_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4900

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 904KB
SHA256 84ba973ccee653a33d0f1f5b714e2115ac8b887fb8d2f299815d1fd8b338a0bc
MD5 8f0280f1d7fec7853fe07f5e69e24a24
SHA1 badf5b229181e033b4808799bf29441eeeb0dcc3
SHA512 83ace675524347106879c4ff27ae2b4f6c3a9556b0bf4fa0d74e7a83ad84b0c77d5d44e0f17d083076942190a04638f4383cc4202c2da4c4864164577ea774e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/p:A3k03kHRJi56rU
TLSH
T189155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5429028eb87d7f74ba905af4cfce2417d50bd992d409ef3f3fc2a7ff32e1dc00
MD5 48827d8a3d1afdb8a23ca7ea11f733cb
SHA1 83a910ad936ff742e835a6ad0f1ca012dd59a723
SHA512 331d41f22c00e3abe204fd15025a0cd336f6b55042ccdc5a4779ff7f4913812b462dba2575d716dbeb4cd9452a81e1a7baf1aeb867ff7f074928b14899619c72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/V0Le5ji0hmxNrM:A3k03kHRJi56rMPji0Aj
TLSH
T1D9655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 919KB
SHA256 362433c75390407511e6a678b37e60f6ad526609521057dfdd1b2cb79d76a512
MD5 78e08d3d4d7bbe19eec7a72225ba61f5
SHA1 4316a31ec9822cd46b51de59cfb7a34c26e65adb
SHA512 22f3ab221017912fdb21098eb95b67b7e3433b365e1e01bf060544dc340ecefa572c5e9310de7996ab36d49e66dba7c16415880334cf6f6329ed09ff4fe93828
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/3a:A3k03kHRJi56r
TLSH
T14F155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 952KB
SHA256 4e69228982a172a00dcfd90f2d9260905b42cdcb61a3b126a4c5a66ea6c63dc3
MD5 a4c28d8848a9e93314f1f40912012c12
SHA1 c6bc68dce2d823b04ca2a312f822efe0ecf83829
SHA512 a081823b3ebebcbed2ac5983ce15c0ccf8e224927585a0bd5e48abcccf7771c585be5529198208a3821b86c1a2351614864588d3bd168c31602b65fc79d7df97
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0b:A3k03kHRJi56rVb
TLSH
T135255A03A6880FA8D11FC1789A968622E7777C521F2093DF1354AE253F72BD06E3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 928KB
SHA256 a31cfb06c7139c2d4ecc6d9fe74668e5af51c75e4e3d27596f852a359fa5eeb1
MD5 1bba45a7860fee042cad297e8c73be83
SHA1 99c59cd40e396c3ef36cb33cdfec087130f0f39f
SHA512 9c7d361de520743b3232f152137d42aea29e0104dd760ef87c59a12a662766abbb2bf6ae9b2641390410ffcb9cbfcb5d7de791de41a9e15447776bf54873a8c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/26:A3k03kHRJi56r6
TLSH
T190155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 928KB
SHA256 f30eeac0aa3cd51bcb584736cc2426179284dd2b8a7910ebe3fa5d52f816b842
MD5 51a7858014780c747602776239dc239e
SHA1 b93410ffdcb40726a9883a4ac05123c929d909a4
SHA512 8b4ce667efcd5aeadd184a34e287fa830852dfce968598c1c6c9210a8a2a28ea18da170d5e0bd39cdc1420e1dc22f81e0753edfa50a5c15e2964d0d733ea668c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/mN:A3k03kHRJi56rz
TLSH
T1BE155A07A6890FA8C11FC1788A968662E7777C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 928KB
SHA256 679104f6f5e95087bff14b936c7b0cfeb0550c2e0a356fddf68a1d5500e5a776
MD5 6b77418282ca911f06ac7f17554df9e2
SHA1 b83136c6c075d711d462a1f382782671fe4db7f2
SHA512 e8d0d2097c7c5c0658cd9377c9a75ce6000f3e75b546f0ab760f32e9685c150e99bcde66bca3194011a06ca6effe31c8a321566b154941a0c7f2419784017c4d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/kf:A3k03kHRJi56rX
TLSH
T1AE155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 928KB
SHA256 e573ca3df4753d247e3e8675d1e6ae56b1dc02221aba56e2852d7bd091a10452
MD5 8860c7ba7d67b4e05a717c8779350cec
SHA1 8a99ffa4c0623ece2b8610e26b7106e107c3b9a3
SHA512 96a226ba5502a9a4eceea62ec58224aded387be67a464e3609e59a28a9b1d8ebfd24f12da9f77ae09466060486f295d4f0b60e1332f8b9596ae933991e40baf4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Oo:A3k03kHRJi56rO
TLSH
T154155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 928KB
SHA256 8713f1663cf21390033a1fba8b1cea36e3e3120981260f600d0270c7fe66926a
MD5 ad9e494bf67859abc9576b9f5e19ffd7
SHA1 721be2875c6589fc107dab19eee61742078736f6
SHA512 0962944f62258ad93862f10365e56e3059f2758e1b921bde4b8ecb513d56ebfb047e8265d85b3dc2aa57ada588473008f8d78740ba5a69f03163ba3f946c44e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/iu:A3k03kHRJi56ro
TLSH
T183155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 928KB
SHA256 1fa8e83216bc146fc8a07c3f9b4d0cd0c0cc606b412567aff13a1acde9eb0c4b
MD5 81c667cb6aceb0aefee2b56f1f307605
SHA1 d272fc1bc1b4cb397a225e2ad6cd9fb15ec72d11
SHA512 1ce0043c8009f8e2c7338724a42959ecc1312b363e3c328726cb666fff1ab33aea676e633445ad24a61ccbd320fb5d54b23455964feff31e04425535899693b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/29:A3k03kHRJi56r9
TLSH
T17D155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 928KB
SHA256 6170b5ac55c272b64d7daf7ad3019040506fd2ce42bf34f39bddba03ddde244f
MD5 702b51ae1793ba335e20aa3080466981
SHA1 acf007da2b2a5c0a38ceacde7af03ce7123e72b7
SHA512 24185bab7c6ca2373cd42bb17529e028b7cd891be72a65cc01c13ac728c121ff46557822c3f6061c4a3a2be89385f143076daa28fb491333514d274ce38b529d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/2c:A3k03kHRJi56ro
TLSH
T1EE155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 928KB
SHA256 389d0836b445bc4ff26849a7d9dc3725a2dc5481c25abc1c4e7f86fb21e27e62
MD5 76f4a8df7589dcadb5c8e9a874037856
SHA1 10eb55ded5deb0aae0a1d36f5b373396df29f5fe
SHA512 49008d72cebada13a4e3d41a037fe76800946de477bb70e9e3db8a39ec15978e0db04de773e7299bb6f2cc54c0896e589c22fb2f5cb1d71dfbda546dfbbd6e9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/vp:A3k03kHRJi56r+
TLSH
T167155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 928KB
SHA256 3c1b31bec62d3ca15cd9f0ebe02649d58523eb33508ee53da3900580460a270d
MD5 a291bf63d74b91738737383e15215ba5
SHA1 7fc039089f6bcf6d4b965fefd22a3acd8e311c4c
SHA512 23ffb3d93d7135a82363b402762fab92f3f49148361731eb286b52e1fca401aaba53c8fbab74f7b0f8937550f8191ab5b89e5617f6b29a21a683a6da46db39e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/QN:A3k03kHRJi56rx
TLSH
T171155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 928KB
SHA256 c1ca00793e85d9bf1ba20a454090ec756e0a2df7fb88dceb28ada7f8dd255969
MD5 d474535e31a9b119c899c75ebfb16614
SHA1 5fb47790f004e9df0a6f6bf970798ec0d8c1ac1d
SHA512 0329f1ca437cd9db9e1bc9ead781335013fddd8eba035ef9be3f8d523fa3d9b49a91edc789eb9dab15a2acfc0b2342803c33c10113423b43fce1a63724a09fc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/YF:A3k03kHRJi56rD
TLSH
T19E155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 928KB
SHA256 fa8f03368194f77900e353abbecc8b15864db75ccdd2616e625e887aca6f1ae9
MD5 292d66604cd169b3262928b372e9c33b
SHA1 9ec40c89325295f4a90e7de462d2adf46e655d04
SHA512 3ab133e81bff74f9ebc55bfae8004b11f27999e2c81f164aec1039bfb8e193dfeef999566d3944c5f121093e46b40b7271f656e3b3c06cfcf8774b63cf49d4af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/NC:A3k03kHRJi56r/
TLSH
T1FC155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 928KB
SHA256 f42c036e746f3f74b2893e9c7e6097768276e0a6e6897fdd9f14811dd4bb62d7
MD5 91bd10aacd3e1b065cae7076f055fb4e
SHA1 fe013d30a3b2ac38484bf8a7c885ece43228b37d
SHA512 4f96b07b5343f8ade6fc1484318cb19af7ece01e3fae653478125fa7f4263128fd25925e499be07bfb26febdf1a15876c62df410746775e6844ac949b9c7e448
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/2w:A3k03kHRJi56ra
TLSH
T131155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 928KB
SHA256 7525b218ba8e623f72632df1a7acb99940101a74a18970acc5813730f0f25a93
MD5 7a9832f6d79a5faf0efba87a32906595
SHA1 770e06cc446628272f68efa99d041ce339a2ce29
SHA512 91bc085893b4ab54976b116d2e6ce820d8fe984b5bed3d9d94f4ab1aaffaf5ffd26149fd8fbf355fb1a428406cbbe51fe2a548f196538bbfe136aa7237be69c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/lT:A3k03kHRJi56rK
TLSH
T198155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 928KB
SHA256 5d192d9b8812ee71b70d1741bc2d37834ef97969769368423678779597e232ea
MD5 740c08026b35ac322d59042839275c66
SHA1 1cd7bff69f62f478755ca773e1f4802e36ab702d
SHA512 193ba5f5e8b76b4cdac5efb705e40faec019b296432f8b2cfdfcba99ff2cf0fb75bae61dd8afe693d951dab0dda391dee8fdce41861c61d15683edd65cf5b0f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/7u:A3k03kHRJi56rF
TLSH
T1F2155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 928KB
SHA256 dfe3acf351dffc0b975f27cc56bf8eba35c7f88731763d2504595f7be967496a
MD5 ba734b08962e6e223fe46208af282afb
SHA1 ad1888517f3d576fa08bad1febe2cb405ff8e444
SHA512 e3ff1ccc3defdb00adbd497573b9e546fa553e81efea3018b52d9f98504b12b6ef44a6496a201379bce78b82effe64f5391c6f36e568f566a8f4bb209041ce4d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/fb:A3k03kHRJi56rk
TLSH
T197155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 928KB
SHA256 4bbd713de34a4edc9c677d266cbb004fc223476126977c59139d80ff9b1a64f0
MD5 44a14f19b84bb2926ad5acc61ea4290e
SHA1 6c80b30df044d5dd2008d9f22250f71acb7c5ee3
SHA512 3969f01e7ef98a66116b3e8bc25815f9f7a12a96ab0e22ac644b6d528775d740cdbe18d0f1ae7797d181e60c84e2201d5a279d8c0b3721d9666ee1e556fa8045
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/bf:A3k03kHRJi56r0
TLSH
T161155A17A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 928KB
SHA256 0cc5d7d950e4e48cad5833583ca2dff7cc857f3fb8b3a6daed9c8b482f9ec0f6
MD5 15583189a0a804d5e0e45b3d146ea32e
SHA1 1b80e37243bf8b0176b67c64945cef8d77ebf73a
SHA512 5ea93f1eb4b3572f921869dbe527efddfd8011ce1f78bf80a8ebe5186ed4374c0036239547bb06d67c6c80c268d4f7901036f9d2682bdf466ac0213be4cb1b7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0K:A3k03kHRJi56rk
TLSH
T1B9155A07A6890FA8C11FC1788A968662E7777C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 928KB
SHA256 929a9cb4b15f03f027273878c8cda6676d4ff97112fbc6e95f9e852ec07ab7fd
MD5 b45ea3db57c5836d4f7db1cd383274b7
SHA1 3f18a19b96d5773626e5898d07c9553f6e82cea3
SHA512 3debe26b4298744d97b2ccea20972ddbcf8253e73175fb63cf986c4e4e46ef8059d4e965247b93c422e995a2c9c03062f13c60fd5b90ce8b57c820290bd85372
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/pk:A3k03kHRJi56r9
TLSH
T1E7155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 928KB
SHA256 e61b5a0650ea709d30b0fda83cd9147ff50b5199555d696b78727b5f6d74cd72
MD5 3caa51364a30506f3616434dfe0ce3c9
SHA1 a34ca91c3a54cef20cd7b6619cac6d1be70833c2
SHA512 d452ae16449c557abf13e7ece611b183036594182ca624e688fcf61ce24c549938b5bdc7feda6f0cfa304ed9cbce19efab61dc2d499e6cd6b5bbe43f97866653
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/G0:A3k03kHRJi56rA
TLSH
T1E9155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 928KB
SHA256 2319676e44eeb8c854e535133b7ffda1c246103bd31007a9bab6e87f9389a00a
MD5 3f5d1e5da738b605da31e58067c51d68
SHA1 ba0fc0cd6f24bb397921cbe96a9db92adf453d25
SHA512 dcb605835ae876b68b5966344f67201442992ee9f8bd55d62e7f9acef3c0997a6d8a94dfe470fa83927a5ccb06d8c13803bcf4f7c3895cdc678ae04496cd4be6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Vg:A3k03kHRJi56r1
TLSH
T141155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 928KB
SHA256 79d4f3c49e5bdcfc03d59eac44d9aee984586c3ac00b2ff862de062582152ed8
MD5 bc7b39af0ff703459c2ec05d9f25ae29
SHA1 780bc0ce7453e108d4be2dd275c7f66d469a9550
SHA512 3d05d2e6e33478f52329b7f919556c2a412b03c2be0f0611ff35674b728c9381fb08d2d17bc5a726329858399b108e6302c3825df1f8c9d135b11fe8ef7d5021
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/kr:A3k03kHRJi56r3
TLSH
T1D2155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 928KB
SHA256 0bdeecad80f9a35660aa2284d7625bf3e47855382713963cd7d31d48c1d4158a
MD5 9c94e4fc94d9ecc06fa30a2620d09c51
SHA1 66f1a6f96fb8a7213012cf0315e8f3f74dd386b2
SHA512 2c3d0d043975f8a604316f933aada1aa5d98c4ba43d59e267b8d671490c4c3bf778dc1b60cccc53c562bbddc1531b099570eff9bb6411e14c2974a60348b4a47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/6n:A3k03kHRJi56rB
TLSH
T165155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 928KB
SHA256 47333d1e9a48869b497dcca88292df017d5c3ba7c915fc3265f3d3cebccac07c
MD5 049d1ee8b1615110c8455bf2480c3dc0
SHA1 3790b6e056ab5e85b600a9f154a6d6e3f0f9f98f
SHA512 c252cddb2700d557a0ad072585306fbbfe9673f540a91ac45b60cf55c8c9edc4161539310659c2540ee215bbde7732b6f6ceec168a3fb7457391f67789d0844f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Qx:A3k03kHRJi56rv
TLSH
T13C155907A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 928KB
SHA256 67b3560f58e102c638c4afb6c048fe8e80f7f3ea15cf6618d0fefb5044ae6ac4
MD5 9e5647e0a5b5ddcffd4d892dbc7edc46
SHA1 b7c8dd81258fcb9f9788d564bc36cc6b8e166d60
SHA512 af14bba3f227acc83a10e06ca98093a66207f24e0cd90ebb4866afe9bb00b15bf2e4d29f38e94ec05eb9fbbf740c98c02166f709edd950b3c31d5676453422fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/SA:A3k03kHRJi56rw
TLSH
T1F1155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 928KB
SHA256 406eac4ace433c45c9541d4ed41288a9d1fa65fb9502e5ad1109cc72851af8d1
MD5 035dcf37c680d9d3add56d68c7cfdc7e
SHA1 6db70ed6e1de890748350e0823ec9d0205d6a406
SHA512 f6371696c476130e525a16da223a7ebd67ae4d570759a6ae15fac09c229806814a07fafee45c17bfaca403d71ceb9e7f95304c06af9a65627ce5681b5ee796cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/r9Q:A3k03kHRJi56rJ
TLSH
T189155A07A6890FA8C11FC1788A968662E7777C125F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 928KB
SHA256 6039effa92fa7fa201d4388511d8469e083d9d1454dd6b03b92b257b92d52079
MD5 a395d5e8342e43725a2635505174a8b9
SHA1 0cafbdb26b48c6d76a42b3a34f1afc59065aaac3
SHA512 b0b8f6ab1f32c53ae778cbd4190767cb03be8e1f356579f3a6fdae986d7cd5ac5552f165ee70c8de2e50817b60443820f123442653e6408992720c35ffd83952
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/a4:A3k03kHRJi56re
TLSH
T13F155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 928KB
SHA256 a67e0bd22cf4c2074e8a363e0acb5ff11d54dc805ee0a280ccb392929dccf7d5
MD5 2d0f79186f55e21c69889d8f2ffe6f18
SHA1 b5796907897e62164c0ca915c81ad2bcef61bba2
SHA512 81c3096ac38a0b3de71e187c21123b8bbce725ca8803798ba7af914774580d21b8a70f7d38579217ed4b580f194ad8998de7f54b0607119341caca3f67592889
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Bu:A3k03kHRJi56r/
TLSH
T1E9155A07A6890FA8C11FC1788A968662E7737C121F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 928KB
SHA256 34c3213aad9f2626144711679f7d03b0b4effd262d99a6f4ed23c9420f8122e9
MD5 c75aea33b3bedf39e580cc9d15e7abb5
SHA1 013b7fcddf7ab6603766115cbb7a72ffd549e9b6
SHA512 a5f698b8e089c0c4291ca64c1b7d74de13f8b2278e149b5046a85de0647e9468e7cf27d7bcf31ce2b8ad3ab28ccc9d48c6aecde4eb2fab2ac2fc27575f4b860b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0j:A3k03kHRJi56rh
TLSH
T14C155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 928KB
SHA256 6606cf62a70ef1781fc65da4c570d6703a7c33e5ddebc55f3e3efc16363593d6
MD5 bf8568128a0cbd700d0cdaa231fd1872
SHA1 4f0841751032d0dd48b616cfa909933fecde6001
SHA512 cb81c488424a8e3825ca80c740d31bf9a0f55dfc211fae0bdcd28eb18f9c47154d3096b07156dabedeacffdb0970a1e7daa9b12c470ae650244d796e2092bdd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/1g:A3k03kHRJi56rl
TLSH
T143155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 928KB
SHA256 188410573faafd1afe34ce2622f550ec105a373e1d6df059c6b93464a63dbe8f
MD5 ba7653c8a8a347cf8251e9bc0728980a
SHA1 779a501420efaef244f34ba74b2400bbe5616f85
SHA512 61922879682a48f08c4ec35ff93d13148fb9b2bf16f58d7772ead7f5427407397b6e00ebca655b9a71843e13bf00bb251e11c2262238bd54f861b291931a521b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/0I:A3k03kHRJi56rM
TLSH
T1B3155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 928KB
SHA256 d057655915c6d778eb0d84aa32b3fe4da09f1e80b437c03be42835c9a7d3aaf4
MD5 0fdc5940c649319439680a8772dba290
SHA1 0383e2e4fd2018829de3062f39f9d49f90ca0515
SHA512 3bd46b78527f6366169a54f93957bd5493d9d1cd125d36874eddddd6851ace9c4d893d95b5c418b2b2cf29c6181fdd0b84b1e22e6069ba376636c4a25b79187a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/mo:A3k03kHRJi56rO
TLSH
T187155A07A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 928KB
SHA256 599a26eae768fdb60c624c7b72cc6a22ed13f8ffa49577c6d6cec9dc1e0c589b
MD5 cdf6ec3d885de59d8913a43dc82e79c9
SHA1 2f69ab87cd32dc564fb30b9d91e089cdab99c8e1
SHA512 2a8507cb87b504de937f453e6da209ec505ce4e60b35d93181e28d2396afbb0c3741cf3f81d7a467f5068f1629085f633b8dd7abac1e9e28cacb8f2ffa1002f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/N+:A3k03kHRJi56rb
TLSH
T150155917A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 928KB
SHA256 587eeddaaad3f840446ce0a620fc06e385b25fe71a278bb8bfc77ec766156512
MD5 c2703844ac8027aa9fe167d443cd5ded
SHA1 20eddee6959c707ba4cf0eb2168b36a9f2257db3
SHA512 b14a91c7b60e538087c94d86d8e5a8997fc6b6501b96d6606099a95b8dcb015e77d2bed9d70d97ba0182b0748ddefc7a835814a4be6e9c58fb24e48037c87a2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/7Q:A3k03kHRJi56rf
TLSH
T15B155A07A6890FA8C11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 928KB
SHA256 066cec1ed32ac4aefcafb4a69fd488431cbc66635476b3db0945fc318a521d16
MD5 bd1e08f0e8a86bce4a5335f89e3cd3f8
SHA1 1d5492ebe804a1e327879c9ac8b12e437af41aab
SHA512 b9da12843e4d747425354a0e3f62f0729ff477e1ea00fd69dd155c1ff2e7df54c7e4a139f5ea591630bea69eea34be469107edb492690b574b670153c33fdb45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/wX:A3k03kHRJi56rz
TLSH
T1D4155A07A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 928KB
SHA256 4cbd2461b02e3133e934edd33088ef848d0691d5ec0a4a8f256dde5b07f0654e
MD5 6a10a35907e92af4c14a385f4c97f093
SHA1 dbc3a270c4c348fd01616a86481c3c4f151427e4
SHA512 84a4d184514011f3da446989d842d532fe0b8be2a9a2d9591b6deb460327643e529287a346d930a7e08adfa3691dc7819838169fd7c172d1b23983de346affff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/GL:A3k03kHRJi56r9
TLSH
T16A155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 928KB
SHA256 ca6f20f6a9480375f1be7284be3032a8d27752ed03cdefde423e40fe0c78f21d
MD5 d501f6ec9da4d992b87e2742d640ebc5
SHA1 6d9139cf4f12137dfbf7b6c547f175d62219dc4a
SHA512 a0f0a68fd6287b02be811302281073d0fc1a820eb351005741203722443c3aff727981ebe33cb2a45f3e7fbf9d90c88461d65e4a5fe71543450410eabf3f8de8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/aM:A3k03kHRJi56rE
TLSH
T139155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 928KB
SHA256 bc39d20d3b9d022c7859fb6a923db73ef6dd092d71c9295f3e729bf04f23701f
MD5 c119367dbddd5be907feeeffca3c2de0
SHA1 532d8e8a1912b0f75d93b7e39eb4a2e3fc52f37d
SHA512 3f28be74a8c7fee1a70ade95f5dc134f2643c671f2136b6c46a7652ba8e1d6ba475cae8f6bf7db1ddb56db584a962552a4a64e3d20f028aca6ab538c1efa5110
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4E/Lh:A3k03kHRJi56r+
TLSH
T1A2155907A6890FA8C11FC1788A968662E7737C165F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4900-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4900-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads