bc791a0a9a2631a83bb8cd40170a96bfd5df3b952ed3924064ec72b3e6101600

Analysis

max time kernel
107s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 951KB
Sample260810-ttylrscr3t
SHA256 bc791a0a9a2631a83bb8cd40170a96bfd5df3b952ed3924064ec72b3e6101600
MD5 6af596874230886868872bbf9e325d11
SHA1 8879886549ae69e0479a6f7a5d8796203f502ece
SHA512 9a2dbe5cc99344f9d02da137058020f24cae57f1fb61abe4f72a1bcc2a7e350c3c9e0784ccb58b70fde63d934e17bd5e3c95cc1546fe9f964de9c361583a0c42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyN:A3k03kHRJi56ra
TLSH
T1A3255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1648-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c528-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1648-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2568-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-273.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-466.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-594.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-722.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-975.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001000000001c528-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-242.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-273.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-466.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-594.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-722.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-975.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2568	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1648	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
2568	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1648

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 bc791a0a9a2631a83bb8cd40170a96bfd5df3b952ed3924064ec72b3e6101600
MD5 6af596874230886868872bbf9e325d11
SHA1 8879886549ae69e0479a6f7a5d8796203f502ece
SHA512 9a2dbe5cc99344f9d02da137058020f24cae57f1fb61abe4f72a1bcc2a7e350c3c9e0784ccb58b70fde63d934e17bd5e3c95cc1546fe9f964de9c361583a0c42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyN:A3k03kHRJi56ra
TLSH
T1A3255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8446890a4cf342c35bcf91cdb159573649bcb199952fb64ae5a8fe7c50418516
MD5 a2f2919bb0d3e33dbe6491e1b33cbfa4
SHA1 e32cfec386d47c3565d76b01104f0b94cf3f9804
SHA512 0fabbf44b696c2b8c3aaa8a9c952d291e3d3a4fb7184341b435d36865cd7c6de4bebd2e4fc7579b71ba7cae5d092665854b066fbd9d341b838c02f34228aa03e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyZ0Le5ji0hmxNrM:A3k03kHRJi56rqPji0Aj
TLSH
T1E4655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 27ba48033c6aa92f00c338df0d5093f46442b7cb7dc802861d8c23397b08bbce
MD5 00a1753e5dab365309d7104c8cec73bd
SHA1 9d7ece56e09f19db6ac60d3e2c3c9b75e05c5283
SHA512 d23d6e77a2d58e638a59ca534aa88b7bf0a383f7b74e4b0054a6e70f1b2fbffa65cebf4818870ccb05f8aa96997dd13a95bd7c4a80adfa225693664d1de732e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyLa:A3k03kHRJi56r
TLSH
T10D256A07A6880FA8D11FC1749A968662E6737C125F2093DF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 0c883c2a9b35db06946ae09ff2e7091904e822c2a99a75ea991f0acadcc98868
MD5 078726fcc508acf541637eaaa76ae466
SHA1 82676fc37de017310cbecf97152ad5c31182d071
SHA512 85831efec26226babcbc55f9bdd351f5617f13c98cc94b1a397ded4a821313a706b83f6e5e106de7711205af3f17b42fc38b2c8f07a295271b21d489206aee60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyK6:A3k03kHRJi56r0
TLSH
T151256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 975KB
SHA256 e630fc25d9b859516ab394f0b2045a758f01aa580a24b90e4388931f10f5a19e
MD5 2d13c4346b0f34efa68f6a788e6c539c
SHA1 70149c3cb4ca03e83de8b301f62c2d9ce62dc777
SHA512 6be142b3207ab788de9312b418badb81b0233b52f7f2644bf595d1197fae9500863624e42b29b9ad60f49dff7bf9cdb222b9e393fea5995129a06f9e75e7f0da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyiN:A3k03kHRJi56rJ
TLSH
T1F6256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 975KB
SHA256 ce81bf82f959a783a9f7b14d591136431efdff636c591006707de667e8d7c6d9
MD5 9fd6e45e372b76a57c39b3eb9a95a3a3
SHA1 217f73fc83e5da8fd0e702124d886c4b490ba747
SHA512 9ec4f378d27721bbf4c3072ca779fc9b1613c7fe905ae0587787e43dd53c9ec66c6703bdee77bf719580609103585e74536b318173a2e9373cf0986eeb699dfe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyYf:A3k03kHRJi56rJ
TLSH
T156256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 4e9e14a1637a12132404fa149365fe7417acae90f3c7b65ea2a5b88ca402bc4b
MD5 9cce37710dcb8136f015234f24015b0b
SHA1 1ad20069c7ccd729aa3478b0adceb89c373fab3e
SHA512 fd071d8be9a656173b2d582b87f4c6efb654c6eea286a94e2577f9c0e75521e0cf749023fc69cbf8af3056c3723a20f3e668d2ed660c0e611e21666b256f8885
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyyo:A3k03kHRJi56r8
TLSH
T1C1256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 60736b315fadaf36e6ae359a8bb136a6acfa7fd0ce6524be524aecb23c56adaa
MD5 6bfcb6491c1bace2fc51ec1b1052a8ac
SHA1 d1bb7a78c07de8d32f9942c880a69826f2373d6a
SHA512 10da30abdd6ee01a660e4944d895a8e8e8367e8b937915cf877c68af9ec18c10f81c5ec6130b2a82fa2969648c7a1a83bcb156367ec63de7502dd8d518e2ddf3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJymu:A3k03kHRJi56r+
TLSH
T193256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 84ad9bffedc04120834668d04d8884da8b770bcf58927ecd8265b72be1e48575
MD5 11cd65ff52d5dd2188cc2ac1844f75f1
SHA1 ad950f50a2e57f0fae8ee03779073e2ae416736d
SHA512 324cf352fea5776a4a0788ed1ff7463ff5a977f47c7b19c18fe4dcde58d0206b2e3fa62544c2df98d4c56bef6edb6c92f36dc7015c840d86d50ca44cf7871190
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJya9:A3k03kHRJi56r/
TLSH
T1FC256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 948a5d9275d8ecde04ffcb093d9bf15ba80a5768e860a79d3f0d742992b1aea1
MD5 8cc3655e571a4573b355b9419a0434de
SHA1 8b94c649fe186ea9e10277f199c7f9a2cc9afdc3
SHA512 50761b08f4e8f1a12d98902538213b30eb8af926e5ad7a566fac8d9b41c979936434c737d24bd7440e197176fbbb8b731b0d56aebf9fd6ca07918bea47d4a8c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyac:A3k03kHRJi56r+
TLSH
T14F256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 ae0fd7953cd1cf6c2c866aa18bfb3792b762fb9b4a0fd4dc867ce5e1c042b035
MD5 6baae7898fca14088bcb1e76047f1692
SHA1 ef0c91888718592556686d4a2a1af862d12a48f4
SHA512 599e5ec9d5e4757d88e2fb28f49458e92f5d878a6e781d79dbb140344ec6b18d1bec9cf61fbdf61cd3281b270dbca85959b2f3977d23b886233181881a0e9721
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyTp:A3k03kHRJi56rM
TLSH
T18C256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 0ede306f15fb0558cf8153c6a55743c4eb9ce9c22e436f30f162836863889b71
MD5 bab0289ac36a0c252ee6586547c13434
SHA1 57f8e1735da23b3e615f4c735249cdc9f3745696
SHA512 cb85d4c4f0256a8bbaf224627231a6fb87c2c4049c6a5b66291702e26c59c8125a1ed29b0827111607a35fefc7bac71638e5604ad50103c32a7c5336d8dbdd69
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy0N:A3k03kHRJi56rL
TLSH
T122256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 ac79247e76b312c5c95edeae21705fbdd584a627b71a9b0e81536b0443184340
MD5 6a539de0cf128481bfef580bbc098697
SHA1 ccea59c40181ba8e6ef1c7470859176251d41c5c
SHA512 eff9c85184e71998961e77f1668caac762bb057aa18f6a375b816a80f026445e8f6e1e5146efc84ab94fa97a0dba7640cd1a1c6b2c0afa6eb7ddf2bd5aae3388
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJycF:A3k03kHRJi56r9
TLSH
T13E256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 71f782f6eb000036396b46fc805547a14835d4fad70da0d094e193afdb88309f
MD5 c6466737a9a598db9cc42e1aaa0d6c22
SHA1 94dc02dcdd8ea2ad4de3e13f3c0ec97953ce409b
SHA512 431329774cecbd047a4c9c8c3424c78f5a35b3d0fbb7115b1491adf381a52ff73b7c2e5824de6d4128da8fd778a7fdeb44ff28408acab7ccd8cb95135125d088
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyJC:A3k03kHRJi56rh
TLSH
T109256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 b7f62894a17506e3e3b8d21c318198edd56818a19923049c1f86f59bdfe7a4b0
MD5 50110972576b0b32d1d0998e03916bf5
SHA1 f0668900bcae5ce6f948d97c02dda7f78fb248aa
SHA512 b4c0bb4217790264c701ceea05271c424cc64fb722b9a128c931f6d77c507879c498a306f02628ddca868073d6a6e32209596df54d297e5f0559e75ce2d49e92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyqw:A3k03kHRJi56rs
TLSH
T15A256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 d6872ae7aaffde9a5fbc58a8e4e40bb196ce57448097439d0ed7b30ec801a263
MD5 f433a95fa5e4ebabdeeddf1833ad49bc
SHA1 df12b961258f599373363724d5fcd929f6557efa
SHA512 33cc611b075910e5581e86a61bf0044f9a3a29d6742cb63ae8d7877d8e006d9839cec6f54e12098d5db0e70161472e53109948a060347b481b75d80d9840f452
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyxT:A3k03kHRJi56rU
TLSH
T1E4256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 b0b99c3a994b4a1dc4c842f1b98dec10498f0422cf24ca2e7632b62d9067e6c3
MD5 c3393e6dd190a1e3743a1a73ad9cd2aa
SHA1 22a4ac637c854017229e7b1c3055bdc6c7d36a61
SHA512 d5bb9f8077d2bce0cdb79108d3e06ac2f1dbfdb0010aad5392826cfa0f3228b5be36959d291b5dbc506174f3212d093a27bd308006fdc3f9edbc12f6bfd764b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyfu:A3k03kHRJi56rD
TLSH
T169256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 f728009cbd4f5c1d02b9b661f2a0158ed00cb03a2673ce9b72dcb67668d4100e
MD5 a434c1b228558dad728536357465c40d
SHA1 42874feca00e86747d1ab03824fa240ef1512feb
SHA512 23fe2f0e573f0121e47495c8d348598001f2631a72288fc195238de29b7ffb1cfb322730838ba71a48ad8ccd1f503207a62de17cdb8fe3cc331d6a284beb8ebb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyDb:A3k03kHRJi56rK
TLSH
T164256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 a419ac7c9f3fd6a8d81a5825f3536cf3bef2d14fa6d5980cba0254f87e9c5715
MD5 08726eb17bea3785f73a6ea288db00a4
SHA1 881e99d0aea22f22b12686d6530e75ee3122580e
SHA512 6a48dc3570236166a77cd914ae17b434bf61c0f3bd39ac840cbb7007e192bb9208804b1930116d41aa0a2c5e12be9e821dc39a03cec94e3c8d56463e85ec92b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyXf:A3k03kHRJi56ra
TLSH
T1DD256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 adaca492c5a2f739775e846f1a36bd1cf8d340c075a16fd3fcac2a65d1a72518
MD5 68d467412170d5135b811defbaa180dc
SHA1 8b01ef078b0b52bdf064ae8a62b0db29a6dbff09
SHA512 14485c1109c377231aa42ea08e49e12a5cfb08d5496a23bfc374597e4a5d77339a53210f04244d60ee9e8a711b144beea5a030ff5c74cf8ab6a2c9fb0a718161
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJygK:A3k03kHRJi56ra
TLSH
T147256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 610bbbef2fb7035d0f75d41c1065fafe0b9d2de279e833d86ce3906194b6ed5a
MD5 205bd909dfd416db8dc89f7d05fa2696
SHA1 3023bec62ff53c1a3826cce11654e1a07550c635
SHA512 7974d45be7cd403b24dbeb7fcb4c84640403b4d9b5150ef3ac4fc99dae76300cb90dbaf6057b41733bdc4c82a05ab8a599a2e212f223560e2c594b9c95f7dade
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJydk:A3k03kHRJi56r/
TLSH
T1E8256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 fbeaa5e2947104165914580d265452918ba96780828a1c294c21a501b7923f0b
MD5 7b78bc3b3bc4e77e2ccd204d85972c50
SHA1 15fda18b73b153b50dbeef10dfb60735be8c8381
SHA512 e51e33cdf71b5bedb9fae2b4c7af9dff31484f6e09d91ab4c43795bb364d4e726b3af1088e0120a2714f32ba30c41e49b7baf394969e89d1976d9c0fd5167be2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyC0:A3k03kHRJi56rO
TLSH
T17D256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 b405b932211e8ba23cdaaafc52370f2e36a78a6620a2dd78dc3906f668c3908f
MD5 9c00c68ec53bc6afda5f16abf5b51777
SHA1 4f29dfc44e8c984c04e6867166c31bae8f861d7d
SHA512 26fc24c109fd04438f7098998e3098cfc9c26a953b87cf4d063f88884253c9e707b506bd77cef4e1721b427d4dc56362b26a5288023a55b0de460377fdeb34c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyRg:A3k03kHRJi56rX
TLSH
T139256A07A6890FA8D10FC1749A968662EA737C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 e04a4a80ed108b15ed6dcfc046465f57463685630f9847ca6f682e0e5a50ec63
MD5 6333d1bc0d6b52d22e31ec524f85c819
SHA1 6100e59017915fad7925595c56eb47df414a10b8
SHA512 d49078a98b3447ebe442cf48827aeeef4e9b933e724791530f5c9bd00ec025d24e1f761856b87c6c31d69fcd51e598789e80f138ec354c674785ca3ae76e86f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy4r:A3k03kHRJi56rx
TLSH
T1C7256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 ea161ecb18721962360159fea115cc9dbe63e98798b9ef07164738f788b4ec97
MD5 c4ba784a1ac7d593b841fb1342b1e26b
SHA1 a6f83ffb9d9429e0f956c8d159d0b2c662d6f2f8
SHA512 12da36b23194b40d0fb8126a7d9b992e98eeb39f995f49ab5fe7df8b554a0f4c043b86e8a86ca8fd32e387af2085b623bcfa835563c5d91a3d9ea10ab3e40796
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyWn:A3k03kHRJi56r7
TLSH
T1E0256A07A6890FA8D10FC1749A968662EA777C121F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 b90d3c05c05923fc6f9bae2c71d42f7e1d718a9f1f350adb9895ef2fe31f4466
MD5 a75b14803b56cd9e0717168900fd32dd
SHA1 701228118295809846213bf5ecb70a9249d4347c
SHA512 0ca979e1aa32a7ab8c4da0832e21f818dea8624732ecb87cc4b326e6883754ebcb522099eb0cf086780b0ca1c7992a04adde81fb6349ee534ff212cc09368cb3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy8x:A3k03kHRJi56rp
TLSH
T15F256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 1357a601c30d9b8be09edcbce40fb4d9f350b2d5ecad3ddcc5269e3233fa6ff4
MD5 182fa3cb1df0035cae2aaf01d4248000
SHA1 ef48ac5009e7c7feb092cbdc4cad00d3a483130d
SHA512 9fcca4b8e4dd9867115178001c2e6a4916a77a0079c29360bae069b1edb23a0e8276d2cfd16b316bbbc6dc30490efa4619dc95b34664165837c6d2a12e9254fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy2A:A3k03kHRJi56r2
TLSH
T114256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 a977170a10269065e8692bc915fa24bcbd680653cdf6a622e83b1cb08e4772b6
MD5 08f8c51c98d53b113a8b1ba6dd33a204
SHA1 b0dd64c133f39dc7a42b5bbe769bd3c150029ae6
SHA512 23719be8d287d3f7830709e5058e65b12a4bac2ca03aa8896171e3b1cc970847c0627224f3d47115f2e0b0d9c815c2132327756b1c3a9ebecfbca27c03ed565a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyv9Q:A3k03kHRJi56rr
TLSH
T144256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 95c55afd3a570aa1d5442392ff2067837fcf314cf97f8b46aefdabd751eb54ea
MD5 4cd96d5c92955966a0e601cbb81e00ad
SHA1 46947bd02655ffa7ede9351a546cd10b5dacba09
SHA512 e907b0dd36eb795e0ca20767094c859e43059f37d458b57e69c0e4d047a5b9ca02eb075b30c5af380736c837b1f8a0d828ba81260621a4a936b339db17c9884e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyG4:A3k03kHRJi56r8
TLSH
T159256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 d438b9e36ca1c1394a221d49986d650ea3762e09281f785d40691e8f6f23e816
MD5 365dcb7d30697df6636dc789ea574a33
SHA1 35c06386843e70e4a03fe4ef12d862e2b73d0408
SHA512 21bf16ca11a71a535705db1ad2b82c2df2cb77ba8ece2ba5c87412d03ce80a034172c4e9610f1ac0b43b624ae6908c4af95cdb14ed1ec4859956e02e6fd1ecec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyVu:A3k03kHRJi56r9
TLSH
T106256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 83fc970a97134969ee6710d912e77f467be0e1805bb2d75a825360ee5108305b
MD5 143d2aace88c162c125f0981df33cc74
SHA1 207f4956855b38bbd913d87a72f91e1be30847e7
SHA512 cb5689f1e96521a97937ce9a636cd000b5987c276b2d51d96e95e3635d7fb59579fd777db2e9a91a9dc45321361833aec9fcc81e5e88e58bab45424002a51ceb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyIj:A3k03kHRJi56r/
TLSH
T17F256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 e96162aff821981a644848f1c35ee8454b6a8ee393d0ac12b67c1d0d2cd88e9c
MD5 9bd82eb0a830589611b2cba8773283aa
SHA1 f1018d0f305cfdb5323b5287075d4db69a5c68dc
SHA512 71222188083a118e2a9c2fd53059d91e103e72364bb264d2e3678e917e31bb7e5b4dea09b5ba44b4edd120c2dfe1b296e93517e0dfbde258875a0948df053cc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy5g:A3k03kHRJi56r3
TLSH
T1E2256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 807736c9a972d303bf32aad6689da715ad6df618b5bc7f7272ade36c5439127e
MD5 92feead5ebfbe2063758e45c28190ce5
SHA1 3f5ac39d10c705f589ab37a48c643ac3efc91ea7
SHA512 019ec1610f8605a642036ec236b6b4dba102e7136b22a52910b816913600e11d26f7363f08def0e0158eea41fed8ac3776f57322864b9a519e64a3da2314b826
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJygI:A3k03kHRJi56r2
TLSH
T178256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 0ffbf9dda849e71382966440dc821639c425060c40f5691c62a77252e56658d6
MD5 bb3ba9f5bf8e2880c93be12777216163
SHA1 f3e2e46bd0158d169f79bd298583d894ef69cf13
SHA512 13cbb9936a8a847f7ebbecd08e7ceec8a5ae2fb71a77c0eabc1e40c64c98a64e3aab39065ca4b388d493699299e15589fe60a5f7ce7f5f2376d133fe8949f014
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyio:A3k03kHRJi56rE
TLSH
T138256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 06e0b7b44e0e1c209bab81110ba99ebb601e599865e6258dd79b7f8b30c4bb8c
MD5 10c9dfc7b44be349ceca94baf311ffac
SHA1 57901733e72c40592ab043c47782821ded8e7e4e
SHA512 1ec040148d14f3adbd777c1ed72d7d7544330c4cfe2799070e8624fb2fc7a43a11e5fc8c23a1348ebf6e02bae8c0791a63ca938cb458840dbff67cc37baa38ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyZ+:A3k03kHRJi56rZ
TLSH
T156256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 65bcde56358a9bc0161037f4bf1ec596f4bfee81b18d28c81912c2ddd371f01c
MD5 101a169a4b2e5ba40f91668e5a9924d2
SHA1 96a415d8a706a16899823408b92ccbbbae1c96d2
SHA512 afcd9ddbf4bafd9bcb9796b995750e251829d214c28c76f6beb39d33f9fb4f7771baffdd9bedeb250ade484a2992d1e3411d6c939e448a8eeb15be94a0d95533
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyHQ:A3k03kHRJi56rp
TLSH
T1FB256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 7b663018d5fde6398283bfd6075b8fc9fc653f53d80e3fa35d3efccd768f7196
MD5 7b18d40161a4d182c6260f4784d2ab1f
SHA1 dcef15b347ec48d0d4c5dab45375690c546fe4c0
SHA512 d7f383fb26c0f999a226491d7c53291c4f1c81b82f49d85a0d0bccee2b3395be144646a8af8d7366bb9690379bc66df16690ff095ee33464c4ca705bbf9a73a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJycX:A3k03kHRJi56r1
TLSH
T1BC256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 f9b52fd6f7e914f3e946a93fdfed87634048bc567f450d4357cb62b9b90b0be4
MD5 c87c5ded64f3f24cd0e62e6500b610f8
SHA1 a24ed4a9126fa7511d45f5e98060fa9f16a4dd73
SHA512 260680cb582ff1c911c2c0899105f6cf61d108a012705b56fc76828fbb02719c77812a3e948afd3d5ddffbb55140308192c9b69fead85f44122e79f0c13b9c8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyaL:A3k03kHRJi56rn
TLSH
T182256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 1e7c0cee58f3cd526d2aafb51394fd0e713e868be259effc01ed27db3798fb0e
MD5 322d99c0ad56afe4d6bc5319e80d77c2
SHA1 e69ab60bfe2d09e3645b07fe6a8f1d44151b9abe
SHA512 1b4533fd3a03db0b0e6a52b930da034d59fb6dc00b8d75c12151661a2fc6155e8a9e0a31c0af32ec5388146433be422a51d12ec15ab343e464f3479214eacb84
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy+M:A3k03kHRJi56ri
TLSH
T1DD256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 71e1d5e992aabf0fe76dc2d86cf6deba3eca4a2d554b1cf42b76aa6425873f10
MD5 bf1e0faadb1085e8fdba5e3e5977f5bb
SHA1 9f0c8f3139960cfe616cc0708ffcddeecc5cb4dc
SHA512 61b06c0c863d92a9fbb1f32970a0661a6ff98e29a571fa4b328af6ecc4349e4080924985624a2b44b38d381bd4815bbeb4fdea4ba60b459771987ea11dfd5ab6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJynh:A3k03kHRJi56rc
TLSH
T113256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1648-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2568-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads