39648c87167b7e007f3caee45f7ba68bc61ef03704ef0bf2283a1e79560e764d

Analysis

max time kernel
96s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260714-sdadkahy4x
SHA256 39648c87167b7e007f3caee45f7ba68bc61ef03704ef0bf2283a1e79560e764d
MD5 1dbcda6333cacb92fea41e7965e2e4f1
SHA1 04eeae2fadf8b230fbc0e01ef17af546df61db39
SHA512 7cc003484167246aff4c7b40302a65e9b310bd1ecbe3528d1e8f0f7f450e8d6bc84d1445da69587d00b467108678144194ae4da8a1d1dfdacb70bbe6f6d95c3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylF:A3k03kB56ri
TLSH
T104157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3920-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3920-106-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4324-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-698.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1072.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4e3-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-259.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-440.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-574.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-617.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-698.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-735.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-784.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-821.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-852.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-883.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-903.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-923.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-949.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-980.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1072.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1121.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1146.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1171.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1179.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1217.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1326.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1390.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4324	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3920	2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
4324	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_1dbcda6333cacb92fea41e7965e2e4f1_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3920

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 39648c87167b7e007f3caee45f7ba68bc61ef03704ef0bf2283a1e79560e764d
MD5 1dbcda6333cacb92fea41e7965e2e4f1
SHA1 04eeae2fadf8b230fbc0e01ef17af546df61db39
SHA512 7cc003484167246aff4c7b40302a65e9b310bd1ecbe3528d1e8f0f7f450e8d6bc84d1445da69587d00b467108678144194ae4da8a1d1dfdacb70bbe6f6d95c3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylF:A3k03kB56ri
TLSH
T104157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 349db3d07d2eff701c32ed556b5734d931209cea41fa93a1d97232c36199aeaa
MD5 8c7355d9af35c75f9b5dc871b881fe51
SHA1 34139519d8984a636f8bd3b07fc409d9e8a3e1f8
SHA512 89e2aed37c578af3e4561cfcd5d029221cbd1a45344377f995f704f86be740dcfc18ccd1fc292431bdac54bc6917b795b707a5719828adeb6c267e9298e8310c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylB0Le5ji0hmxNrM:A3k03kB56riPji0Aj
TLSH
T1D0656B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 3693d8501c275815db95ef547f7080023706b92bd4d967bdd6775ecb85c5321c
MD5 d65b5d3fcc87ab0d720a97ee8631c110
SHA1 36389c491138a208e7a2e0bfda7b037bd78d17b8
SHA512 8c82286b181987f6880980b3eec56aeccc55fcb76ab6f52fb800da3bb35bd67a8c2a0fb9649bae9dc0ace6acceff4505f5fa91e4f30ffacb306284776cfe8bc1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylDa:A3k03kB56r
TLSH
T1C1257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 4262acb1efc3cd6f28c6ff616aa404b0c9428c5da90729b7edb8d0e904aaffd0
MD5 b175ed7e813d849c3d3946cd78b2ec38
SHA1 af4413559ad57b7b4adf691309b511cf2957a801
SHA512 6bbd0ffe537e63560e320e018c187f2a3a95b62eb7cf635c5663a972083f5feb611a5ca9b2c0f218ea419d5e00d287dae6441d0ca2cad18b1f8855f7486ea8cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyli6:A3k03kB56rM
TLSH
T150258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 74388517b437e5c698019e289acc185acb12e7961704085526b887eec349b12b
MD5 065d78e3c6ca9062f0244b23b6c186a6
SHA1 4a417f38b933ea0e3756cbbf61380ce9b96eb504
SHA512 34eb4721f2d9d5accb412ddfb7eca226d2b6ba840dc53a500071d3c849de5d8eda1bd580907891bc7698843f45d4ac9cbbed21279870f9b6b85734efe7ecca61
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyl6N:A3k03kB56rx
TLSH
T129258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 d3005913581f2f1d50f6deb534c737b04b7ecf1144db9a7ef86e77fdd6809ca4
MD5 16c7659b8b5adb41d146e1a7deb64379
SHA1 98731cd53d632c9e2cf1f889a8bc14fd5ed08ec3
SHA512 e3dc04f8676835e399b22c0c097e3894f750ace62d50d6d5dd8ccc75135d64d932117c928203dbf4151efa2800365dd04a6a89dd77bfe120c9ba0ec66650765e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylgf:A3k03kB56rx
TLSH
T1E8258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 06db0ef68ed7b1bfd9dd11e44ee240a742778638e3e98147105c3786088e1067
MD5 0f1e9f8034d7d50a3b72f934f178e55b
SHA1 0269938506ee8e6a2d882f0f0fa1a81713cbd97c
SHA512 3682275c6abc9c60da2ef86fc687a1772abb78721cf4bf64b060310a4d7b707b8cf69cfea3a6a4a5bf7554ffeac309dd2aacfb9b0a806a1c5c2826bc8ece0db3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyl6o:A3k03kB56rE
TLSH
T1D0258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 bfa32a548704e003f67e6725c850bd8b95f48cdd0161c06f5dbd223bfbe83114
MD5 16fcea9500c7028610173dfb7471c42e
SHA1 9b2b584f4e3b51d096163bd588baa9bd31aad758
SHA512 c781c0e010d621b452a906591f153105583a606d69cb37ea066a01e793d07f5b780fa7f26e37fd9dbf3ea459504957ed5c33281134782a8ddc7e64062884c155
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylOu:A3k03kB56r2
TLSH
T1AE258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 2c01dcc58a6164256c76f07f5a68369ba40f897da0bb9862e66d91116e7191db
MD5 6ae5bd87033055f3903520dea6ab2391
SHA1 ca5b71a99f297219b27a1351068da7eb4cb56db8
SHA512 97d6d4d32e98b3f6e157ac26b543f2cd21cae9c3026131adf9205f7ca8f42c2105c9bda957481dfd92f514a721dd962f17b6e2ba625a19202309fbbb45e0e7d5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylC9:A3k03kB56rX
TLSH
T15E257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 88fe5c10d6916b6b7d696bc47c53cbff52ddfb4b418294957f7090274b5bb433
MD5 b72d89fcab14ec61fa07c1c3360db0ff
SHA1 b24067893c5158b67b93adf0320cf21204538184
SHA512 d84762b58cf77bfd696f20e01c4f5c029e89110abfd8781b406c9018fd69dc975ffbca81b578287d606733698e19b1363d735e9ac0b4c069b6363a2e9a78c43d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylCc:A3k03kB56rm
TLSH
T1F2257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 0b8de535efac93d772138d81df1450a5c2c309b87c4d5c655290177cc4bb4dd2
MD5 e4b208fc8d04657f287a90833a5f4ac5
SHA1 446d0293a01dc1542cfd59acb4b820848d9f1808
SHA512 764ac0d15df976bf8e31dce0d5253f82255fd283f737e2ca776e6cb12c7f41fee1188e92c8a78241966b0c6d81a3c5a16b999c6804001a50cac37595e1e3866c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylLp:A3k03kB56r0
TLSH
T16E258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 4dd81e8ced77ae0b813117dc372759209e08e39803d64a5485b75f86b6ae8676
MD5 97317e08e43fc8ea960e0b469fc686ad
SHA1 4e9471895c348548e60c017db0cd6cbbb976e800
SHA512 94859440d48e551b9522a8926929d191aa32313383364c59d5bac2c49f5929e39dd0284378eda612ff92abe8e245dc8920a03edcdd42e8a759da32313f2577bb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylcN:A3k03kB56rD
TLSH
T1F5258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 b0759f66749aeb58c53e16ed2ee8740fc046269776a0d91aa5fb8d7915ec5280
MD5 1f26c1816def1f39a3b18dc7beb8591a
SHA1 f066d7bf59483bd51d0b4faf2041ebd2ca5c8e6f
SHA512 a1df728285a1dadb71f05479ecbb01a25c0f31c3b5807fbca4a98eb5b9b945cc5e574e8c835bf8894ca417624d50b495d325212551b801133d073fdcacfb0b5c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylEF:A3k03kB56rV
TLSH
T1F3257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 60821e241cbe52fd9f4d0433fe11ac47c8e48cd7b3d34c207b9ce6df5963224f
MD5 dd831353399ec7392196a1a5215ef99a
SHA1 d6353023ad21607087952b822d3fef9dafe0ff95
SHA512 440916e764c31c1169782ea701884c35c863e781f1066bde9ad135e857ffe2fcb676aa065e1438d8aa853131684e905e0895572471c9c7c792d3bbca085b8d58
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylhC:A3k03kB56r5
TLSH
T196257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 49d14b64e0e966790e49a42c4eb4e14982d645577a2d94e103dbf676946ed966
MD5 18db62c7be10b7d947bb7f6a9bb8dde9
SHA1 2ced723cfdb7c036018b2b16a3e77d931e4cb869
SHA512 be689bd13f18d785a199d5f6325bce7d57e2ae3e45574080005cad01f667647a48c860715e8ec746d5222702f7e3ac6de008a4ef1de83d3773bb6aefeb3a66f8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyliw:A3k03kB56rk
TLSH
T12D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 3ea9f7acf46300e61e25f34879059b5aef40d8c4e46b27c278d5c0cb59f4ed55
MD5 4b2f8375579b1bce4bfb15a77f3c5711
SHA1 2e4f464b1694501bd307f35f49f1b88501a3ec71
SHA512 9b24c100f9fca730bc96757d2dd860794a7bcb15ba3832d8bd64d30b540343274c6998bd94cc5428fd0083c9c9d69f1652c8b84b5a59162fa5762b3fecbcb813
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylpT:A3k03kB56rM
TLSH
T12C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 ca2c6fc500fda28a85d4816c11cb96484be03d9b06bab1c7805266f72a7f1cc1
MD5 543daf00be58b965ba27b6df8b3d70a4
SHA1 7f1ee99b3cae38dc05baa8ced39ec9bd3a73f758
SHA512 28033c583365fac8b9374c55f9b77c6bff6ef35fefb87dd381d8c97d74febdbb8d17ab0d04a26a12dc74384102887b229bdc3ea0b2279b02be7560478aa9bb49
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylHu:A3k03kB56rr
TLSH
T16D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 4b2d8e6c51aab480a08a5c0dc4dddf48bdc54a2414cad19806bd243b6a89b4d2
MD5 37c7bfdc8c4611fe193b34c14792ddab
SHA1 efbe895c1c3f103a155aa1af414bfe709de2cae3
SHA512 9c6122992e78d8a3aa7a230c5e85c8caaf4e1d0a19891eaa538adc808790968f9157734c72303470df8cdf769a5be46224b8e86ec8ffad047eb592e17d8d005a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylbb:A3k03kB56rC
TLSH
T12E257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 bfc8cb4d33796f4208f2c29b881e587aa54eb06fff0ece897a0f171e96771270
MD5 0d9ad6b3b3ccc648f34c9c19b06502d5
SHA1 2f7447621795665ab274ce91b0ce9ce23bc769e9
SHA512 68ff8a10b8ef541a7aeab61024ae9a04f8f70dd3d4781ecb348c05459f817399edded73ef30af3ab62dcafe1cf2e319e8e60c2b1dcc8dafe7cf86fe1c2ce561c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylvf:A3k03kB56ri
TLSH
T13B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 05ef24b8fa30650a2d2e132000310c21014b27dff737ac32fcd550d0b28c73ed
MD5 8f01ef65087ea707bf87cd457cedb035
SHA1 c6922df869431bf2d01447d9b90b0c37d5b5bb2e
SHA512 9475422d50bf6b1f87e1eb3d54081fd7fa10838897215fdf70a46353f1e8857eb342625074ad4473ad31dc0221bc8aa36dce58ba94371f671658c39b8b185d80
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyl4K:A3k03kB56rC
TLSH
T186258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 d03c15bad497ed4612c84e9635b962d439a4f431225540461049ffbde85fcbdd
MD5 f01c762447482622f1e87a6cac2dd215
SHA1 a9e71a1b3f05bbad60560d6c7cef7fa4202d4a76
SHA512 22f33fadd99b63276d90f5e0abee38b9fd018ee47959f5f1727feac7425cf84e1536e7fa7b405a20fc663f7f8780287319045f42c0e92ccceefa24367a1e5e46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyllk:A3k03kB56rX
TLSH
T154257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 a5bafc31173b6de73719132219c8076dcb459c376b5c0eb7280b33121eb8a96e
MD5 00152be36e3ffe25f4557b7d69ec8991
SHA1 fda88c5fcc58ec74100c0ed22f8909693c8171af
SHA512 32eb9db2d152ba37c1e1fb06474023237bdc7f4c9897c220614098e4c6450b374f78e738ee8db11f7552224042bd70b0edd26d7868291cc38c94d5f5bf794217
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyl60:A3k03kB56r2
TLSH
T10D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 8bc73f46a78aed76b1a5a2e10d88e1a56778bb3b42fd927d5b3e92bd7084964a
MD5 26c354f6f8e04a5d12ff07728001b8db
SHA1 33572d55688f8f1d4521f752ad0a66d89f35e640
SHA512 590170dbf557f43ffbbc6de0a67587cdf3d95b65dc5b34090a68b9d4dd479b5dfc43578d18bb87467887cd69f6fbe10f291bdb25db05e84978bf549ce2f81572
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylpg:A3k03kB56rP
TLSH
T107257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 477cdf24c18b740d521344058a38af987f7f8f4a028b16078952a2afc26405c5
MD5 55581737c8b87cacb5cd93fa5c12f07d
SHA1 27fb73616ef0201379256c929c0220de8a5f82a6
SHA512 fdd39a2c4ef9620221ee01600f158028ac5c799782a63dda04a8bbb7aaf7050fcaeeee813177c6c764f59a22c4bf590b5e68bebcb1f9aefe4dfff93cd69c145a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylQr:A3k03kB56rp
TLSH
T180258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 9f8d33a2d99f5f11cddd1722a0e5af720f98f38796fb68735b52149083b87b6c
MD5 52bd5036d2e059e4c773f53632ac5a07
SHA1 58ff4104845bddeefa6e4c58176f434aec370874
SHA512 e6d9461717de6f495593f8b8933efb5032b874f7c18aa17b18922763e10249c5273db2fa798dd3db454475c9acd066741973c0e9d80f8fe71780c29460662f9a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylOn:A3k03kB56rD
TLSH
T124258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 509af67fc0dde4e00c1890a0fa2526b6096d18bba278a70e509685167c22297a
MD5 fd268c586fbfe7c711ce24c476799883
SHA1 a0cc6e3fcf03d88a79dee1813c384c408fafa46b
SHA512 8f9e555527ea50026a7bed9c778d2f926626d6f94337308a8a40170173c76554fe0e6d7d66e13bef8d742b0476940efa45e1e9d7a0b5e5e6b1dd36c03d6c051a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylEx:A3k03kB56rh
TLSH
T196258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 115da16dcd0ede44cdf507f7aa977ccbf7658aa20503f9059eca286626643a90
MD5 c5812ec6ba5a124570abc9c8da530bb1
SHA1 300b8d2a2c0bb35fa4b578a21870484eb3507c58
SHA512 81bc34e8f606981678e13bfd9750c459b50768bccb7b08a021c755c42d437249b357dccc15843973d80e256d1a2a7bc5d95d1e4cab9e7bd15a2b9b48c822d49d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylOA:A3k03kB56rO
TLSH
T1DD257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 e5f16f0837484200869357c66b11f93fc94375c2ef2373e0b19752f4ab1a903c
MD5 cfc9080c64dc31d1be02d189b81f2293
SHA1 d77e01d2255bd71eeb68b16458502c16ae148dbf
SHA512 062cdb67d1cfd7e866e9b5a10fa31b25f2bba55053f3b299c2a649f404466a5fa83f2d56d344744c4082eec8d74e24bcfa96676c10826abc248cf7dd55cc5330
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylH9Q:A3k03kB56rT
TLSH
T17B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 bc6ff85c0df9e103224fd10f39f6b793e8126347d3e7a1ec04fab576cb780973
MD5 968e793cee31b9834c7c215c8856e0fb
SHA1 bf3cb8cb94df077d184753ed7d5e893e56e4ba71
SHA512 ab9bcaae261c28b2870c09b8ae91488472a729b983a8654cf1b11315d07403f52963013ecf0c3f7d51b272b2651d9b04453f63711a12c5ce259f295ff204b81d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylO4:A3k03kB56rU
TLSH
T1B8258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 bee900d7df7f022678156fc12fbcd273f66acb8b2f4e4ea8a5d3b601954d1127
MD5 b7f282470aa41157a9139759b20430ac
SHA1 ebe64eee943740784e7df5d9adc4ecf63594448d
SHA512 369fe99fc46221d04f9b700507874947f6c61e7ffd907a9c9eba52521962687f2cb0b2c93f0667dce0a8c10e5eebbdec774a3021c4c65a8d3a4932687f658aa8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iyltu:A3k03kB56rF
TLSH
T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 fe8765364c7d709cf632949aca4c369f436133a9e46b6682faf7e3dc5dbe840e
MD5 54368bf7b42a6c726b3266cd189df19d
SHA1 e20e3f2d00c1c2e822d8474ad58536e455114b8d
SHA512 9eb24db6147180c254a3ebf741a7133d1d8b62de20f32baaf837b3ea7b9d82e3a860610478fb7e213021374e12f71b3fe51fd88cfae87dbc08a6a079176b36f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylgj:A3k03kB56rH
TLSH
T163258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 caa99b01f16904cb7e1a7730f77f63e11a972cadb9a713936d6a5cef18b9fbfb
MD5 d90d4796e73a57a260b3c3c151bea615
SHA1 12453b3a5e8dc61c997140ad5227af37af918d3e
SHA512 87b5c046d2a846877ee174563eb80fdc173c05c5374974f1f60a933079fb97113fea5c4f83716c42ab05e74f99a8afc506b2b015160bbaa78ffe23d9a7176d64
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylRg:A3k03kB56rv
TLSH
T16C258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 8b0fd1663cd90b1bf33134cc0caaf15e87ed5b2427084c9b5ca5c6ade293a62f
MD5 46255d1dfdd60502ec2b95ab6ad0c102
SHA1 0803b71baa290d75652fe6c1a0dbb3b622550e80
SHA512 10ffaa006188d6a0bd2ab039e1939be421aaef55038c5f854843f757dc53bfdac006a66e38c26108435d8947d0f57a2d6d28b0a7c197f89d45195db6d83e7395
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylII:A3k03kB56r+
TLSH
T135257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 3e03f4ac40367703ab2ef68e86f6b86285bcaaf99d89da311f2918fb9fd02c0b
MD5 210852a01eee286f37ae3cf40ff2baef
SHA1 2ca67ba50808514e5599048d129ca82a3bf12a4c
SHA512 2968d660b64ddd24e7ae7237c0859dbfac477ab799a867cfc0eae60df0ebe81f524d9b660071475742984b2d7947295b3ea9611d9d8a59049a2ea6e92cba37ff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylqo:A3k03kB56r8
TLSH
T130257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 785722c4dc21b8d7517b2d6aa8c6db0ccf82faea4e652aa66f438bc86c92828a
MD5 69a0c83c975052f7fa71aa4d9caacfcd
SHA1 8738b4584b9a42fceb1cc0863c061ea2dff55c5d
SHA512 0d687c19a981d82c0c28a66c3ebad56a68d3f683c92868edad72717300fdba7b8f78e588ab927ebeba7ef301ca6df864e23e35e35e09f8d9a25588ce0fc86e9e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylB+:A3k03kB56rx
TLSH
T12F257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 5b7aca00f7fd56cbaabaf314551756a7e392a49a5d088367cc9ff574c8d58318
MD5 9e40f8681de86b1e7beb47a9e9cbbd6d
SHA1 1960bf67ef38ac0fdf1f260e686a5c3ceb0cd70f
SHA512 0b1d8e37d2ed11edf17e249a7ba7d35a4e5480ab5012b277399f14338b1653267d897c16fbfac96f4364a785822b4e7b866c75935e5cf2b9e080ba191f6a35bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylPQ:A3k03kB56rx
TLSH
T1E0257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 2abf65306923f2eb6e66849c289db42f5974d19f650b487d6a7f8ac42adedd86
MD5 eb8c0804e44301fad39d7522bc4932f9
SHA1 0aa70534bbbec891dc25bf57d617d13614b14178
SHA512 292a288876cf2c05cab85461151a0b635919b58eaf4692b8fe0bcbec1c16e73d4e47469cfeb4a99e780d285166692ea3404edaac0d79135c85dd2a5f2e81eec0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylUX:A3k03kB56r9
TLSH
T128257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 45a73ef84307dab7e4fb47b89b45b3cb079ba9c5daf2aab9ff046cc58552db79
MD5 34131a187a0441dcc139d5f39d9f1dfb
SHA1 e4481574d6ca25e60259af6c71973288f0149410
SHA512 cb8313fb891fe449ea83fd60bfcd831bd899c7260a365e1583e394c545d31fa0b4adf9a2d718b151b48027fe179812288d3332bb9668ec3ce2ed3cec577dc031
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylyL:A3k03kB56r/
TLSH
T12A258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 bbf938e71c0e8db266c96e1e3c907cfc8ed9aa3ddfebe31bec9e7ae70c9c409b
MD5 87433462e07e446d4a19cd387c824197
SHA1 e8adf04868c1ce2a7b0e81e764399073c64a8efd
SHA512 93ccab1dbaba1b1c9fe7904b68449a0f4bcd305f30a3d848a821af3aad52b8f8b1b060270cc96e77f6430cb2b2e81c7c6d8cd7ee4f2bb45d431a6446927b04f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylWM:A3k03kB56rK
TLSH
T1CE257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 98db7af8e70d2eeedb6943f48499155928874fea52f1470d1dfd6f0a2cc58b8d
MD5 64ae36713ff8a5fe5d2b49bb696a7b21
SHA1 f0e7ef1227bbc4600c3ce1bac66376877098440e
SHA512 7f6c062b0dbfec883b2fc2029bd9f94aeeb0f53f2cdfe4624ae442ad343ba4f83ed706c6253f831d9eed27208e22b957743d4f6d143e2bffacc2e9ebc99c6560
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iylfh:A3k03kB56rE
TLSH
T13E258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3920-106-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3920-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4324-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads