c339ce947290ab05b3339e4d2b5d53ffdb0df180927bff9f4a872d73bcb9e355

Analysis

max time kernel
101s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260720-tafxlsg121
SHA256 c339ce947290ab05b3339e4d2b5d53ffdb0df180927bff9f4a872d73bcb9e355
MD5 72f036cc14f4488ff9bb3b69c3bdf039
SHA1 7a153304c6dd60a95fe94958a04047f04e455214
SHA512 7644d31e742cf4d89543b8732881351d701785f0f957113757b05d2d2cf9f42c23ff6e8aee156969c0521d323b13800290dd18790ac3a8ce1a619037bdd852aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2u:A3k03kB56rs
TLSH
T1EB157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4900-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c4fb-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4900-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5224-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb3e-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-668.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-848.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001000000001c4fb-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-224.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb3e-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-668.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-848.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1333.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1358.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1380.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5224	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4900	2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
5224	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_72f036cc14f4488ff9bb3b69c3bdf039_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4900

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 c339ce947290ab05b3339e4d2b5d53ffdb0df180927bff9f4a872d73bcb9e355
MD5 72f036cc14f4488ff9bb3b69c3bdf039
SHA1 7a153304c6dd60a95fe94958a04047f04e455214
SHA512 7644d31e742cf4d89543b8732881351d701785f0f957113757b05d2d2cf9f42c23ff6e8aee156969c0521d323b13800290dd18790ac3a8ce1a619037bdd852aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2u:A3k03kB56rs
TLSH
T1EB157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5c8f844811d69adf781b0f393bf85b55ee45d4a0926d7daf7f1c28be5d235209
MD5 71f21b014c30fcfc9b969ad57cb4d98b
SHA1 ab07c44a6a58ae1c11a5010728e045e36bcae77a
SHA512 c40698cb4af12e8c13824b9c078d702c343974534eb62918071264b2cd2e89cc19f629019dbc1ca5459fa2b38dc3ade58d57e5943bff0217bd55dcba67401357
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2e0Le5ji0hmxNrM:A3k03kB56r0Pji0Aj
TLSH
T10F655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 aaf1a978d0386d4ca0694f887d597846b49a1e0abad2010f9cc63e23ce6eda62
MD5 83e5f18e5052d256254db3451e44605b
SHA1 e914595098027751d53ab2c46a36389cb438ad99
SHA512 b8d55e6ceefae23b9358d5741861de6352d3aa7dc67268224b33082bf0ce5a6f9665f1bbc62d6ff49bc33340b79b13edf4e63c89b031b41262e1310678e6abb5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Ya:A3k03kB56r
TLSH
T106257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 69a9b60408297b40c7a6617e71c5d751121672a073b800ea5178fc3e4a4b3fe5
MD5 35043eb2e61c7a0f07d050f3eb330588
SHA1 cc3f3ee408e58fa7777e7fd90852da3c7db8f8ad
SHA512 fe604029482ca4345ca24ca196245e6a29bc85922156d28f20595bfabca1c40d9896a9b1564a44baee1a792103c37490dbec9ef3fd47d2c3c5c2e89bc03c2537
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2x6:A3k03kB56ri
TLSH
T104257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 8fd610898beb389fc61bbd9e57115bee914e0794cafd2c823390e45694101deb
MD5 35cf11bfb19f5addad3b37f23fc9d883
SHA1 30cac26db1b0b64eaeaf24f2fec1c69a0ea5db4d
SHA512 433973835035e21f2e885711925e699b7b09454ab5ac9ff2eb0138c9bf7b077a1b39d45ba24a7903b4607978388f8176ac586f3cd2372926fad75489a0b36585
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2vN:A3k03kB56rL
TLSH
T1D7258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 c3590a5f0e578e77890e92f2f9bf4034070b90351dea973c3fb1ae6cae90ca8c
MD5 ea8f4d056ad8ae85d6ebb638c93c11c5
SHA1 14e329f3cb1a21453aaa393f4860899f34463117
SHA512 435ecdd5d61c9161dff5932b0d8c066026782948dca841ab912f53045a8762fe2cd5d149da5e5a95bc3a8d2a00bcccb08916b9fef89bfd9020288fa36197be3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Vf:A3k03kB56rP
TLSH
T15C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 e67ff734c2e93ba9b3e102c2ddb02a56b4bdbd3300ddc5e5664344197f762745
MD5 78792bcd104e4ccd1bd772fe4861711c
SHA1 540586bd909fff8d1d24d3bb9bb03d0f13fde630
SHA512 dbed135d4800088c47b469ef6263ef704393b3d546eab570af3b6297b2063ab17e47615e491747ca2eca394ec6f7a022397f4c49d43d17bfde5eb2648039b050
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Xo:A3k03kB56rG
TLSH
T1A0258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 2c54b9fcb06c1fb5d6349a77c50578d149d2e7bd41020ff9689ea936cb05a6b5
MD5 a7abc43a3ef8a9052d3376e74edfa6e0
SHA1 f97dd834d23b050bf3574f628b79f312fd26a941
SHA512 d0344f322f68b1547b698f3fca2b677f9191c9b0f5b5d0b7788a5359db53573ec824136e1d676810e26bfd0abcf398a4c83f39343a8aa13415eee0b308704b4c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2bu:A3k03kB56rQ
TLSH
T1FA258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 e71898c7446f614e0e936d95ad9f01ba9fef5a6979a7afa3bf62afe405eeb355
MD5 28088983ceca6fac1c2ba42a8858b27c
SHA1 bbaeaa3bb4dc85ae345a64635a9b0c0652d66cf0
SHA512 c41099d25b21f5b7e9d13d983e2e010399168767de52764526416e5ce2047a34237f69fc5defd59e256cdd33ec93351ec753fd2173f86582a7272b3f4d624957
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2J9:A3k03kB56rl
TLSH
T193257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 5d7e58c62eea5b81c2fa74a10d710967f5683a6d73e8fdc33eae84e9f93b4d10
MD5 af06b32c5bfba40924c961ef3cf1f03e
SHA1 f13459a07871c154b81284eae52dce373eae1fd3
SHA512 0d2dcffdd118f47437168627e24f90f91d10e374e0ec1111be051c7e0ba0896f9c9dc61ba81f929e2962f59ab42d8baa3c9fb2e82c4a0061501dd30171060298
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2lc:A3k03kB56rg
TLSH
T187257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 62628cde81b6cc3cd7da626ac9473270495110b87d2c267ead973889be8a3a48
MD5 cd56742e872ad3307382559821741bc6
SHA1 bfec0581630157bb8f11e09b2a1484ac037f35db
SHA512 8c3dfe2746f819e107d4f64f460695fb1b2d55ea8b87e033e92819a6e5dfa362f6d8f17f818d0eed2cb3a8b1a1bf22cf24d2c052735a499e5b881a53e789e14f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2ep:A3k03kB56r2
TLSH
T122257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 8ddb8e2d2b1c813424dc8fd1997069a0f51037d05bdba82dc9a14b3b55d9ff8b
MD5 4b477553c24ba9ef99293d56bdfb9432
SHA1 c40f91de3a1cbd82311666eadbe2953f2f110cda
SHA512 8087366cda3722b97f0c8d9c3793d88bb30ec8ebf9e5124624f4bdb816b1111b2e0c570e11fdf6bec70f102f0949752a634255cc0a6828224c6aba5d5c6b8b81
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2RN:A3k03kB56r5
TLSH
T1C6258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 3b514f50ab53f9747fa9f3ac06542666c9a98110810d72d6e06fa85c5280ca92
MD5 fc931fb6befb0242809a4ac636d78212
SHA1 5f33255acf8857051865c479717e2c959bec918f
SHA512 1659717227549180d265fed0eb8a4d809164ce6be43714d0491d86f764ad02c6c79ff27295fe3adfc971b2d13a6a91374a966835b8a870ec4e539d088e112e4b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2zF:A3k03kB56rr
TLSH
T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 d5d01da1289edf9ce5c14157f2d0b1cabf336cf729f07f9d5dc979c31f4f1baf
MD5 3cbcbb23dd338fe97a51fdd9c926017e
SHA1 dad2488d4335e9aa56d56e9455752d64f2715a97
SHA512 8e552976798da89555fbd29f8063223c63ca53a85ce587575f881e79888974c8acbf52c1d407a9bede473097baa7858ddcd5487992fe8ec50bbe75f2adf51ec9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2cC:A3k03kB56rH
TLSH
T153257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 187e78cdfefdc9bb9562ca9ead101692fe2ccef43d9022b391e2eba377407431
MD5 2ee8107abf90973a69f8b7525aff5cf4
SHA1 4ac44bec7fba140bd06b4d84d946732b2a197b8c
SHA512 88ac6c700b8a680a0aa447ce538b0f3577d5003edc922f2507c884ee723a5440c176900d6d71c4579f9b39ec0c0bc4e95954a767676204feea25869eb35ee2e1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc23w:A3k03kB56ri
TLSH
T106257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 b02fe8761d909940374a745425b484233ae8250a53def01caa1c9c315863a7cd
MD5 ab65d4aa3376276076e2bb23cb2b910c
SHA1 e748232a86114ad048ec35f499022908a013f1fa
SHA512 cc09a3311400b2eb3c71fc5e99bc78de1514ab92805e551e49e30e323607eef7b61173ab22b1d359a701ef6abf35406219a298c7255b7b40dd427fa84ce672b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2mT:A3k03kB56rS
TLSH
T167257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 d7e8a16085e40c3fafadec39552767f0264fa0fbc7263b5f2dd6bd4d61aa901a
MD5 6c421c6b91d8b232c2e01b422e12784c
SHA1 d3470cf835e2159890f522d58bb8e752d775148c
SHA512 dc4453ae9164fde6956cf321ef4f01d11d5b19ad3ec58cc7a737e28d0bc0628c0fe11370363e6a971515a064c878a8183f3acf7825b4c9e5108ec37f3916ffed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2eu:A3k03kB56rd
TLSH
T1DB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 1bce0e2364c938ad80b46fb0e69e176ca3d474e9e0e1365b1f85f4ecdac7322c
MD5 0c9b65da0a3bc7e0db27806e8d32ffcc
SHA1 acb7fd222d45bcd1ee7ac9cda82ad18a39616220
SHA512 5b1f9e644ac196e8965fdccc8fc36ae8ced7f7fe4a765ad969af3e1b6dd4c1cad77cc7452085e2ebf47473b139b2265b2bc5a248e5149da74936c40df1f78b90
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Yb:A3k03kB56rs
TLSH
T1A9257B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 b7c25ecd2da30482f2b83d2bbaafcd19921627ebd980786aca0f35e469ae3496
MD5 18ec3bd2912cbfb44dde8954ffcb6a05
SHA1 e0c8e2adad5292b516fb52e5d7424b67715f1d62
SHA512 51dc31eaa384a74ac881cc86bf0ac2ba0a949e9c45d4d37b4dd191ed303a20f39c6332a75391ff54fe905dd2fdfdcc83c9dad5a9e90d145b816138fdf371c56d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Gf:A3k03kB56rs
TLSH
T107257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 91a9bd173e6387a376326c6a3c35c946f17c89cd36877a96f220cae511f53a9b
MD5 c972cffb2f9e836ccde3be470c07659d
SHA1 51f2d8388a3617b04d2f8bd0726d5d78c8aac1fe
SHA512 cb4352ac471ca097ae4eaec975d2c741fc480b3d5efed45d72940640fb47b759137b1c8acc7772c4d4b52d136e3c4f7ab381f08f1419945867c8eda361b855e2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2DK:A3k03kB56rc
TLSH
T1B7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 7e84f4fb3e8b7ea76c37b828190715d66b18a2698140c23e2618b99e94cfab8a
MD5 149d64123a7977c611a6b669531a8026
SHA1 3e660a03aa7d28ff5d2ad173732b2a2fa5caf4ac
SHA512 dc5bdc57c1563a3d0e8ae5790ecb81b2e48672b164062c788f3bb8726a74d97647bd169061b3a0ebebc0182101fd0e63bf3808d312c16edd688b76534466d807
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2kk:A3k03kB56rl
TLSH
T12B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 24bb9d255c9cdf04f7e8b37ee9dd1c65650813dd512f7d6dea2bdff047aef656
MD5 e3f212ed8f55b3c338e347e9429c3675
SHA1 5fea019c8c561f97f917bbde34ae8ac14f0e0294
SHA512 e915934511bfd9fe69f9a68b450b1237b9ecf9d08e9fb3d165ecb2b8bb86df20734d816de061d61e403decc793aa4874f75d03394edadc6575bcce88183d750b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2t0:A3k03kB56rY
TLSH
T16B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 50762215eac64357279c7cd21c9db921e4b9de585a9b239c3f37657cff91ba42
MD5 10a51f9117672c0baab8483d49917bb9
SHA1 7012562b39ef0b235fb6065441b772a69a8cfc63
SHA512 bcc4e41c6a4f47efbd84f895072793f0a06733a4c298e7ca29a2f205db82d38bcf781d2a8812bcd2829ddf1f6672ccad76de2d3e002e859e89684e11d73e46c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2wg:A3k03kB56r9
TLSH
T165257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 d35b364f3cd51bcfc69474eb552ffd41f4596d37bec5dd5b09149a5319f904b4
MD5 441cc44c9467abe5114576c6bcff94d1
SHA1 67bfae91592f5f206c3bfd16126bc2469984fc39
SHA512 7e4357c38a7c4091d3b7bde5643d6c5feadaf11eb1b694c380bc0a543b132a17a6c70eaf7210b4868bb9209bec16db0f87f36d8087fb4d5434b706d302b7606a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Fr:A3k03kB56r/
TLSH
T155257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 63f1d86c138bb5ea8f01c01c7d49abc45d1aa1a1c6e6465c84b7378d8d80410a
MD5 0b8e990a00b3e3ac8ab1081aed82c35a
SHA1 c860ce8bfd3245afbcb1a101e8d174869728cfb6
SHA512 f70d09ab80e93e254ed2aef7804f38e231a806e68c34a9fa2523be8c1398bfb5cdf7675b0619ff5cdb1def3bfb02f24d21508f378b83932a1a599d2ae7be4f08
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Pn:A3k03kB56r5
TLSH
T1A3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 ebfd4b801cadfa01a91a6c544454d42fad96fb94bcf21677bddc82000c9643d4
MD5 5078bd60c56f9fb792d142c1b86e06c1
SHA1 fce0ecbf16a5fc1fd182272a017e0bee64c5d907
SHA512 bedb6f5abd39bde2590025269898f67b534cf778b91f6bdeed037dd3341eb9abde2d5063a5168df74c73a6b8a885688c924865ebdc20519ed963aad753e48ba8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc27x:A3k03kB56rX
TLSH
T12B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 c39755acf0f335b545fad1cbd2e189b97dfabb7228f47bbafd68255472040ea0
MD5 df144b745f8ddd13cad1d0bf79fba8b8
SHA1 f53b1d5b78fe1ee7b312fc87b5fe798944e0f398
SHA512 418d44abd17956278620fa535971fdd4333cda3c4cafaa51f933bb37b4346d73cb0167d8fb65c69252c9d135962da94896ba88653cacb238220f96b1a342161f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2pA:A3k03kB56rY
TLSH
T190257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 547d9b4b69488502d5a2b36743e381047dde43be30a8a810bf1c3d650843ef35
MD5 c84168cf5e7f293c22ef9c6c6a0ec893
SHA1 cc45d1ddd239e6a2bc0785739a0162d5fbd56337
SHA512 7ce93a682db836671470430e9547e1d573428db4e38802ac6b7722f3f57191114d834c126d57507bf07b1f09859c62e4f3917b992ff371fa5b761d6cdad60c8c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2i9Q:A3k03kB56rB
TLSH
T1A2257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 a31ecd7ef29d137f937b48d5a2686c07a1d8770d8bd985c6fa67f53bf71aba4d
MD5 967ec95802135993f090f1f8bc530ea7
SHA1 3e0b150d040d026a97c292b21711a15a12111c16
SHA512 b76347ada67274114eb78fee3b58da64ebd8e9810161630cef6ed182433b8045a977b62fb6332e58e23da2f7535c2170b786c7589c47cafc07b2014fbf92725d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2H4:A3k03kB56rm
TLSH
T1DC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 fdf5ef4cc8a440790714f7c3131fa9408cb797167ff8c3f390d931958e0162b6
MD5 386686898c8de1f551034b28784d0b3a
SHA1 e4fd4273c1a45cef5d2cf1e4a14bd86343fdf79c
SHA512 14fca0288a318f6d375168b137db009df7c64cc007c42bcb54c38ac93eff6050356ce629c660063c2d1218ae76f8250e5bd3d80da8e3b41b693197a5e2d71a01
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2mu:A3k03kB56r3
TLSH
T1EB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 644038af768c38f8ffdd1ea5d5cec2a493c8dbf8a66991e9c83f4dcb0efd704d
MD5 09236c206b17aa6b6e55f22dc2460093
SHA1 d6a6f665f298aea75772c04da1a7fd7961037893
SHA512 f55496af228a83dd9d1e64ac5b91df484a69de5fac54aa5932b10289128606341fa412159d5d9e52bc90c60e11bd58a9f8e41592807055175d606ea59c685a8c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Xj:A3k03kB56r5
TLSH
T155257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 fdb014ef257e649b11055e97482978df42b0de28ccf04d84b66781b6d5a7e1b3
MD5 0216f38873149ac23956368a34acebc2
SHA1 5b01297b196d2005bb0e308428f0dfef212eadbd
SHA512 bac7d1e9a641ddc4cb93fcd0be57d6b0b8b40d3ae92a82c706197a3d3b5683c13bf5c9dc4e4602b57be6b5f92a79c1171e0080ca588f36f12f92af3c723483f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2Cg:A3k03kB56rN
TLSH
T1B3258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 8180e7ec87ad1d28af02b6de9a9a04d58c1fe050c75605c35e0174cd364498e0
MD5 1e5a86bbbaffeaad645b68d4d8e60c5a
SHA1 4c69de9f5e14db09f7d76775b6e49d2fc414345c
SHA512 0ed7386c3677fd1c33712055f7c0d447221d082c074a0118a81764c8450c3ec29c96796d449ab59cdcbcbd041bc6f7fddc334509328787980285a3925bbb4193
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc29I:A3k03kB56rE
TLSH
T117257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 5d5e440a27e5cd1f08004ff4f2c50e958993a8e511fd32d429712f2d8f0a4ddc
MD5 15fef791af855c69dfd097317ea089e2
SHA1 16253dc0cb41309c5ab0013ccd19a2e9d48334f2
SHA512 e41ff6649e8f0987c990c32271f2c09d5e8d43a54cf545956c64788ef1f574f155121216b09d765366760689217cf69e5e25b45c035fcefcedb89f2924d2e498
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2vo:A3k03kB56r2
TLSH
T119257B03E6850FA9D00F81749A954662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 cde36d2c89770fac01a90037a056b9b1dca55f0fca280db046e4f49c5827185a
MD5 e5373be1c436a28c1a511b927b4fbb83
SHA1 757a5cf96ae3487e22f4797b1748f878d8a9e08d
SHA512 4433a6096b22d76779e11985be048e61cf854dd45607fd1738989b1271ccd172b19312c9bb67681d4ce88b88352fe7cac4ee64e513b6799f1f43b6f95f7ef9ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc20+:A3k03kB56rj
TLSH
T108257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 188e1e10fcb7b5066e2a056e954a6821aab44de6ff61042106577cf67bb13142
MD5 d0da31aba08f008a9337ad4a42417992
SHA1 7e1a967b45773510524c08f2e91c11187f651b85
SHA512 81725f02c28f613eec1f6b9d89b62aea437eeb5fdd4e9bfb105a70a90639224251f5f42b90693cfc66b06c8b105fe6bf284d02786a8081d078a98356fcd48646
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc28Q:A3k03kB56r3
TLSH
T1E7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 bc2121f5ab003be90af8a259bf668ad2c31e72cc4ab54268409c7b4a081b9b1d
MD5 a619f0141baae43b837030c09e1a1dc6
SHA1 eb03d91a911a4ac310af1d6cf4f9350c206f02f5
SHA512 f2bd47246e5b8f039ef3a54e49ca3a6bcd7c18c638c6b6f8d9d5c706e2f0414feb0fed5bdc722ced21ce33f91fd3b31a16182b375f4f144c02b0f1eeed3eaa1a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2lX:A3k03kB56rr
TLSH
T186257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 070b4d81edf19a4347aa3d121bec835f445ebd51050cb74dc8fb1aab0154e176
MD5 ea9f2231046bd34b193e62d3bbd0d3aa
SHA1 814b6c8d2683479cb484b2d025bf4a529e83d0c7
SHA512 27e99e8d86d9fef15c552519291d0c5de54e61d885158021bc9d6ac810570f03b086fb64db575fdc472e3978d2c7b03a3bf976907d3592edfd834ce2544ec39b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2HL:A3k03kB56rl
TLSH
T1AC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 06dc69fe7f3735167dc1bb9e212fe2d8bb44d45df096efe0c349b1db9a476621
MD5 62a70a41fba0764225722a3e084f1e3d
SHA1 ca0f41d5e41c07f7b8dedbd862b15a8d1428440c
SHA512 16b90f138c6a2df9caf0f550c240b0a3aa775319d460add294702bda717093de9197896b03759530946258a91bc2faea78d021028de7bcc987e623916ed59bc3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc29M:A3k03kB56rc
TLSH
T12D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 1f543b91e0ea47dee33592ec3efdf6472fa16872615f7469c974472e08215c24
MD5 2e45a48e9a80a1c6b1b5efed281037f9
SHA1 5e6b7b6a68bb45a07f925c6f7667ec62ca79547e
SHA512 9fd95c57c363cfc206699ef1d063cad87e40b33f206e7e5f6a57fd559bddfa9019ea83df2c30d544effa8130ee10bebac2e3b848c64e5aa1fc67e9b7d7ea3169
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0Yc2uh:A3k03kB56rW
TLSH
T150257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4900-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4900-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5224-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads