7bcab5e497f34737b3ce88614bb4b430baea4daefcf9222dd5fb2499a562d5c9

Analysis

max time kernel
107s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 933KB
Sample260730-hrwtlsdd95
SHA256 7bcab5e497f34737b3ce88614bb4b430baea4daefcf9222dd5fb2499a562d5c9
MD5 470e53d8ada0ee8bd5cf9c95ff011ac8
SHA1 2005bc01525e1c8d74849c3eef5eb32e1a02c1f3
SHA512 289af80e8d526c5020d036d57e50554a773fb966aaba9068b0b28c8162d1b741f8a141c1ade62c1417987a4f17fc7ab7702f4937644067de90558ed236b20ce0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Z:A3k03kB56rR
TLSH
T1FB157B03E6850FA5D00FC1749A964662EA777C465F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4292-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c43b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4292-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5140-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-652.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-768.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1292.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c43b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-652.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-768.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-842.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1292.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1335.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1354.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1380.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5140	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4292	2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
5140	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_470e53d8ada0ee8bd5cf9c95ff011ac8_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4292

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 7bcab5e497f34737b3ce88614bb4b430baea4daefcf9222dd5fb2499a562d5c9
MD5 470e53d8ada0ee8bd5cf9c95ff011ac8
SHA1 2005bc01525e1c8d74849c3eef5eb32e1a02c1f3
SHA512 289af80e8d526c5020d036d57e50554a773fb966aaba9068b0b28c8162d1b741f8a141c1ade62c1417987a4f17fc7ab7702f4937644067de90558ed236b20ce0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Z:A3k03kB56rR
TLSH
T1FB157B03E6850FA5D00FC1749A964662EA777C465F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0defc3eaa594907fd6cea8f1bc6636f83661454d97816becd1d0e049e51cbcdf
MD5 9e7b6a3be39e32a84b02fd1b43ded7c9
SHA1 093b246c51ed52c16a448232a1952ecb68f81166
SHA512 09db4592c0bb9379559d30b57444fbd9463a19f4b1921b8e420b4c61d95e8e55924689896689140a418e5681ab6f38ad176d4a0ee5acba344b3c7e85cfcd97a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3F0Le5ji0hmxNrM:A3k03kB56rtPji0Aj
TLSH
T13F655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 af8caf836b0136e627a6e07f3aaae52216dc259307a46a5c93b195df4be16e9d
MD5 a141171aa51ebf0874c3e65ce21e7f64
SHA1 8eb4d5048785093c662798deae9e312750ea6fcd
SHA512 d275d0dc4e92802fdcd7d5707ac3ea485b716721fdd9be5641f835c695018b44231e255f0772e121f8d18d3c7623c1a29917ddeeb34e583a31a5f5cca3e97240
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Ha:A3k03kB56r
TLSH
T1DD257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 27e48c8072be0e3121e26cb51c8065e14b630b41bd4a5feef6d7027a61270354
MD5 646a95b7de5b0478cdfd8826d7f70c35
SHA1 78e89c9f6335ef52c331a76c0de2462a902e5a2f
SHA512 e4401f51feee9a04aef1626a4d8487dda2dd7a8ca1c91ac1d5d9fd97ca50cec72d7c450864c87326a8719c6d0517c93ebb4a098c131615fb238ad2b3ce84c9b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3m6:A3k03kB56rJ
TLSH
T1B5257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 2de630f3dbca4b742d8d56807183636d487a50f5d07380f4c3af09b483051194
MD5 67e8f64b839338459b5260f82705f674
SHA1 c9063a4f1159b486918a8379760eaa20f59f8dba
SHA512 091fe6f14224e4e77addfd36b75d546a5c1cd8dd93a2480c7077fa2ba44559ec0114f1e0c0e94bc57f9e05ae58e9796a528ca75643ed48851d7cfcca834e2d8a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z32N:A3k03kB56rw
TLSH
T1FF258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 1319a029be8b5dff9b04cb5d60864eca7a9de275f18ff0a4766360cddca8e609
MD5 b3ddba19f3d5d0660022f6ff0e023314
SHA1 799e8e0677d9a4e4d331b237e2d0da9e0e8b747b
SHA512 d0f1e9b0db093377a86381cefa12d85d4927c407de227cc478bdb8d9f72ae74384d7a68b9cbd1cf66e3af5917ae394040bf274fc83491af7e6d07e80ed7b955b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z30f:A3k03kB56ro
TLSH
T189257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 dc011833a4bd235be03544dfcd55af6f355ebc6dbd0e7d25ac9e5bffa2b53d23
MD5 7b76f4635c7473577951bb2acd1befc9
SHA1 003a27432030c3bb57850c41e59841908c24eb65
SHA512 a25a09c04a536cabafbc3de31c7b80ca1c2fbc3b91d9fb2a08f9da2080e3c70c24412649da4aabb1be8f883dcd5170933ca6a367133ce910635474a30ba429ab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3eo:A3k03kB56rV
TLSH
T149258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 f10bea092a10daa03aec71240ed454f350e00778db442a715bbaa85ac8805486
MD5 6bf064535a4e7d31fe7fa827c22b98b9
SHA1 9deccddaac8ac21989b784fa6697cf0674cca20c
SHA512 044bb85b40a4c5d1cc3ffe90c4adff1a6df7dc277b50fcf50b86486aae4e88fa63d1ef3de29e56e1adb5b355fc46da0b4e0f7aed4d595e37ba27de09ef80ef20
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3yu:A3k03kB56rX
TLSH
T1A5258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 2e66c340a2014ed54b002b1e5b686c3899f499f07aa3f3d6ebda06f95ba0b0fc
MD5 5016517c24bb019e43a514527122d83d
SHA1 b659fb21590f52b63aa3b747d20c395c20e6d699
SHA512 da236da1ec8d72f26c546729c9a92655814c2b4a5c36d8df9a65fe04282797b257b66bf557238b738ed7af68bdeea21935761c2520fd04ccde852e3404c44156
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3G9:A3k03kB56r2
TLSH
T177257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 b3e9634b758f736807d7418ab813ec8865d14212ff18273cad8a74382c8d4149
MD5 9704b9c7a4b02616f63dd484c4a3cf54
SHA1 9e277773b3eb787a5f20f86223e7d45ed2ea3b0e
SHA512 528fba035a1f9754ec8505bc1914d7bdadf92c7113efc881796a171b75277a5c4f64e89f868ab5f5927e6468c4fd06ab40a63004ef4b338a80bc4830963c2b1f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Gc:A3k03kB56rb
TLSH
T179257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 3b78423c27191779f89d53ff4199a6652a63690d1d863f992ff6e561e6d41b2d
MD5 c8bfd4fee9f182534d81d2d2d61aa1a3
SHA1 795a3ecd811c2e69182a1deacbe9d28367ba6274
SHA512 7e07380052cbb604f90dc59c97b874b01614a76eb61a46b4cfefbcdc1df7d28534f238c199bc5e965720bd404648eed3ef891d781b499aa709e44686d0ef1896
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3/p:A3k03kB56rZ
TLSH
T1A4257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 99dfcd961f57bac89bda19b7554f03e9d52ab32e53776d7f55dfbc2b38f53ef3
MD5 fd9616cde28663da32a6a6afb2c4d4d7
SHA1 fc8012da51eb258fc8039d787a05f8bc9367c658
SHA512 ec89c7f38db7291ac13abede31d1b0124e731ca968332aa13d759c9a355785eea7e8d1c9d6d90873e631e190846d99289187c7a5aaab765f89406aea756a9094
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3gN:A3k03kB56rC
TLSH
T133258B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 7d2c44b20ae1c78bd98834d4f582ecb4e82ccbfee2bb662f35420358e342321f
MD5 aa8117bb833e70478ab5012d7f55ebc5
SHA1 89e153c71a5266818ddfa2ebc44477307d44526e
SHA512 7889ca3e89f7fe5e118065a1211708ff7c85f85a867389c736f11b0a7fc9e4fc93aefc303c06f3767c300e6bad9a5c4c6764c7e5f5fd03929c6ba9dbb9604d32
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3oF:A3k03kB56ro
TLSH
T137257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 55268b37c032c93030c33576b693cd6ec0d0724138177bf96b96ee6613ebd077
MD5 b318611dee6b3681b0f5c5c753b40dc2
SHA1 5a24aac8802c5e6103f39f1287a772108cf52a30
SHA512 94c7713208f7cacb9d5634170911c941a78926f6f08e4719fb9e143c870ed6a59a0d513f78c96ca6fb8e7ff8404be55d2412848f743631b9826b9aca4ae6563e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3dC:A3k03kB56r8
TLSH
T1E0257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 66c3f978010c749e543ec1a0735ff14df42e3789a82375d1af8b3b7000daeb60
MD5 c49852f78c03fa21aa0df74d5c401e0f
SHA1 c41c74181dc9b1b1e474d6fc90a01bf578b486d4
SHA512 ab3a13bdee944810ca8ed275947cce9f6ece650205c68763c51558e2f91a321f08501640d1ca831d347783a5861ba03ff2251d790c416f255650a98358e6de59
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3mw:A3k03kB56rx
TLSH
T1E3257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 a85419bbf611f4da4d03bf092d97ac7210c03ca198d7e3b1c135d819de427c94
MD5 016cde61f4ad7d02b48740f0c0851956
SHA1 7e49872fdce25069b88bdc8e70007a313136871b
SHA512 481d9a7dee33aa02a43602b292c157bc65bf43198be13880cdc2e7212e9ab4aadf5a42c0adbeacaa605a9bd1a95208bebcbd0e7ce5c3898452e9baec2bad7aa2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3VT:A3k03kB56rl
TLSH
T101257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 4cbb8a3dd8f72e945ddb3bd9157ca7148a0faee280caf7938b8484312417ab47
MD5 a65de6510690696bdc424e93d698b7d5
SHA1 2ea3c7125be900dac4c96a8919dafa87b6a43e7a
SHA512 9aca4cb052217434e24830fbef626ae3f72e53fcb705701236cb790677c34668318605fa1b38ba1dff3caff829260dcfd618605a9cb609500480bf1e943f0553
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3ru:A3k03kB56ra
TLSH
T1D4257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 536904d4709a1979d7aaa34ab7618f1b10e4935223f254a81a1934c77c6c7fcf
MD5 4b4eb2ecf15dcfdf50fd3723ca7d21fe
SHA1 266cca4842c70c456eb0d6a4cc19a9a2cc9127da
SHA512 1d9ff9e5e99ee59c31b5b474f5ba58db40ccbc7c6768dfc5137f190af1f7e7602a1a3796a0584b35737e376e5b8a14f9adbedac0c68c7b085a542bc2e1d42fa9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Pb:A3k03kB56r7
TLSH
T110257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 06870e8b978c0fed8960517fcd220fb74a2a78b1c7158129a185c25f49d064a1
MD5 c39d52140a1bb8bfea84334ef9bfc68e
SHA1 83e075808ed5f495841f051578dec8ad79988b97
SHA512 4f3582166b4e5e6c35a8b41130b0cf2407e8b56e6f645c13c0e28ebe4c8be8f34f02aa977747275e0476730ba4a5171784ced43b62a40b6cf3470b2cd8bda160
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Lf:A3k03kB56rD
TLSH
T175257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 0b4aa08ffc66989f402060c7e77d729f1746b303194964b4fa9aa9a12f2d9547
MD5 b25b53513a57b7790794197cba5fbc2e
SHA1 708d321e572490e6f6d8efb890503076e10c3b1e
SHA512 388fc564af5aafeb2c10265a5b21febac99e60e8555f04b25e049e550bca7034c07f7e76de3e9df2a2bb3ef6161995e80956fb4df758f762de505f81fda61c1c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3EK:A3k03kB56rz
TLSH
T1C6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 99b887f8cd90f7d5d2bbc4d452a0c9c1688611ea4fc457cb2ed8d5ae1ccd4c41
MD5 4ab54a67e5486d4ee96438360a9eaf71
SHA1 a06ff41f574f8fdbc50cb6c4f80e2132b1cae622
SHA512 f315459e9365102d81be7bfaca22654925d698ae32b1b4d4e11bb048619e380e16e4a84754ec05f45c1336574cb78688e85b82d43c13e653c22674fe4a1053a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z35k:A3k03kB56re
TLSH
T181257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 9e523f86b3b80fc50decb1f71f1a7b7531a4340c6db5bcef904ffa8fabf3d62a
MD5 580df5149dcbcf71f6cfbebe81447f88
SHA1 1e40500dfb0e916f021c8a737eba0b9ca20d5ce1
SHA512 74f7d2b7dc70df5824cfaa8181d02d2d31d886438751c6f7f924d4849fee0e8cbded1edc54b04498699f644f56b1cfc85ec1850f00b10e8f62cbbbb5c6414be4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z320:A3k03kB56rD
TLSH
T1C7257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 95bd044f1c9e7e49952699cfbad45268e489192c1bf7b23427fd52d52e7b50ff
MD5 71c90887d92897bbf4786a1a772c0747
SHA1 37b8a4d9012f9a37ef043c626ca45d74e9a54479
SHA512 e98f9bff8a65643ec6e44e422baa680aa0ac5512ee4cdbcc1946c29bbdef2dac005b6caa6c45b79a5b73d7f20d7c439ddbf63a93b8b829703c5eaa7470cb7416
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Fg:A3k03kB56rm
TLSH
T18B257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 cc86f3b54b71996b40dffd93f7743c6a8da93d10b6e48323f39ad9266dd59399
MD5 f10fb96a317b55b8e6be101938c03284
SHA1 9b3cd51f3113c146a5a3aba1292b85174ba6b054
SHA512 aeb83585c6f57b90fda9eecb9a50568c226f93d16f29eafba4c675df8463f8912e23061c3dfa5202f7aabfc3388f3c72b82e9bbad59dc1b0cf596b81fe8b3322
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Ur:A3k03kB56ro
TLSH
T174257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 780773a4647a068d145ce113b1db8dd174dd4f95230aee111de282c0f9182280
MD5 6dfe76cb374d0b30a502475fde5a14ef
SHA1 cec66656fbefcb091c86de0fa4f3f7ef33a707f1
SHA512 29f51de0f090e535b48dd411fc9048186387dcfc94664069c6df3ed8194e16c69e8885b62cdbcdae7ae9f3119687b6b5004a07a6a401e1955e64ec35cecddc6f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3qn:A3k03kB56rK
TLSH
T1D1257B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 9157a529753240cd3b1f35c8ec37535f2c2eef4349e9b02c26b30c216dbbd0a6
MD5 52c63c45fd455e443ac91e6dd9a87eab
SHA1 b27d26479f599ad6c27734504ab6d9698119ac9f
SHA512 bfc7f05e0b80402991ba360484a4e7170d6f975e408b8aef9ce46ae842d26bcc71f8c7cc9700db40c08ebad6fdbc6fdd9346c0805a31a14bdaa95e95f723582d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3gx:A3k03kB56ro
TLSH
T10C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 671357f551cc7086132f9275e0c1755d7ae68eb74560b941d2d917275aa13624
MD5 2dc79e7267f102da719744b2b843f6b9
SHA1 ea9e678c65462f9cf7b61877c16b972ac07cc196
SHA512 a5c276cf30d25fec9ee19a300ad4e27740dd0665fb2d45ee3636a75ed6e14e031752df1eda9eb0c79257908be66f6e90f571d9b4410480d9132389d0d9c17dc6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3iA:A3k03kB56rr
TLSH
T10C257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 b3e50bc6c6a5301a75b58f4093105e37b8bc37b305088ed6497e7cd8197ff298
MD5 89ffe3ae02b1454b6e1cc8643234ba1e
SHA1 0c0be5c50068ad34744e2e80a2b6a3c3773ddd1f
SHA512 019bb3254b9ea043194bf41c0362520db0fe4c1e64c12e0aeac81c64ca093439448584142f9a978ac40606863db9855dc231cc43fd65ee9ff5244d8e1a86a9b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3b9Q:A3k03kB56rm
TLSH
T175257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 a7455e9fb067593fd12860823bd9e94fb774baa6563820a490ea1981cbfe5bf0
MD5 c9b9b28cf231727bac9787819324f29e
SHA1 07a47f8edc5f3730023f4962c16cae3253d1d74e
SHA512 7baeec5554b567447b3b93df7b12760b3243e21c74045ad5d69560368d839d7758333e908afd11711f1706c304807eda5700623f74d7281cb6bf6810a416b047
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3q4:A3k03kB56r1
TLSH
T1E5257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 82cae218700c4355fcc98a84438cd6e69532462b0777b3e6ba333db3b816eb7d
MD5 578b5c7f3a0756a2453d136238e94267
SHA1 e0e30b2639b231445f6cbd11025a15a7390beb2d
SHA512 958f9cd6e044cdcaea0ffbaa052cf50643228548401672bdcc2782cd74b99c9ec04bad2864ddfc8d84253a5cf86f335aab36f786b24b2c2f9e7dcc053068a0dd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3xu:A3k03kB56rg
TLSH
T124257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 70781de917c81576155af1b4fe72820cf73a199d48654ae96234fcfad0e87427
MD5 28d3a86dc9a43cabeaf6499d95786b16
SHA1 25a1e957c962c85cdaab0f24478e7c923020a844
SHA512 3aca9a7f4006244e44fff7e15160e49574622bd5504f730a8e41e54db234b10c4542856ac1943d04bc05efc5b2a70f97d78e995392f2eabd6d19bd8ba7954824
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3Ej:A3k03kB56r6
TLSH
T131257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 6df0377099c06cc41e27ec8a31a579904e4de39750fac10d77fdb72c7d3c25d2
MD5 02d348db6b73bc30e840ce5cccb19222
SHA1 5c3771dd756ef60359a8181f47ca9cd3b3285b9a
SHA512 9962e3b9ab67af7f6a05a522fecb0a6024ab4a1b63041bacc405e994158ce5b0b68e5d726852356e0931f58039bff73e76865a374aa422611476b04dddaf7046
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3lg:A3k03kB56rO
TLSH
T193257B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 8fe8173d0b2233f433afe7e91f6e986f658f5cabef7192a4e67a16b220380201
MD5 e798f0f1ec6df1c4a1ff528fa48c6b3c
SHA1 30b8f1fadc5c04d62041f2d6d184dd1f2c4ea690
SHA512 10d0c5afb154d642a7f1b7c4786c222074b44bcce5c855c280c938629ac8ba8fbe53fcdea35f7649c678e81e2d6c844cebed115c010827d658a7fbc3f9fe5f52
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3EI:A3k03kB56rH
TLSH
T1A6257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 65457d521c45d5d304f7f544c7b4987fb5ec6a625bf4da587d1a98235b301ee4
MD5 1de7a983b46f1aad49c27faa171c8876
SHA1 3f59abe4abc593e7e2f0bc3143ce7f644e6bbee0
SHA512 27f39d33ecf4c3baa07a642b55c80d92231b880b2dbff1a97f5df27d93a6bfe02390d3c9779a7d8cdf4f5993054831a983f833a3533705285807ae78213cc80c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z32o:A3k03kB56rB
TLSH
T1E2257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 3f6646f0df1e9112100d0680709fc641b645b0fdc2010cbe32e67b3b62559777
MD5 286afd3b61272a5968d2d103fefbed77
SHA1 0de56f55b316bae47fcfcb8492e67e22b40e5eac
SHA512 3e6bd7e48dc50da655ff7098c05129b8408cd24e7e4359ec8aa255124d1130591600e7549c9bf7ee541cb9fa76221128f206b3074b3c83cb27b2dbe72d9f7033
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3d+:A3k03kB56rE
TLSH
T1FC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 56f5f3400ef25b82bfc09bd62f960904e56397b7a9e090b257a3bea411508c76
MD5 b4c3f153b6fa3e267ec84be89513e987
SHA1 850d31f9c17f411dabd1fa07e8f1c878850e1d16
SHA512 58d2446ce2ad390d496abb52b95e7d240a08a10d8d1565f036c43c746d2bb13901b2ab77671f3a197592677c002e57f388a2cf836aefe945d024fc64eb9a1c40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3LQ:A3k03kB56rM
TLSH
T1DC257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 b748e07bf180d0ac64eedf24fc436b3cc88d629c1eb0ec9ff54fc59737a77e5c
MD5 43a16f3bcae153a08426f22ac8c2034a
SHA1 88ebcbcc12eb615c7a443500e07e2e587e2a98fa
SHA512 396c16e1205f713b64746ec97d19cbc2a2269ed0a682087e1066a0c7fa39876b72e9c1dbcfb723f82121a1ca831b5cf62134ae93c6fc42300080162fb85d90a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3AX:A3k03kB56rM
TLSH
T165257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 81b8d33aa0acd1c62f89ec12c5712d9ebdaca9aad2a7ba7e2050c3d16aaae6b5
MD5 ed0e163d811ea928793824130903545d
SHA1 d1f9f23f50af2244c34f55d5fab45efff73139e9
SHA512 4ca3e0eab93e2386c37c875b7d9a1b84ba4020733495597dcf3551b76f01e919a0bf63d0c4005624240aed33f1f98e618f0572619f68da1a8f5b10fbd03538a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z32L:A3k03kB56r2
TLSH
T14A257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 fce722647b31fe8f6578cfa0380b136ab34f92434d45007db1fc333a1e392860
MD5 e2b6c0f9e13c9c0e5c5737c7d3c6684b
SHA1 5ed9d842581399efaef91cbf33f9a14a56fc47c8
SHA512 984e7fdd7871dbca32696bd170d7988026200a8b506860f6a810bfd55dbb012b2a98e6f5d063376ea9d4cd8d281743c1e336172e5de36569b92ba092aa056083
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3KM:A3k03kB56rz
TLSH
T1D7257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 4a4ab65191a617ea283670bcefb3b55acfd17aabb44a645243237b4435c3a003
MD5 54db6a043ce3770a6f8b99964abd0e53
SHA1 7fd5c0cc3dff6ec1509d198e7b3c1fde0514c564
SHA512 4567ab4b2ec8516d73d443bd6828c7fb9eb33180946ef8205064a28871bf0440364a49a7831382db554dc4b9be15f6d48b5c79fd7fc4aed90dcf2c42f175e8e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry00z3bh:A3k03kB56rt
TLSH
T122257B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4292-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4292-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5140-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads