2cf293fda96830a621e6a1ee40c6d14d96170c52d0b9d3eba6a137f170635aeb

Analysis

max time kernel
93s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 951KB
Sample260810-wlkfaavapg
SHA256 2cf293fda96830a621e6a1ee40c6d14d96170c52d0b9d3eba6a137f170635aeb
MD5 fe38aaa487922cdee67e0989efd13e0c
SHA1 ce97606c04f10c5be2fc2461d000034b0f311557
SHA512 ce43e885ca38830fd4816c2b750bdb2710084461d8a59f38de3e80c0ac9c76be97719f0c93ea4287515586110b459639ebb36fd2c8a0b44e58328460861d307c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2u:A3k03kHRJi56r5
TLSH
T15F255A07A6890FA8D11FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3704-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c501-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3704-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5840-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-582.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-680.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1313.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c501-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-259.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-441.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-582.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-619.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-680.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-735.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-784.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-821.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-852.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-878.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-918.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-949.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-980.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1078.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1127.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1147.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1313.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1332.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1363.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5840	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3704	2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
5840	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_fe38aaa487922cdee67e0989efd13e0c_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3704

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 2cf293fda96830a621e6a1ee40c6d14d96170c52d0b9d3eba6a137f170635aeb
MD5 fe38aaa487922cdee67e0989efd13e0c
SHA1 ce97606c04f10c5be2fc2461d000034b0f311557
SHA512 ce43e885ca38830fd4816c2b750bdb2710084461d8a59f38de3e80c0ac9c76be97719f0c93ea4287515586110b459639ebb36fd2c8a0b44e58328460861d307c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2u:A3k03kHRJi56r5
TLSH
T15F255A07A6890FA8D11FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 ef9821bb1e63480b1b08bf9356cc015f7e1b4e80820d87bb8b1fecee84f10f8e
MD5 cbf77628d2d04061901af65b0ec9663e
SHA1 51f0f0d6c581b2262ebba781e866730a3ac4cf16
SHA512 06d3e626097297b73ed68f6333865fedbe2bd028a1cef41396fc1875a2c21145dabb6ec87ee8d4b2345a347b3c41482b48efe83f75e8ecea23a1c4efe4a56206
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2e0Le5ji0hmxNrM:A3k03kHRJi56rlPji0Aj
TLSH
T169655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 70617d6d457378a97a81fc2bfd96983040fb0b2f015f55a2a0f17a2db8923f30
MD5 dfae89564878683a0acd879a0a3a5078
SHA1 0cc003cb82a2e98d1e56409d6ffa636266d71e6f
SHA512 5f00aa6104997d3016a71a680841ddd4f991bf0c951cd5c55569e114f51da6bc5ae7134bdd1fea187a4b389eaf5fac68852e914fec818ec4f84e7b40bb656868
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Ya:A3k03kHRJi56r
TLSH
T1B7256A07A6890FA8D11FC1749A968662E6737C121F2093DF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 01a4f5fd54d316c7f6478ec16c059d511a0c0aff4a5543648ecab6201dacd8e0
MD5 f668989ea851b0ca1f2e6285b1da2ff4
SHA1 221a7ca60a5045b018305b206d3ae913a074667a
SHA512 e66a7b0e2a6517c07f779ce61b8d9ab53805e4a0a217493864fa8641b99159c6d796905bdd327c1c29fc87df338289a3b7c243fdd89063c50fac9422deb0d9fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2x6:A3k03kHRJi56rh
TLSH
T10D256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 975KB
SHA256 254da4334fe9ac3a277fe069dbcdc10b2956cb20d12de1796670a0ccf0c4cf27
MD5 fe87e597e96af1b4a73ac0021c53c902
SHA1 809bcedb488174e6f44a39ed916334549c9e0d9e
SHA512 37204f20197d0d28bbd55f158db1fd95d4e3dd91b2442d52feb1c5ee6192f461ab972a063b7f9614ba54c346740a9d23ad719c314aeab3b168c0f82f0f101239
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2vN:A3k03kHRJi56r4
TLSH
T191256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 975KB
SHA256 79907dbde64b2ee5e98af7da9f1b0b0b027d21816eb3f1b5ce2f5e883224eb48
MD5 3c4f90bfd68e123c98e55d8d6981d17d
SHA1 b826d06647451bd8f35f96c984c380bea175aabb
SHA512 3e1b3343b3dbf6574db09c048f407324a3df29a012cb5bafed7afd7767d1d2ad618e81037e8bdaf7608a48ceaf7974108cccf7a6461625846aeff87fc2876675
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Vf:A3k03kHRJi56rw
TLSH
T1B9256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 4414538b494490fad2078d841c9e277a9da77670b5aa27f0a02c2e64ba2cccc6
MD5 488959ffb9ef675b8e2d7b133c16bf60
SHA1 317a1e717a8c64fc9871a7d6a3de5aab453bbdc0
SHA512 640bb79115c04c97787c04eb6ad4c066c04685f8983330c44f62a6522bc2eaff0a6a3610b12f7e519a4e15382b7aa48fe5eaa403b48ef0ae19de312e4c7f0c9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Xo:A3k03kHRJi56r9
TLSH
T1DE256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 331c3ebc55fa5883e607e40fa4490292aa3dd7ee808fafb5ccdb118bc51f9c41
MD5 05d91687b6ec6ae1b3c3af21afa56c99
SHA1 ba6146dc2b306c718b58ea423036eedf7bd6913a
SHA512 3d302143451277956386653dd7bf9fb5eeddfa92fb6a45257a6a06208661e0d59c2496c6b04cba5dc224e66e476538b6b29bfe9cd8f995388523d13c63914539
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2bu:A3k03kHRJi56rP
TLSH
T154256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 e478abefd41e60a571fe3765bc5daf9431a474d3f349b2f85d3b25071e5a2917
MD5 193322cb16ed8d940c3399f31815e9f3
SHA1 429cae8efe06326f2860d8d834d5bea34a953a7e
SHA512 05b3442c86adf1339c670aec3cfecde9a0f04f0be409af9672affb241cde2aefbdd637767df25ccd88dfb2cccd4301d0e325167a1c9f83efccb4eb7defe4fdee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2J9:A3k03kHRJi56ru
TLSH
T174256A07A6890FA8D10FC1749A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 e7d9da9b2628f530de5aed81113a7d167701c4bfa1426580f06dc1390f13e7e6
MD5 77c82930abf3f7a2fbac339b271b960e
SHA1 669ac47808d2819fe47624178ac35950d89d39d5
SHA512 e274f3625a1f331b39952322aacfaf46aab2b900958bb4fc5644dda93ab3f5648dc6453ce2b9eb19e3dd2a02e71082df5e8cfada7c55fca6ac5f64fbb3ccf12e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2lc:A3k03kHRJi56rD
TLSH
T1BF256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 90550ded767c4c2f24da02b9ecec5003bd2044a5999f19393a9df1de0c219a63
MD5 6140c04a51a3c9c97ad22931e382fb49
SHA1 e4b42308ec4ef85718b452062a83a59ae58c8512
SHA512 2e60161d782cf2bb29e83b7115af95f68791855dbd98eac1a1b363cba400cefd8d94a4328d5b58474fc60279cfabbbb0deb93d045d468ca4045c4591ca586ef8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2ep:A3k03kHRJi56rB
TLSH
T17F256A07A6890FA8D10FC1749A968662EA737C165F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 97d57c21be839dfc5647b2f6864b743ce2b491874e97b1b571a5850074074b42
MD5 f72394908c50eb9b09489e1b3681db5e
SHA1 81bc8b9a086781d7b377e931c5aaea2670c94d48
SHA512 da7061edc492ff0a0b47e6b2dedb3cbd047bd0533032ece527672a3fe38b2c84af90d710e6ec469de5ead8809c1e12426c899e3cdf5904f16e56920116a72c62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2RN:A3k03kHRJi56ra
TLSH
T17F256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 50686f429b2dc4c21a0d05bfcfe91d320275ab205cb156c4552cf926fbcd91f8
MD5 43fe3ff3159e367c71d0d3bfe6d0a3cb
SHA1 0a046384d240952be8c4e9000c536e5f3cfe58d9
SHA512 2069e64c0e48cb674d619f7190b2b215df4152a8fb1ef429462baf05dd7868add407301c2a8cefc4246132784b6e5dc27a24edfa7d17010eb3524e1ae6afc022
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2zF:A3k03kHRJi56rg
TLSH
T1DE256A07A6890FA8D10FC1749A968662E6777C125F2093CF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 5dc0caa0df282fb54289a2f4362793c54e2f36f6ae61a049c87c87c09649f3b4
MD5 aec24bf309d2281736c069214089e365
SHA1 07340fb3bef17d136be1e15d68e8e48d15af1fb0
SHA512 4834d76661bbd0f05600dbe1051983387d1f97cf9302ac5808fd8adab91592f4f8499efb56ee5a5924b769d61ae9066e5df46c28221d54baeaee0d6365f05fe3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2cC:A3k03kHRJi56r0
TLSH
T19A256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 66228c67d390dc346fb89e7f706708616892f09a79db0ecca4964a041fa0d4ad
MD5 0f4a36d715fa5a883d79a133fbe666fd
SHA1 e3bc2745266b9b6f079f722bb293d2a3c86e1890
SHA512 80801761d77484c99aa1aeb02541c05759ee790b3cf6ec000f552d67588a4923ec4bbcd91576232c4bcb3803cf309ef8184ba750d41e2de2984ffe7ee8110bc7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ23w:A3k03kHRJi56rJ
TLSH
T1CD256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 885fa1cc54e5592bc8f9a3f7c3f37ead8e58a9e441173314a565aa5ea12cd69f
MD5 6e2f06ecf2a44f43e15f01a7d5771bb0
SHA1 f8f50557dfe0524d148f1946ad39484f4160b285
SHA512 67ec997b8c4762de5f3c9e720ecd5543acbbf3d68dc41bd8aa24db8b1b725f84c171980b67524c94fb4cce80f14dcfb3a3f3fea75c9bf8c5d00fa35e2152d3fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2mT:A3k03kHRJi56r9
TLSH
T181256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 70ee0eb3c29da997298028ab34201326c8cd9a63d3e7c6c8039dd2c5afb0d949
MD5 f7ccd4e1d7fd7805e55a9e9aea80b9ef
SHA1 a3e2f0b1779a3cdd6ea2f84db2e3030319c1956e
SHA512 540cfa81f620bcb85a403fe452459a8633259f5fe59e1ee586f726ba1f9e608c59c2c1e329f0f17b711222c7555fbcedac634f66f74db5f61a3bbe8a6a7c2267
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2eu:A3k03kHRJi56rC
TLSH
T134256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 cf0c3f8a80e6b1506b4e1ccd9169dd0019953c159ef3489678d072846b9bd326
MD5 2259265254d503289161cb31277fefe2
SHA1 176498087a84947edff0b4191368079ad21ad761
SHA512 79438514063ff9ad9a933acd59e067e0f4cfabe7df4d66b38248dbf5d8ae0f411f5d2debf3d1b7a704db1d59041b6c788c7f3b2cbc3db8c418be671b606abcbb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Yb:A3k03kHRJi56rz
TLSH
T108256A07A6890FA8D10FC1749A968662E6777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 c98a86afa4e76141fae76f85eb6db07f2a507fd781ed21f3d30b11bdecb73e41
MD5 a4a4dd996ada564a9b0e6e9483985417
SHA1 f7e2305d712a9eb877e20f4f0703232624696fbc
SHA512 a4c2817b3ea2cf1bab233129624bb6a3740e788bda5241b6df6dd7c9e244068e172f912fec7d1ff0956c65060f0ec3910c6c663536bd59b77f923293bbbe80e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Gf:A3k03kHRJi56rr
TLSH
T177256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 21139ab1d49978d4e065e6e46f7ed57b8bdd30e1f72d21c087993d3b80be3f39
MD5 1c2533a0687f19d14ea8e33ad530a1b4
SHA1 5243674b36391e9bbd0cde8cdabbc17ae5f30d0c
SHA512 6531269e8a2bef8e0827992f96646cda65cf333226b2e666dfd34431a4953430a4ea968c21e87e55177dcbd43858d7f37b935541fc84fbd3e5b207a66eeb4373
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2DK:A3k03kHRJi56rb
TLSH
T1D2256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 178b760e03b21953f82396dbadab0b356315f52ecd68484ca37f84a44b3339f1
MD5 e124f9edbdf2822cd14fbc735798453a
SHA1 d255c74009656a1573492ace1ea12f60ec5344fb
SHA512 b3e0ab3e42ce9f6398de2d85ec8a1c924f5f01f6fda1268f88177ba825a832799377d2e0b9cb1bef87abd6fe8018fbc0ecf5d4a674ee9ba3612acd322136ae2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2kk:A3k03kHRJi56rW
TLSH
T144256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 14a9ca7c77e7b75300df9a9b94185e0c0b05f24b8d07091db79e713da8c24938
MD5 693e15738b62c73f162d9cee04ec9ccb
SHA1 341c3b427b584e3f19c626cb6ff496f943299cbd
SHA512 f8484f35842395a5fdc1faf2d376bbc3f71040fbf45b653ef96a0eff4ee7488ff695e38bba0cfa7ad25e490357ded815c0ab2e9823436a3a24584139757a7a9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2t0:A3k03kHRJi56rr
TLSH
T199256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 ab083850e6dc374751fca3ee06dfe6fa7b4acf288a517f8e147e259423968e36
MD5 126ea102c8e3813355e7a93c224c4f96
SHA1 13e0dbbdccb9fdf58aac23552da254c121fa5641
SHA512 26ab3bea5528c6ef2dbe5f4653d5b7c5e3a48ee33da59d79b6199228f0f046dbaa8f8ea575e89a778448c20a1b8ee6fbbce60e0551c2234556c696a86615ad20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2wg:A3k03kHRJi56re
TLSH
T1E9256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 a8b51c4863707a51eb8959443847748953da40d7ed4114668a174933c5c86841
MD5 38b57caf8dd6cf06992ca18dcb30c2c1
SHA1 53c98c94987b1b241167566902c86e2cdea9e94f
SHA512 c5bcf875686351132bd4db54b7b03196358c6ac549904958035187ef30fbd848936961a3bfd65fe58859687222f7780225b8b6f6dad898e99b4976c79ce49728
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Fr:A3k03kHRJi56rg
TLSH
T1E9256A07A6890FA8D10FC1749A968662E6777C125F2093CF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 df223ae6265698615f3e15f3ffd34b82a32dbe2f49d5719363e6700f3be5b8ba
MD5 cec119b63bc3a53c53d26d5acf89acf1
SHA1 9eb59a9033028738c533b8b6cd357a4684297137
SHA512 84cc2c6b37cc6aeae2f8896c6b18e23965b09355bec3e2f54609d77afba4ec066bb86147c914957dfa825a3133468e368571727e89a391a52cf7f341c4d83f01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Pn:A3k03kHRJi56ry
TLSH
T198256A07A6890FA8D10FC1749A968662EA737C165F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 559afa8ca3b2e9544a8041a164bb62322f119cd8b1afd3f093bfee1b6cd55e3f
MD5 4fafe74637bab9d63a504ac9c9802232
SHA1 650f3a6756bfac74490cb1f95521f10a191d37e3
SHA512 255aafff4423ec0f5318107840e02285ea47d8f0b429d65f71cad5b4ed9397d63d8b06209ff0f400f85ef8783ddfd0c733aeef7e85c6e87217c9c649d2bedf37
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ27x:A3k03kHRJi56rA
TLSH
T193256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 36be6918515d4ae230644e6595d8675553469bee4f770b015024aa186cef806e
MD5 87e5c456c818855d47c9e890105d7b19
SHA1 fa63b3bed343779139525cb5bcd893653845a165
SHA512 867d6fc11b42fc1c2e1748e171015dd706be66910dd56ae48f3d729e1b1511372293c85b5e9620dbd4b1acc0d25499f25873f7d18a4a7bf4428707bd094ddfb3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2pA:A3k03kHRJi56rj
TLSH
T177256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 9826cd51afd11dc3a8ba01fc34c9caf702d6a6689da462ad865a9254eff5fcf6
MD5 429630aa13277d2739ac6cc52abffe6f
SHA1 4812d61880ac7d3652772fcd4abfba140ec830fa
SHA512 55b7002d9353cea5c1a965f00866bb55de3931c7c5c444b48a7ba30bf682ea5e51bf64922d10581c21e6f29f930ae9759da0a52fa19af25275e68b7292452d9d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2i9Q:A3k03kHRJi56ru
TLSH
T113256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 0b9ef4fdb3ceceb2aa4e5ebfe4e9e0379c96b028a26a337ec20b125682e1f148
MD5 7cf66e6f0819b72e470d683d105bc3b1
SHA1 dd0a34f9bf4c84f7b15f7128202f29a9f9462448
SHA512 0c1cf40ffade6da84f1b4b2f1f12a1ce9b2b0b6a419a64681686f951363c96e865d7946c82e35eca306137e90d71877130626f23d2a46923e594a637dc0eb271
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2H4:A3k03kHRJi56rN
TLSH
T183256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 ae6c6d7e74d58d8c9b4a3e0529561a4b48caf2c917bcc3cdff26ceccf4cedf26
MD5 d8fbce2b110b366a9442fa3b5a01c662
SHA1 10ae1e0570aab8abe6e2cf9688723485422dc49f
SHA512 03731f40c140bce62ae49eca7ac939e2a47b36a7f293228f05dab9cdbf05cb1593f73d6c80ecaad25d73bfb25d53c06c28798d252dacf537e41183c0b0167165
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2mu:A3k03kHRJi56ro
TLSH
T17B256A07A6890FA8D10FC1749A968662E6777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 0b7ab19bacaac0c125dcb4b1e5bac59efb966de5023dae5846f505ad27b2c74e
MD5 bd89b0666fa8ec571f0b3d47036fa9f0
SHA1 c47ac6f3b3ebe7f9632f387e617649a905358441
SHA512 9b78eaafb367047f2686a24d0731362e8072660208d102bd17e453da79a11947a903c2248882abc00f6022c12d0a33ca47adccd59e6275b9f0f58602bb84ccc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Xj:A3k03kHRJi56ri
TLSH
T128256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 dcbc433e7608530172f4d51d6066add60f8405a5a4f8a60be81de51a45c6edc2
MD5 2c739acfe24453e5cea764ecda9b6bd2
SHA1 b338e78275d22bab484ffe5fda944263a9a2a536
SHA512 93f43f7531e77113e255c792a7a6ff930809c8976449fc856fdc21f6d7f49965f103f33c792f53ed5427bce7067c6d3439bd74add4821f02dbcc3c073757bef3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2Cg:A3k03kHRJi56rm
TLSH
T16E256A07A6890FA8D10FC1749A968662EA737C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 7992fc7b3eac7588b11516bdc8abc7dac36cccd8f7a59ee21c05f3c46e99a972
MD5 f62405078daefe5380a65052571acc4e
SHA1 e443959ed0f18b315e433871aef05ce3517c2e22
SHA512 fad4ea1ffb7395b3f91130c318cba1b872ddd713efbe8fd6470fc3d1368a612a63d65de04a51b02265458a807cd8bfc8bd48fdb6efe597e4d8788b0268b0e356
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ29I:A3k03kHRJi56rv
TLSH
T1E3256A07A6890FA8D10FC1749A968662E6777C125F2093CF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 a8444bbd9e93b05d8ba4c3e43b7655da1e2edfcc97ec0f895ce5adaf5b87511f
MD5 f25bdb085c355989e080e3d1a0754b20
SHA1 5e148933ce4c5480c356070222399fbcd6a1ece5
SHA512 2a895a8d58fa920f1db3b87fe5653bba691622d5b5e09d4617b02d2706c1a0da46fb0d4e248e78dc4925b52bb6d50f2b13435397a9c12f92aa1365bae74d024b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2vo:A3k03kHRJi56rZ
TLSH
T113256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 4d42547878d2b033225c0811d970aa82ffc0d1056af34c1b89f7b4257538b1c6
MD5 2e42bf87d87ee2253bab062396c2be4d
SHA1 00707383c1483f134fc8d58c3de2521b55f17ed0
SHA512 2f4b107d4a8e70822e46e90cd278e176ef25e3adcad5c55c3492391446f8740697384d8da3ddc17fece1b559f4d8663b116291daf661ad6581f20c4386b31c70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ20+:A3k03kHRJi56rc
TLSH
T1B0256A07A6890FA8D10FC1749A968662E6777C125F2093CF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 f8d0b26f158ad703e70109fa072531d2b734a190a66a730e6ca259fbce3ed879
MD5 9ca4cdb839ab2d67e155063143eca738
SHA1 76682a5538d18319242cd0771e2b0f3154ede81a
SHA512 d868630d229da4f48e4f2576b402ddec869377d0ed1584c11b3fa6fdf7320a7e75eb77ec9d23bef8d8ba1df9e33830d98802c0f06884a295d09e5bdab48678b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ28Q:A3k03kHRJi56r0
TLSH
T138256A07A6890FA8D10FC1749A968662E6777C125F2093CF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 6291d4cc041b38a917f741b091dd20b6368518150e682155f7714ba2920a1cca
MD5 52c42ae6bf0aee9589558032e861d497
SHA1 30181044932e120bd43bede7a413e10d8f6e1382
SHA512 860faf10d1f9adbfb028ea1e4f9320f0bc283236630a054a128c62048a217839c9802a65525bd3e8120cb04dd827a7f581b4297adadb6f3d44384328be9c3ddb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2lX:A3k03kHRJi56r0
TLSH
T1F7256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 1c488f6baabd25b9dd6b4b2ea36bf9654e3040b03d1d67eadccb38d3b3d7c02b
MD5 19dde4d227dfb2aedcfd39188a217b77
SHA1 c1531473fcba2b0d79df66d1d3f7bf7b7f78fc9a
SHA512 975de441ac9cb551b529f618e1e9d0ae838c266ced0dcb1322a2ec354dee0d35db63f8ece8406acaa36170d104e2fdcb3af8a007fd0747e5a5ec15f71abb8c15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2HL:A3k03kHRJi56rO
TLSH
T1DD256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 e6598a5ed8e2203d7233ad2f33387e3c46a14cda1a865e7b540e4d60e033013a
MD5 cd1ce407e9e3598c44cadce43c244bbf
SHA1 06c4f6b4857d6f3cb74c50ed4bb7c7f56696aa76
SHA512 3399a95eee3ee4ec8379c089781311ab72361ac30ee6ee441aaa0b12efb5c985239809003982acaae057138aa46605e9bd08523fc8a907b1da4668b9c7c26443
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ29M:A3k03kHRJi56r7
TLSH
T1E5256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 1b8266d6cd2c78697bcdd0542641ad1df519751ccf454fbfaf442c2130c73ac8
MD5 01f143292d8237ff7dfe831547176263
SHA1 e4a233ae18a9847360e71d579540b2695eb965c2
SHA512 f1bae4f6e63c4980808512585110ce6c15723280285d681e20be6923c69f5d404d2e6d1ba00973c9772b7583e4d8e648d65a31b8d7ba9bf50878410a7324a941
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2uh:A3k03kHRJi56r1
TLSH
T15D256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3704-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3704-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5840-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads