e92ebf69b7f40b13cdce622f61c45431ed038443def53d20131275b485bb1b72

Analysis

max time kernel
93s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 21:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260729-z7zzmsfb39
SHA256 e92ebf69b7f40b13cdce622f61c45431ed038443def53d20131275b485bb1b72
MD5 136fc489d58e334c12fd282f40f68b00
SHA1 8ca20c23e45a606f01e413d8e5b64d2165953661
SHA512 ff57817ed4321d81f237b86f99f8eca8436489980e74fcf5a38f101a8702cb4678050cc7878ae6b74143aa01faaa9f7c6b41ca2c2a57e3ead967554f88d478c6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2c:A3k03kB56rL
TLSH
T135157B13E6850FA4D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/4452-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c624-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4452-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3716-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-691.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-864.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-998.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1158.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1190.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c624-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-259.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-458.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-691.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-864.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-928.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-998.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1078.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1133.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1158.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1190.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1318.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1338.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1363.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1383.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3716	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4452	2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
3716	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_136fc489d58e334c12fd282f40f68b00_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4452

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 e92ebf69b7f40b13cdce622f61c45431ed038443def53d20131275b485bb1b72
MD5 136fc489d58e334c12fd282f40f68b00
SHA1 8ca20c23e45a606f01e413d8e5b64d2165953661
SHA512 ff57817ed4321d81f237b86f99f8eca8436489980e74fcf5a38f101a8702cb4678050cc7878ae6b74143aa01faaa9f7c6b41ca2c2a57e3ead967554f88d478c6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2c:A3k03kB56rL
TLSH
T135157B13E6850FA4D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 28194b7dc08744e88f46719f6498c7240c5fcb233984ed2b61803e878c7fdb87
MD5 39ccffa338ca1affe9f8b0aedd1a7132
SHA1 58a7d608b950eec58ac40c254c1301b3f86a4ed6
SHA512 03c3a6247a2c46713243279b30362afb9ea45dde02df943f82b438a3d3392d375e8d2caa085053d70280d25c4f2c761f48037b1636726708f8be28a5aa7e5ac8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2k0Le5ji0hmxNrM:A3k03kB56r3Pji0Aj
TLSH
T1D7655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 df658f270e39698d69cad02c4515eebee6ea13b98b72c2cab8b4fb79ae81e919
MD5 64b6ce81d56b498f4b296f9b79db4aa9
SHA1 8de75de7364cc7642c51fda6b4bc131ca6ad7b0c
SHA512 66426fbdf795ead754bdedcca6f7e093f6cc92493d095a601c13bab75432ab3f6ef87b84eaa03707a81a4d4491588d08339d870eae53f7b0f76a570761ed2c1d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Oa:A3k03kB56r
TLSH
T102257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 943d6135b4be55edefe4053b8d39feba7818e832aab6d3408442472ab7bdb2a2
MD5 aec9f67437d22f06f49df3262e0b7f43
SHA1 9d24d92094e7fd36824ba3321200bf75e8276deb
SHA512 97ad6935a3ded995df38dcc924d6ead845e6266e3b21ebe087efe0d7d951b4e00d32aa2e6ad63719c7302a12671fb617510479da65147cbec6dcd74c1836145b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2v6:A3k03kB56r/
TLSH
T18B257B13E6840FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 7939dbaae9a9bd485617f39cdafe95530a3c4262f1efb576e4c26f85f293bcae
MD5 ac77fbc7fb62f5b494247365dbb4c429
SHA1 e41b17ffefd42a8c3fad59cd0271d11ec9610256
SHA512 07e8b1516c714196c3efcb5795b399f487fe4e3d1bfd8dca4df0ed3d5840eac20505c29c3f7ec8b2828b0908d2a4819209ca23786057753614f72d27fe0619a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2po:A3k03kB56r/
TLSH
T12D257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 b1e866ec09f6c74b56c20652395ee51926d3633e2e26a97d0ee12fd9de185c2d
MD5 eb9778dfee0d854791659981c5e5f2f3
SHA1 ee872306663976379a3ca26aa790559b66b294a7
SHA512 a0b12674a85f1a9bfa6c05e505bdd65e6544a6399b86f10d07bcdb07ea6eb814d43f4eed3f07ec0eb2d6cd6c0b9b2f5f136c3494c682f55a2f7eeda1fabc402d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Zu:A3k03kB56rR
TLSH
T131257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 1dc9e843bdb5a7247a381e672a2e40489de65344ee85c8fca530670766a67893
MD5 98410a85334d3bf1e634c4ef3e0e0410
SHA1 0c7f76f99cd83cfdad08e260dae86f7ddd58d0f5
SHA512 73b6bdfa8b5d02c324cc2bfc39c4d4c8abe86c560a23605060fb8b76566035c7e6cdee51eba16dc48c518a834ccd771eeba2b7680ddca381c5ef92d4a726fafa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2/9:A3k03kB56rs
TLSH
T152257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 e1cc307f005070e3c1463f702e562d6827a87220bd0f9bf2fd2d7f099d1a7eb2
MD5 a88556994b5a1b3cfb2330972105d0f8
SHA1 ecd4999d052e156923909d737fa271b2e8879ff2
SHA512 4ba9e8a2fc1ff12e5cb936e6961453612847cb184be734183c5ca5f58002917461f3f523c58ecb7d36164b79ca439bbd6560e4862966c7f0a4438ee9a9b028dc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2bc:A3k03kB56rl
TLSH
T143257B13E6940FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 6d3d03e85ab3a12fcfe1a21768be0d1e0db30ace14c46137d491173806d846b6
MD5 81798571d2cf1d39a8fc6f296963e67d
SHA1 57ff8ae33741aca7743c884d03d79143d812d0ca
SHA512 e24913374f60357bf841b6f4b83ebcf7ed5c8122a0cf1d242e46c3b21589985a0bee59a7ce48da0558675c411efaca9da26f3d4db9bf31f253e140d550236172
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Ep:A3k03kB56rL
TLSH
T1E5257B03E6840FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 d56f16d89c51ad731119889a35f11c83cf496cae07a16dfaa26e2692294cf187
MD5 366ae28f901ccc757912236cb0c07f53
SHA1 179d11612418b8091230f8c88467eaf49e8603e8
SHA512 a915b06b05ba51e97b5c5c9908bcb2b17b9f6029b1ca11471d821637507cb4aaa7af9727599ec8c8102c315a0b39592aad6b2a3216176f8888987b2263005ae3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2LN:A3k03kB56rw
TLSH
T19D257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 6d98f2c2d35cb97e335beb3c55f8bb3f33a9386fa9fdf61d1a526c083f2cfca5
MD5 cf458380b703dffbac18ee67ac016d82
SHA1 20ae9cd5543b281fe60abdee1dc0b6f602002c32
SHA512 aeb25819352240cf38f98ac93fb1f450d259d7797e19c1e91aee261dbe927edefb790068eae4f769b1436fb2bad138b9b2b334b3c4e17403b05c3b0c6ba2bb7b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2ZF:A3k03kB56rm
TLSH
T1E5257B03E6940FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 6259fa561786bed3dcf0f27f30dd660c03c0e323bd87ddbabf793ce7b674cd7f
MD5 34a5d29c36a8a7774275e914f2e31a79
SHA1 ec793fb5ba6e4a48ed85bdfe60d4547b739e68cc
SHA512 be36076602a541ed14187290ea1af682cd92104fdd88b467ec360ca85651200e8360f80b12c8d615e04bfeb1ddc8222e1852cfb1b83c9a94b288bba8440bf8ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2yC:A3k03kB56ri
TLSH
T1D8257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 fdc17883df496c98f7a31628f3d0ee4a7fa70d813d05ac6763415bd41ea5ce92
MD5 c5538846af3bc986fc455c9958c85f8f
SHA1 733945558c7d7abdefbea4b5e3b41b11c44bbd3e
SHA512 7501f6c9e0555e7a25702f45145c129b79cae438f0b389e8768950b2455aba2b7f9106422d66265e43a347c6e6495358de50f18737734395f3b415b0e747cf16
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2tw:A3k03kB56r3
TLSH
T18C257B03E6940FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 51482feff21800eed4c03c11a23f527210dc08bb664bcd89157f3e599c08bbd0
MD5 790d72252ec72f6d0ba9338022543c61
SHA1 9a2f19acb8d956f77c8d68bc51ffa00cb0d1432b
SHA512 3066d92f6aac1269797fd67b44baec3b0d2c34479d9477476683a4b2757cf22fb226569f15acec8bd9e81d864370d0df04d5a531541963cfa257db0808f36b58
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2cT:A3k03kB56rz
TLSH
T1AD257B13E6840FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 186568786d4d8346020f86f29c876af36c29deacb7779374287f2dd41e1e19ea
MD5 7f3a6e6adde50e8741d4de1e1e1e6393
SHA1 a078c36347df02b226ebc57ea1948f1eeaaddf26
SHA512 a6b22964e2efadebf53efdb6b7613db629dd5938acabfafd5365715754715cd847abcda8ea8319e48b90275f6f353f4ffbafdfcb80ce79aebc683780344cc3b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2wu:A3k03kB56rk
TLSH
T196257B03E6940FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 7ac070a0635edf093459044eb9c5b4395751f6dddbefefdf946590d0f20a0372
MD5 2a62cce5d77312fee121ee38f0ede47f
SHA1 846313a41a42e60eae9d8a492fb930933b9feaa8
SHA512 0d16e688c252b499aa670c20ac91b9a6f774dacd0a6fec4ece63a6d50b524a177124a61ec5c32849142e506fbbdfd94edfb8b78511561a3472c6cec3bd8a2f19
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Ob:A3k03kB56rN
TLSH
T168257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 a9ee4e3aed0fd89952b8bd982d3246583092301096308ff41080d657b5b6e824
MD5 e018fd1288ce5de12097eec738f80d4d
SHA1 0a9995746f9451bb42f95bc8f0e5bcd2301c28a1
SHA512 91e8e6c6aa780ce1a88d87b209b3a9311d1b8983233289a6bdb5ca31bc67e125cb89169462217cb827a62e040d5d6f2ef4ef8aee0b4bfd800f7202cd9672c4cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E24f:A3k03kB56r9
TLSH
T113257B13E6840FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 5a62767e619e2d36c3466f16304df6664ed7c9ff5df86923fd5ab33185021234
MD5 eda197b6a54a44cee2a6c7cc27e9eb3d
SHA1 8ec49ae8b57285405f9c169d1a247861cac4bc61
SHA512 433eebb502438eb29b0b9b0103fcc2c2a2e2d5329be00377e96d6e62546ab5276286204d9a6a79fa72fb471323cb2dbae39ba44bdb18b9f5af1352f809bc81b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E21K:A3k03kB56r1
TLSH
T10B257B13E6840FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 45cb9a5e2851c640ed5b66be455e55b6545a57061ed1c01408fe72ffa038c702
MD5 ba81bdde735b2d6a30816c8fb7a14e7a
SHA1 5ff613528773bc028e54b3d5be1aef32a2021650
SHA512 4307a66ca726ee0c743cdd46848ab301b9eb9269d48845f76fb3f3c1896b228d32e75df908ea964c731307303ac7d016bfea87737bb1b5e7620dd3b91f982e5c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E22k:A3k03kB56rc
TLSH
T1E1257B13E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 8cd52c71373aabb678e473158d3757c3141dfbb46a3d326bae60f5c8732d5ce4
MD5 f59aa888d37fe3cee8f0e07db8ad3f29
SHA1 249c1a481dffb63df499b02c16e8b9b9e2f4c202
SHA512 a67faf0f1a9ba164e68ebd74ada58576de0d2218319e72999ef82695beeae1336bdf985f6c0670a543b81e2c5d506d6cf2c68e2294fdff61a10db6c119a69909
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2T0:A3k03kB56rV
TLSH
T168257B13E6940FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 1076cc910964d8a8ec515e0142e9656117af34d969fc60fc0f6bb012ded37c60
MD5 f995595c5cc64abf8349b9fe7b315387
SHA1 582a4c61485916309654bfc7913f210b04a94ba5
SHA512 575042887f11f9cecb7c29c71a5d0e073514ec16bd29bb3c6bbf25c93548bf91b598fd67c8f6461173c1269a489b071b0eeff284b3312f82f7ad47a7423aad42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2ig:A3k03kB56rU
TLSH
T15D257B13E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 dd5038d8de61f5a087f2f151e176c1a1a749fe2a142517d485939b8a3e4aa009
MD5 c3434f50ebf9a5bb47f485835c94a53f
SHA1 7d509cb164b8cc172b48eef62767f2705a187ab1
SHA512 8bbf5f81577b299751782e0ae301c8da91ed859601944dece6715991a0f93d9a85b5a4f2460fd050e86d4f996ea5a1078d2ba5f3c29c6b249cc8c9469db02e39
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Dr:A3k03kB56rm
TLSH
T1C4257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 b093988d6b5402239f1b3d36e977a72e84855eb15e10ffdb87c60f869794a227
MD5 dcd8a231d2149e7ed10222666dba2c0b
SHA1 03166ffae91df026873fdd89012dcbf178e2e853
SHA512 bee1b825baa02357738c2c60c93cfa3717907c1ba5168b6dee61bcce65d9dbfa6cb3021d75b0e287ed68dc5f390d8bec99f7909be9e2474c293889d7eb217eea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2ln:A3k03kB56rA
TLSH
T133257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 caa89e5c1d423796c5ed1d3d2907a331e5fc5ab74e3448e2e871f4e6bf605014
MD5 fa7be886b704e906ba0424c60d573f0a
SHA1 6daca428ba5f62ce217100e530697a01c81d19f3
SHA512 85d78c7015b87f262b16ca2c280dcdc41edd01c0ab8e9ea16266def03ccb74a8a974ee217625d9079ef4ef20523f04343766308ed10a6208a64054c461934b48
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Rx:A3k03kB56rG
TLSH
T138257B03E6950FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 45cacbaef140de936de45bdf40f912ad54fda214429367764a07e8578a6031f4
MD5 a1aba51d0f86333d7bf6b17f1a42f2f9
SHA1 ac2a9704f39dc038c8b79f1981a4511fedcc5a9a
SHA512 9ddd02ecad415061f0a24cbececb31ac4841c521d3b6e6d253fed58cc55e651261db5e57b6f5b3d8711ed3a3bb373d3490fc5f40e71e07e559d89b76ff564053
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2/A:A3k03kB56r9
TLSH
T19C257B13E6850FA5D00FC1749A964662EA777C025F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 4b5a09cd51d5e4b092dc9142b4079f96c4090cf27da56b0e08d9a619ef63eb1f
MD5 d249a694ead5b25987f3cdd05dd0d09f
SHA1 fad64d97dbce2ed00a47265eaae66cdef3fafd0c
SHA512 cba324a554ef8b33b9e2b700bd4e5677ff57553a2da7828c932585dc1b2713297e23fb5f5c3b347c4a98ceb21ee485fe98f96fe1fefed70685814a4f99fd9456
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Q9Q:A3k03kB56rs
TLSH
T14C257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 92a54e329de3c536aece9d09104d1650feac54033619c096c21977028c936567
MD5 fe8ca539b832abc3b82f575feeaab4d7
SHA1 74069f4f738ccaf8d2a7176438e32318c47d542d
SHA512 1ae21ddb106eebde4cb7433b078e09c40aa7ae891de7d59184a554c25fc628884fc4bd3f768b86d8c838ad4b9cfe792bda49eb521f5e22b8a419c02fd489225e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2x4:A3k03kB56rn
TLSH
T16B257B13E6840FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 9aa412c7f5fdd1c4426f29631811af239926608b9732b72901b2bd8b0a6e4781
MD5 6bda2d60b2f72ff9d49d1fcc0ca18b75
SHA1 a6755084445c926f91533a75329305a08622e84c
SHA512 d464f0ab1cff1dcbe6b0723b6e57860cd80d82f7d731d6069996a978f58f92045095a337e68ed3d0eda6eed7353f0b77b2c1971daed354e8100757c4a7b2cdb3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E20u:A3k03kB56rq
TLSH
T159257B03E6940FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 59f977dfa04c2d5d382dde1a0a3204d2db6bee4662bf9bcd5f70fbb41950f687
MD5 1dcabbacb65ef534038a0bf476c814b4
SHA1 452d5663b024da7bff765b06c91629637d518a10
SHA512 b937c3e5f07f234149fe9020b5befa1b1ad7020614ac8a2fac94f5d4b513f98342c301d9ad87634fdd93fe34dacf02b888a35a7aeaa93d8ffc03aa8c400d3f8b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Fj:A3k03kB56rk
TLSH
T1A8257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 28c8a35b98898f653820c8a5ab121a51e041ca9d5eb9205123694bb37a03f457
MD5 0ef1091a01d68d88fee6af524472c46d
SHA1 38290e295fb75ec658b7c9ec4f451c2e48b95ef5
SHA512 967e76f3892ada9f9cfb748283865f143be23a22e5cf7e0ad88ec4025b17b6affbdb94b66802cc7fef9c34bffec1477e1ff22e82d04e3ce86cc3ede9a67db035
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Mg:A3k03kB56rs
TLSH
T104257B03E6840FA5D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 7b9908000b35f5039f368acb9ddae5e8c4c8e9236526b2c65f70c7185d978622
MD5 327350ddf4d7cae89ed2a9e40b7f8e26
SHA1 ef3802af008064bf2a9b2623e5e8274af8a8d0d7
SHA512 07bf8f73784adbe13d8c20b25283c718dc507e6b7a83f69ffc0bbb048938ae3d7071212ea5002d3c934d83f8f69e0d171796c116db2e0683f396386bd7ef5128
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2TI:A3k03kB56rl
TLSH
T134257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 aeb1ee57e3cfbecc07bded039de52aa3c691aa47d1baa07aed5767c693fd6b49
MD5 f404e3afa563147fdddaf6e1fa680490
SHA1 375478b988b2230c6c0eb448205d6a5de3ec6248
SHA512 94e2f29fe374540214d1a64a9209e077c8e3428c6e7ead7093a7e2f0c65524d8407085e62badfedb7656dcf45ae5453fbde738519178bed85070fd392be7eab4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2po:A3k03kB56rT
TLSH
T11E257B13E6840FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 3f3bd75bd3f7f3cbb2cf75363f731985e61d85c7c978fa9d46d4a75e3fb8234c
MD5 f2d9d86f6ebb9b971fa7894029e8eec5
SHA1 da029fd3554a80967457ee2a598d09458f49d15d
SHA512 4cabf754163d5a4eb79487da489dc21f71377ce7379a6cc1b4a01a4575d0cb31b06e2de405cac673ffb50ee0ec807bff48935e86bd80cf163f1e39d2171cdd0e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2a+:A3k03kB56r2
TLSH
T1A6257B13E6940FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 bab3ab35b2eca3c3622495b96e181523d41c07331b6ad9983622e52bfd6dd61b
MD5 3766d444738899f8abceb756439967b2
SHA1 5228b71379d906e0898247d3666f4e58d701bd21
SHA512 b8aeab1b3c0ab2b056246399add6691716632dd03432ba8d79aae9fc33e850a4a01a30753a8e57e38213499cedab4e9c2f861d0b8628d5f2b42f00211a335be9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2aQ:A3k03kB56ry
TLSH
T120257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 f8a27078fe13c3d09d88ccde6c89b7decdb478268d62a54f058162b28ec0e212
MD5 a453792c5236ccafcd672830b30ed1db
SHA1 1882665e30511188225b3dbc3c6eb4376a7705d5
SHA512 0ad995a80a78c51c65130ecefd73b442ed690df257849d16d709bed20a27cef657b45c622ae94fef827471cb193af1034f7b477f0c31133d4a0ccb3a546d64d8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2rX:A3k03kB56ri
TLSH
T1D0257B03E6850FA5D00FC1749A964662EA777C425F6093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 2fb1d8f4d36d6180dbdcaf1d070a8f660c0a17813dc6c996c7f3be65a7fc6d30
MD5 bc79698a39ece538d4daf189da6a6e81
SHA1 f10bf1d7d5bd0ed979d4a3fcb5495809913ce72e
SHA512 29ea9c2576db42383d030f008a3cb7d97f90faaf3ddcd1eeccf72a4e68448ebe4d1addfb55bee24c9b8823f1984a0fe29f911514998e8136947e78a1f6dad70b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E25L:A3k03kB56rM
TLSH
T171257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 2426bce85d99216e396d1c1790185d22cd4959fb74ea6f011fd7938b983a25c2
MD5 22bafbf92accc71220d55050b082c396
SHA1 77ee3c02f88791ef84b40b076e674d22cdad9398
SHA512 e7b9a59678d11b8a85c15f0db7f36dda4312235ce0d222b4cbcdb7068f6fb38dea9159f0c7d724742a6ccb3d27edb946889ffbb3585c0227fdba545f5ad662f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2nM:A3k03kB56r9
TLSH
T18A257B13E6840FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 4d48cfa1e6577f98fb51d0dcfac94aa1ddcdcf2fccfaa8604900165bd25f07a2
MD5 5f55a41e1efbcc8d345b5f4d6191b873
SHA1 1141ea9fc9bd4052c912fbc74c761c785335b957
SHA512 155adf0469c6b5a4b7df1de47269b61271ec9de3794d43d3f209b9c7d4476682cb731a5696c7720559c4afc477e6899ba87541929b8f056bdff2767d77ef522f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E2Qh:A3k03kB56rX
TLSH
T1F7257B13E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3716-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4452-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4452-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads