21ebd099bb6fc4b10d3ffa8d1446e360a778167fd2b3f5012f3f92429e83734b

Analysis

max time kernel
104s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260728-vbraea1zew
SHA256 21ebd099bb6fc4b10d3ffa8d1446e360a778167fd2b3f5012f3f92429e83734b
MD5 d3a769db4431eb669b5ac72e2be2fed7
SHA1 0b27e96e6f60af698e34ec198ff6527ab443152a
SHA512 3e77f5297a830e85bd04234aaa020081c8d5d018697860e6d02e88377da693ddab9d7883b77abc5b6ec1ba9d63a3eee15a0411c59516c0dcb850ce6df9718aba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylF:A3k03kB56r2
TLSH
T150157B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3724-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3724-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1900-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-582.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-880.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-40.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-582.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-880.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1060.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1121.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1141.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1364.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1900	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3724	2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
1900	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d3a769db4431eb669b5ac72e2be2fed7_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3724

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 21ebd099bb6fc4b10d3ffa8d1446e360a778167fd2b3f5012f3f92429e83734b
MD5 d3a769db4431eb669b5ac72e2be2fed7
SHA1 0b27e96e6f60af698e34ec198ff6527ab443152a
SHA512 3e77f5297a830e85bd04234aaa020081c8d5d018697860e6d02e88377da693ddab9d7883b77abc5b6ec1ba9d63a3eee15a0411c59516c0dcb850ce6df9718aba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylF:A3k03kB56r2
TLSH
T150157B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 dc2bb669027fef92de23baefddb31449b11b1a30166ff3af97b8d9c9624833f2
MD5 477815fb5317eae7b234dadf138735f4
SHA1 c6a055b6de274418d72129ee3ac2c882a209df41
SHA512 47b4a117aea7fb7f27447c9307b54b1d2dc467a158bc4b4766d93f88775d5cc475cf4e115fe81e803c5c52b4da004555108831ddc20d2668502e20141329a4c8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylB0Le5ji0hmxNrM:A3k03kB56r2Pji0Aj
TLSH
T1CB656B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 efc757b39c86ff9dafebe80e227dd9113a657f78f0444b59bf2b0536a5eb385b
MD5 6ed86e2976e6af24a321f265e544c8a7
SHA1 fa254e6c4177746e9bd2d0ce13153a5a505c43f1
SHA512 b15c9fb18a2476393d6066e9217a29dc4d93940cd32562ff426c61e72ed29022127900867c267232c9ad05709dea128c3a60219b4d2bc52afc2a4d59a312c3f2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylDa:A3k03kB56r
TLSH
T1F3257B03E6850FA4D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 8539140b000c60c66b78dc15a2dce8d06ee7a2a624052db7222bcd0a6e3df3f5
MD5 3e17ace3c7e17ecc0d7298477537185e
SHA1 6acbd0da6e2e4fe44b2792100ca8155f4cce3c81
SHA512 20eef85791f911e9d15bb5b37556e914606fcf62454e9eb17c7cc304d48931b54712b22aa590b679d71bde4c38754e1c4a890c5f380eb4d3edbd89320543f26a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyli6:A3k03kB56rg
TLSH
T156257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 340778cccbe1278e203522e4df6a32bdc5d65ce8fead62374186620564ec401e
MD5 2f035b039efef0f3bdbfacaa5e6544a4
SHA1 e9b24b2e80e82653004e10eb4974419cc334d1c5
SHA512 765ecb5ee6e02a04e3531eb2c010f54ba818a58bfe5e73fad1441d4bc8e0fe39d62df34e7b38ff7b6160e57e8e1578a5a89b6a81fe985371571ac7645f85133d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyl6N:A3k03kB56rd
TLSH
T153257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 114815f30ac66e2b7ff5e931036a22b399c07cef7de9885a3910fe4c101b5fe0
MD5 efda2ae92deed935b23e679f34c5da7a
SHA1 bd05bd319770cdbec83e2e2b498a8d3129ddcc5b
SHA512 c7ecacc369f47d91e186239995ccb5f96dab31ef345c621190e3754e17492207e7b360ab6d27ffb580f0a1339db00a6bf8ffaa1b94677846e582ec237214b963
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylgf:A3k03kB56rV
TLSH
T125257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 d3e09748de8bedd9652fdecc4718d6e7f72e5fc432abcc4c48fb606734129e6b
MD5 5e91bc10a8ce2fc8feaab344e49f56bb
SHA1 d8dbf97dece39119c247239cba0281cf58606fd6
SHA512 3583f08e0e793678fbb48e28ed8e2cb88429781f4b16fb99e149d6b9aabdb29088569e4182ac406170978baf24445cff127dad37bd0d1ce255b5e0e8dbf86169
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyl6o:A3k03kB56rg
TLSH
T1DC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 beb231b63ac1d17464488c889024f7c969ea8e20ef6212a96e865d02085c5531
MD5 00febe9d1119472c7aab2893758c5273
SHA1 9ce514f0a14e1a7eb14038b8a6df1e24722ba6f4
SHA512 a11760ad564d7a64286f32b25fa242ce311b954cacac7cecfb1262c46be9c553f9d2d35aa5cbee1e8e58bc5244ae9405d07ffc633dad510fc8f4e89c07a06869
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylOu:A3k03kB56rC
TLSH
T1ED257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 29b0fc5cebd768e8ebb8295d0c78bc11777a02351d413b1ee57c096ebc92d0fb
MD5 01c94b1eb3efa2522efaf94e68cb49f0
SHA1 a6089a064c68f1c1cddd9a52b2368b3e8c302919
SHA512 55fb71fc8adb918c897b38ba4f867df40a3cfab685e5f705a6fd1c50f6b6a818ee46237566f6393ffed959562de7a2a8193335beca3e70347c9e71d8084b656f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylC9:A3k03kB56rj
TLSH
T1A6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 da0bd86f756c1a20fdec255303452dfae50cf7925af2d50533a0ec33ddf78ebc
MD5 646f3e4bf51381f1cf76ab83234ae355
SHA1 331e9205c5792c8a10df41ee2d35b4ccc9070481
SHA512 0fb37d319fd2bcb0a12a6eccd4b57e7dfd0de926157a26d883146a5865ecdf0c67275aefcb65375e4c69d7ffdec07603f345d8e44142753a52bbca5ff5aedf39
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylCc:A3k03kB56rK
TLSH
T1DE257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 460019fd889c0cab4a8422092b48c3999a6679a5e5c7190fbee0f60f73a98cbc
MD5 09bbdaad3bee2721c610c6ca4d75089f
SHA1 171a901ef64db1eda1f88f0105923d840e0fd091
SHA512 a365e5e076ffb5473819b51af962422082ff29714e51aa13b0a932bb59cd810686b4bc085248092262cc87886f4ce467d79a0fe9ce81cc06d535c379e6ab9b23
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylLp:A3k03kB56rQ
TLSH
T1A6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 802c58b52de0f90f51ce961a288ecbd95c4b7f0753240289a7f9d13cb0c66655
MD5 a36be920ad49309833367cdd8724142c
SHA1 18d2813057457288b690c6e39dd8e94d404eb210
SHA512 de832ee9f0b2b826072abc03aa189ebae7bde964ffaaf2af8c4db5c988722a2e27051562386d449365def2dd07b539f5818a327b8d7c2966422c1588ca614c8b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylcN:A3k03kB56rv
TLSH
T199257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 7254ca720c45648a44af537304a3ee6a92fa0ad648912e24b8befde3a83c5a67
MD5 14f00efb634c848b1f9d63152122bda4
SHA1 af9de20ecde947c190da317e653643f50801479d
SHA512 d09fddac61b3617baa50868ee1ee5fff898f709c05100f1386e7ad6284d1e25fcebacf1bbd3d6dab35da4922ced44216c906fd8d21782fcc235bed29c1e59556
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylEF:A3k03kB56rJ
TLSH
T1E9257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 db31dc9a50a553b5d69f5b66c83e35114e4554a294e6c177ef0c9ad4f70d9d95
MD5 14c79435d22e5c7f89dedc362fa0435f
SHA1 a8395c9ee57db1bbefc6b0dedc684420a436ceec
SHA512 23522ec44087e6de0a54e86e03e91646a5b5cf10e93313194942631ba2fe735113994f3054f0bb4f3b95b2444f712cc126479bc30590e7c6851e7c01517a94a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylhC:A3k03kB56rV
TLSH
T1C5257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 769296b0935bd97e3718405b04c0c9cbc05b0fb2f425054b06a72b8c8fd35ab6
MD5 20f5e8b228d03452b707dfd8633d103d
SHA1 7141947606b3074237dd34f0dc40f176cd1f3458
SHA512 9a4233e90f058873b4721d214831d397a8d85aab32c218c7584f87289b406884618a1b99dca60ae6aa51c9be5983a32fd51ac1967b75a2275607a703e96b1a20
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyliw:A3k03kB56r4
TLSH
T174257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 b30e2ecc91a3d37ae2029016cc9f08d7ba7ed1e462e4915bc99f9996f3f62ef2
MD5 8e7f52304621afa98447223fc78726fb
SHA1 51bd55defd7ccff946c2aeaf9f8c2e5c2e9e4b99
SHA512 9aa99395187ebace15557dd8cc40cb8e998e676f864305880e71aefc50fc61cab9bac1777228b317f06cbf8a999e4774db881b8d285f069e2027e81fa54ecdaf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylpT:A3k03kB56rw
TLSH
T177257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 39a5c282a467ad57885dcd00fd153431c03d8fee8fba1e8ea076298ce78d70f4
MD5 a333d39438c18230d99a5ff186f26322
SHA1 6e97d9a36ffde06d85044d918b054c9664f5421e
SHA512 ff8a509509dce75f7882151e30c3348cf566a36c2c6f632f01e86ac8648cb357bbcb8fab47ec387bd8f16e59585dbb12c963a98370f66159cfafc8f050b878a5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylHu:A3k03kB56rv
TLSH
T1F6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 718bdfc0c2087c714c8a52cdfba7602ad2d3b2be272ca28e8b5dd8f54cbaa996
MD5 4f4c4889d34d2561680e1b58e27dd8d9
SHA1 41c014a3a31fa88c4b5ff6802612e65d49e45a11
SHA512 d942243c2bad24c1d86f24dd2979243b598bc940a56c335884625da52e4cc85fcb5bac13beccdd1f1c494bf99fe9a6fd971ce318daa06da31264033308a6c4d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylbb:A3k03kB56rW
TLSH
T147257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 f1df722e4a5d633da28f8696b177f876e024fce03416ebf83c119a764b7cac77
MD5 6e91ee964f847030b17a54bc6bd8be82
SHA1 a91db568a7e2e7cd0c079e74aaf3463065652458
SHA512 067948f73d02c70acc9c9b563900d941fc41f68c3c4f27b54cd076c366777c82ad78d17525493ebe6944d88d3e6d5e1a0010e7a726e46a8b7632887560568817
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylvf:A3k03kB56rm
TLSH
T1D7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 88eaa44198dfb00df31f955ff5e8e125858bcde65af8ed167fb8b6a875c10a8b
MD5 b04b9de6e025311f06287bda866f2176
SHA1 809baa055652a47fb593d53fbd4a1351c2a8ec82
SHA512 cae30088a4fb0fdaad0b41c1200e34a416718458754729e024db7e23bb0ac31329b24b444afdabfd9d8e08b89019a11b982c3f69501de29a3f697d8f8ecf6eb8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyl4K:A3k03kB56rG
TLSH
T191257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 8f2b48674f4547c2f1f1be1b5d869c2331afbd058204f10b7c4ef35ef66e6b3b
MD5 1974398f0158fe75826c5e13372563d7
SHA1 6f4b13e3d0266b0e6215ad77387801d73c0fb1b1
SHA512 9efadf654a5544d6dfc6725affa20f92b0fc4628e85126096fbe3ee813eca9fc46b8e4272b857928be6ea0e41221ed021194a8ef8d67531eeed3a3e6f51603ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyllk:A3k03kB56r7
TLSH
T161257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 7a5699e340de63805595f1a8e3d15c03f890113b5a30032ad540060dfc303a06
MD5 a400de207c709615c01a33ee24c771ee
SHA1 184c7a95c61ba7c5882525a49f54fb7b0102d40d
SHA512 01d8d050640259ed5e377b8905789d5096373f0277f786474e0c4bb473289d34e2fb2dbd417419667436882606f09e5b11e2ee817fa48c83d45a78315f97b796
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyl60:A3k03kB56rq
TLSH
T140257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 933c52cc54d3417388c24ce5fd524295a1eb64ad0a78fc644ba42778f515f0d1
MD5 39cb542cd2c3d5a4ae0c85fab879a1b8
SHA1 804a0d5b1b6d72984ee68f8cb03e4bf9504cbb86
SHA512 abe09d2931e9ed5f3b783c70bc40e173c20ff2656b983c4ec4b74bcea38ece1ca0a317fac18d6112d3c1c357f894e2cd4f0355754af238363b8cb3162e9b27bb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylpg:A3k03kB56rT
TLSH
T12C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 f4cb8db2aac3e3c307aafb25eef6d5f71f3bb566b428627cde0d1b0aead9fb27
MD5 790a9dcfb630481c2493fabcb6e57dfb
SHA1 2ff0ed2376fe938b945f0d7754d24cbc61bb65a3
SHA512 b0529398aa346f285e4291f67b20ce70b7590e8f0f2410fbf248cd07378c1dcda6facf8b59ec295c366ca8da031ce40acf98e1a1d163a8806591180d6cf809ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylQr:A3k03kB56rl
TLSH
T14D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 6d6c5f6748a0320547c3078835fd6aae4d79b0f1596001c93d4456c019f1992f
MD5 7d01d508675353a702a518cfebc2040c
SHA1 59a0462c3e7272da003a72e7da4d7320c04703f9
SHA512 d7be58138d7dd5a204bee3ab24132be41796d88e211d3e78d2effa4c986e909a536a8cd68be409e9ca9a690b070fa95411899743865125ef1db142cae47d686c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylOn:A3k03kB56r3
TLSH
T137257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 6145f5c594a679bdbb367987636265da739db94074d5bdf6a12100becbffc6ce
MD5 e1f091c8e3c1ec9c65bf97e8a17dc32c
SHA1 d8e9528771aff34b5e6a7db01619a817b49f53ab
SHA512 9ea8696d4c6a73fd7a9bb485469f5b2efe9825d08b65b4e37f93fcaac0cda2021b392b49bd028027123f6b7b77b665c4b20069d7f88230b0f6f5dce351906779
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylEx:A3k03kB56rt
TLSH
T19F257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 f06d7a025ffcc5d7c251aea9c4361c8aea5b1816a2ce90f1583b0e0d427f91e5
MD5 593e9b851e0dad71a84e6ad0d17aa72f
SHA1 e941f0dc72ee697a1a8c92d62007c70b07d9bbdf
SHA512 9bbe9e2489af94f2d8d3552743241963a05887f932235b5fb87fff0ee00206a4db77e9a08b3b2807390e11c630ab03264b8ce86d5ab2839f41aa6dd6e60c656e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylOA:A3k03kB56rS
TLSH
T13B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 768d128a29ddd7db8bac933dddbcce852b59363c6e711580a13c52196bb50edf
MD5 13c49b5003b040c781f5dd6bb8d732bd
SHA1 b52fcf89f3c4684708a8588fed6946c4bea867ad
SHA512 9a2481f407c8fccdbac2f9b05c2f6b2bd6c2520bbc55f2ced00519805a20a1bd5bc6a8128f536a2dc5a5aff8e1c3736d55812838335b105706a1380a551f330f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylH9Q:A3k03kB56rP
TLSH
T1E4257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 037372577949c43381644415a3388c5b5ebf9772259bb698623e9df11abcd99c
MD5 137b1f6200ce7484405fb7609e5525ce
SHA1 bb4a2448e14fa8b357ad8659506c01746b97fb6b
SHA512 ed98c45a881771806900594997c694f5b37e4adcbf69f9206e2c7709d07e565a51ced821a414c3066f8bda8fe657552985c72d3756d9a743530fb16462bd8268
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylO4:A3k03kB56rw
TLSH
T1BA257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 4a598a563dc9b7f7acad366b42fb066d55b42f0f2f12ab5f50eac085d3648407
MD5 0473dbc520030d9301338f7931d7518d
SHA1 ccb2cc312858ccb02aa6e7e33142e29db9c13409
SHA512 579347a6b42294b08d32d4cbee93ccb9a60ce5a67a13c45404da356136549cfd7598d08a54a372c37ac098a754bda5c8f48acb630688ca2f0f3b6b37a0d01c33
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFyltu:A3k03kB56rR
TLSH
T1EA257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 38469a4f82cdbaef247132d03d43ae3f5d5e00d85c578663ee21805183259954
MD5 dad33abdf6fa8678c4eea7e39787d595
SHA1 19c2bb377df5f846335dd95776bf6e1dfa014104
SHA512 f5601e401abe6d61c130e3c8dc795a5723df5ede17aa3bf8f7531e28f5274f39473426829f50bfeb67d26d45e19f152dbaac6ce4304627d8021f2bfe7bba09d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylgj:A3k03kB56rb
TLSH
T1EB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 9175975d0b3fc3564ec2747a6958c4d536f987b8c573aa2ea477df24c4e379bd
MD5 22115a1aee3b2ae20b2566969a287c75
SHA1 81df476d4f00d47d1747c410028a67abc67b8fcb
SHA512 0352f7464b9325794afe039e35e2815e40f88743a454b7db014c1c9c40e2d03efc2a82194a1031f36d14956b92893be6cf5c14ddc22786464cc5d684db2e66c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylRg:A3k03kB56rT
TLSH
T115257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 5f80631a7017f9fc4727053db8c20cbddae41a68cddc08fd1a53c2a8b47f64a4
MD5 e05cabd2d74d246c14a40c71bb79d87e
SHA1 05e184a4ccf267340ccd384595fdb5daaf56778d
SHA512 5c20dc6c3c347b9834b50b6fcfd076a35686cae29c60f7ea4ca1f6295ad37990243edcfdc48fcdab56e7f46735a35854d1b7c5ca68e29e44a5de74688540479b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylII:A3k03kB56r6
TLSH
T115257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 0abc358129466da6503dc6b1ba0f8e3c85c976d1617f01ee9d21e9a45832c921
MD5 6bb6c11dacf718daa4894da6627c27e7
SHA1 0491b78d9abfca24398890ebf01c430c8f455117
SHA512 ed8d750da2af075b31a9e7339630cfa170aa16ef5b1cd7cd7a296c13d1fb1d0b85fdad3f5b2a2746b9d8c99288bcbfb90a0de49e5f1a932d25cb6b08e57e6ac4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylqo:A3k03kB56rI
TLSH
T1C4257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 a9c7c2860bc2070caa85b204d77655ffc254b079b16f479a6dbd20ca533087cd
MD5 e2ddcc8f46f82f42ae6452c60378a384
SHA1 30ab3f0fd8e2667207cacaad7a8669f02dba95fd
SHA512 414565e3b3f30a8fb50a6deabda25cb0e836436f42569b698fb8e34124657d937b9b95fd23a6e33f67302bdd82392470f127fb70a91d0e78da05c145ee059e11
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylB+:A3k03kB56r1
TLSH
T1EB257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 72105bebbbe9f02a347c879b39eec50a72e2ba9645895bfe41a2eb197506610b
MD5 ea998b5f20f15a11c63cec993d8990bf
SHA1 d70d80bd055d5314ff6d444a30b1c6a20e5adf71
SHA512 31539af94e6543ba549f7403a360cf611ffeec36628ddd0f1fd0cd71b68f3a829d2062bcbeb13f7fc78727e423acab4f9743b902fb96fb7571ff2dad7eed9566
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylPQ:A3k03kB56r9
TLSH
T101257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 3e70159a2a6330f0633d6e4f6a69d204a603c3fca40eac71e5a50b8cd7a3da94
MD5 cc6e5570bf6460916717094f04818104
SHA1 d144485b1a63075176b7a63b97c9667aec8fb62c
SHA512 c3d47855ba05e7332af2de0bbb3bec132654fee5f07578efe0400d7ea7d43aa97f2562d5d2586c8d86553add9dc1333fdf92bb12d9807b64f44264e869e3c985
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylUX:A3k03kB56rJ
TLSH
T1D7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 65c34c82b1b7b7895ebd2a7557b0e0afef511e62a20f00fe834d69356f77dca3
MD5 5cedaad78eb92889537fea41bf22581d
SHA1 acaab03cbe3578c37631e881b5ffc58c262fe4d2
SHA512 e2532c7ae90ad29bd5a372e20be8a48c08a14f6db59d9c4d4f001bb76b2edc5d9fcf05900a5846bea72df8869f7254f4729f536023252bf02bcdf3d54b4c3980
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylyL:A3k03kB56rD
TLSH
T10D257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 134f287d84a8ef4daef4759866f5d8f1b1419b22b788dbfcaad0d52a4e0b7d49
MD5 7060dfd2e0e21080858728890356fdd7
SHA1 1a216c5bb10aa92225d3e8848a58ea0907f113eb
SHA512 e406a6ca04359f8e51d9c9d2762ccfefe44f94b672dd866f2faf3cad703c8d1fc7148eec863c7a14f98f34bc763cc515682062062ac0ecfb77fbdbeea1c848c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylWM:A3k03kB56ru
TLSH
T13E257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 250d19a65e5a147d0500b137e8f8cec621e5457ba617f27612410fccbd11c925
MD5 1e3b104fd40b688617475385b1c2911f
SHA1 c85320fe120188695fb6aa1729dbff81c1a55ba9
SHA512 ad345efdb831bfe8d6bdbda7a91db9f009fb24b921a90ab8a5241cea0b58340a0e2a58348145512d21166d8b3fc530fee7fdf8562a9531a76bd2cb93aa18ccca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryJFylfh:A3k03kB56rA
TLSH
T13B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3724-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3724-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads