d46d59efb02a4d7ac3e3d45bb96f79fa1875a70471898fa5f9fd6ee09de0d5a3

Analysis

max time kernel
109s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
Size 787KB
Sample260802-dt2qestbkh
SHA256 d46d59efb02a4d7ac3e3d45bb96f79fa1875a70471898fa5f9fd6ee09de0d5a3
MD5 3b4927f81909de7d6cd4bd2dff026c90
SHA1 de74377924773db9d6af5305318fa23dd5292c43
SHA512 8fdf7c31da9c2cf08ef62bb562bfa8e649c6828aa0421a69d498a2f2fdf4fcd8ce9a1a5cce1c6ca6294fd69eae1442f9061143a4f9e137ede61e62b50dea78d9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0a:J/sCv7QExqatgl8beJTTx0yAe0N
TLSH
T104054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/4912-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5c6-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c72-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198be-343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-470.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-864.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1040.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1096.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4912-1508-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4412-1533-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4412	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
4412	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3b4927f81909de7d6cd4bd2dff026c90_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4912

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 787KB
SHA256 d46d59efb02a4d7ac3e3d45bb96f79fa1875a70471898fa5f9fd6ee09de0d5a3
MD5 3b4927f81909de7d6cd4bd2dff026c90
SHA1 de74377924773db9d6af5305318fa23dd5292c43
SHA512 8fdf7c31da9c2cf08ef62bb562bfa8e649c6828aa0421a69d498a2f2fdf4fcd8ce9a1a5cce1c6ca6294fd69eae1442f9061143a4f9e137ede61e62b50dea78d9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0a:J/sCv7QExqatgl8beJTTx0yAe0N
TLSH
T104054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 ed10cf72a0c4111bdb30f02d48c7f007a7f2bf2b99016264cd401f7c66dd1bcf
MD5 66d8af7eaba6954a28996afdda1481c5
SHA1 a6b4a5ebf9e0f876dc333124804a817221ee2127
SHA512 d67d1ae0ae8ca0e984b46772f11e0de3cfa8500c24d828d9bf7451b29d22c70e1ee93982cc83e54033970672f16b2d37f7686f8a6bd7e03a2cc646fe81e151cb
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yAe0Z0Le5ji0hmxNrM:NDqatgl9TKJPji0Aj
TLSH
T1D0555A53FA648672D0228175C4E79686EA31B4461B3086CB13ADD77C2F33BF1A63A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 802KB
SHA256 95ec164f37b870044b3047cfc022b482b516f753ff9f75ad4f2ca5ffa31fb490
MD5 d30a0b7aceddbe822022867ba0f86fda
SHA1 af6d88fc90b9a8f34ef5b26cceb60fc89d231343
SHA512 6166a29c937507f00ce0e745f429de1e1f7dfb7954af3e2ffb2be1aa2d22c76fb983905ad0c1473d9281bf87211eb2635e1fd325c7915161b485e6da0330007f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0ka:J/sCv7QExqatgl8beJTTx0yAe0La
TLSH
T1C1054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 835KB
SHA256 e30976c24968dd1af84933fd740db160d3218390566271c443c71fc4935629d4
MD5 0e9663693769450da221587be2f38ea1
SHA1 c95468dfebb799a16d7a3d2025274daa206e6d91
SHA512 e3468128ea313d7b88a3b04d514dd8a3b8df62d3230e0febfdf67163c6b5ace686fbdc55471d9627fb5e9e4b10691ab918ee480061778047e8a8570aa2fd84be
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0vb:J/sCv7QExqatgl8beJTTx0yAe0Ib
TLSH
T192055B53BA4485A2D416023054EB4253EB75F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 811KB
SHA256 bab76186e5e277dc12e22ab19b9d4516cfaf2b2bb2e907530362a4540ce3bf21
MD5 fc2c71442111266a9d2962859c4e5c80
SHA1 4988723220fa487f37f0de4c1bebb79e6012a40d
SHA512 8f1416585f9f970e2a942ec9b56b1cfe8e0bbb37e3098372762530343661f6bbc6c35b85f004ae012db23c3ce0662d817cac3a06995445b233472f00ef4d16a6
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0d6:J/sCv7QExqatgl8beJTTx0yAe0K6
TLSH
T150054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 811KB
SHA256 af18df2c8dd7273d01a062cf5aeb3fae97299072d24a7519da143691fb9b9a02
MD5 668f895a85f31356f5f37d592a1aa5fe
SHA1 ee2714288ee3eff9d79a7d06294d189444ef1bd8
SHA512 4fc875cb315fa8d8c5d313fd81baf02b419e0951e37af7cefe40b8fc72fc09519ec6321d1354935176044d7516234638e36d7b4d98b5a513b2382fd747cf1137
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0zN:J/sCv7QExqatgl8beJTTx0yAe0iN
TLSH
T129054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 811KB
SHA256 e615261bf780b2216de3d4c9b9b5a940580d11ba92c41ff970d69e061a71cd11
MD5 ab1465beace063d9b8e172d077b08a53
SHA1 fa40acc2bcba3104f850536330fecf5440c1f827
SHA512 6d1e1e98e09d2aef264a0d6eb328cfbe8e37fa7ccb945cdf623b3205d9662d7c7292a487942eee8205c7d3ad1132056d6421c896d6ef687121f6c8b29c4a0d17
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0Bf:J/sCv7QExqatgl8beJTTx0yAe0Yf
TLSH
T1E8054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 949KB
SHA256 b71d95294662729d8b9353d4398c10797e32eec10fa76cd9e1b1cbcb3f5c1886
MD5 0ccbb88e52a93f7217426b2a1a5198ad
SHA1 e68eeb661e83c9ff5466851a505a384af5138cfe
SHA512 664faa3f8df7eee09b7e1f81cb4656e9588d279bd2e7a33c49b0505b9e340cb24eecb62aa5a6ac681c89959440090ae41f1c6bf2da8618c80436560f5f95f00c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0FyPz5L87:J/sCv7QExqatgl8beJTTx0yAe0bzy7
TLSH
T149255B53BA4445E2D416023148EB4652EB71F81A1F21968F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 811KB
SHA256 65838aec382ca32d9c6b15bb72e699405c31f5254b71e3647efe61bff6561d3d
MD5 b0e83e78f475f43eb5cc8411fdc14a4f
SHA1 1f69faf1fb26ce0fc1939742efd4717662ded746
SHA512 217d05bafb6b7c2e1eff646f73720cd63a91a4ae93cadb1eac36f20e2c89de254af3b4ae6922e6f47dcf2d0843c8fd5a01c251138b6a4ed81a5bd1fb77596f4f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0jo:J/sCv7QExqatgl8beJTTx0yAe0yo
TLSH
T1D0054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 811KB
SHA256 a5171a1f62705000de96f3badb050ba8f561ee84022555bccd0127d353859829
MD5 906d811355ac47592e68eac2c8246623
SHA1 db9ae09cbe84de0798c236bcbf1b12d1bd765358
SHA512 c7a6779d31c493288c4ce435a9025080c7de33eec51b4aab99944ed9e6d968006656bbc0cde3900f7a2d5dd261b09f377b711e9bc218e074fccd115905f741e7
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0Xu:J/sCv7QExqatgl8beJTTx0yAe0mu
TLSH
T1AE054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 949KB
SHA256 1af4b08b8dddfd4fbbd6667bd0068ab788f423d0165d7edd535894a5ab5cdf62
MD5 9bc25fdbfc5c574aa7efa7f686176eaf
SHA1 96ca1a115279f98503bb94a4025a1781a5a4aa98
SHA512 df558cee094f7ee6bdf2090bf2254710336cff176ba6c62eb77202f913108c85c863440f3784bc79e9d7f1aad6d7c3f8db7f4afebacc9bbaef9ad61653b7f200
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0EyPz5L88:J/sCv7QExqatgl8beJTTx0yAe0Ozy8
TLSH
T15F255B53BA4445E2D416023148EB4652EB71F81A1F21968F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 811KB
SHA256 d72ef950c93615e29da34e160ed48c4321cb0e85197f0bcaecf18fc7f850acf5
MD5 995bc716885c3dcf4095d62d2e844f14
SHA1 17bf372936d2b9c152e3cb0785b5d5855ad07592
SHA512 a548fdc545f62b4407f462bd0b07d29fb372f52a351bbb7b7cf5caed84da1b0dea8070876f2c54d4d216cc7ad84bec8430492b227eecd5e6749bc0fde26e7d44
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0l9:J/sCv7QExqatgl8beJTTx0yAe0a9
TLSH
T15E054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 811KB
SHA256 8126cb15d4e391b8538b75eed78420b1c198595191ff3071c1de440c89833b1c
MD5 f1c1998b08546920e57d9fa1f82fc460
SHA1 33d8caac95a4813bdaea2a6d3f2b6b18b8e711bc
SHA512 6e212fe61b678f25bb563488661acce50b88c79159a83ceb92d4b686d8b38d8a354c6c37e34e380afc2d840ae81ade14b546bb35bea5b7a007d5f62cfac05706
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0Bc:J/sCv7QExqatgl8beJTTx0yAe0ac
TLSH
T1F2054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 811KB
SHA256 40702e218e7b00729c20faa9be67d76791fd57d8e797d6af65d42f7d8694809c
MD5 5ed13ec8695414fe2077c98665ca1769
SHA1 9486fcbee0b6a79da914e166523233460d40b5b5
SHA512 48161320fd65075b4fe90d3b012618142c52b2558ef880c4e761a269c81908f18fd4d58b6bd0b6fc004980b48308cdfc5bab48bd0c5f7a03cacd8fe4dc4173bc
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0qp:J/sCv7QExqatgl8beJTTx0yAe0Tp
TLSH
T16E054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 811KB
SHA256 89682b07175f4fff7f57676e70ef1d05f50380e8d4284cf5435fa90cdf683003
MD5 ddf617a2ce85b2857857bf5aca5ac84a
SHA1 2bdf2980cf30896f94019453911c70712cd65b7d
SHA512 f33bfddba237e80d7a1982daef092aed80259c005057d7632164f09bd5b128806c0d81ee8dea321fd5256d8505d76cd51a03693016fe37b7d0b1f57d6059307d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0N0a:J/sCv7QExqatgl8beJTTx0yAe00N
TLSH
T1F5054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 811KB
SHA256 c33154f3f578eb88df3871bb58320aba452906807053468d2c093a7c916044fb
MD5 41d218b05902263bc846e2f088a4a168
SHA1 c115ccc6a1628bf8cd95d67cece7f0921834f99b
SHA512 64fb9a7cf5b814f6c89199e8a15f4b62bd312fe9260523e2ec34c17a96e81e3496d01734e4eb1becbeb69bfeb2712236ee601496e6c7f0eddd60b6c10ad2cbbe
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0/F:J/sCv7QExqatgl8beJTTx0yAe0cF
TLSH
T1F3054B53BA4485A2D416023154EB4753EB71F81A1F11928F27BC9B2D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 811KB
SHA256 70293825d7910014f79583f528627c13c19afe3259af25c4825141f275bd8ca0
MD5 18e39c66f3d69982a42f21870c95fb3e
SHA1 d914a944a54b4cdb99924c207d7c56452e77deb1
SHA512 4895d4440e9f71f56362e34e8a4ec9b257a59f5e2c0ec6dfba7c0f01febaea8c0a0aea5a06795a04a482eae052d74e226df5ca58e3d7f21d33039489d71da24e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0gC:J/sCv7QExqatgl8beJTTx0yAe0JC
TLSH
T196054A53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 811KB
SHA256 a4fcba8326f0ecb43fdf88b91895f692293bccf7a149d903d76764b2ec51424d
MD5 041bca87757d9df152fc859fb841def9
SHA1 fcf9238e99be00c90e479982c54f759aa221d787
SHA512 2376c36c6cc7e01cd4d2abdc5a9d99cb9e4915f22917d2d1fb62039a6be1d79202cc2b3001bcdfd74b012c8926830d851387995008c6ba199f72efef629dcecb
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0zw:J/sCv7QExqatgl8beJTTx0yAe0qw
TLSH
T12D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 811KB
SHA256 2afa5febeb46248b125bd621ad1c3489b8c196c172d0d3b6113289dcd2c29929
MD5 c54ad248c59694c1534f16b0eeccd864
SHA1 657c0cdb303d3089e6a9bd4d771fdfd4fceafe93
SHA512 f5c690e4d8b6e9b5f25b3a064530761887454542cd842ba533c95ed6c2a1396f80256810593ab8c0d33794dfcac801364af6130cff26f57fe95278ed23b984f1
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N06T:J/sCv7QExqatgl8beJTTx0yAe0xT
TLSH
T12C054A53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 811KB
SHA256 7f1280cb6b74bf8c699197d560dee462ce65bfc7ad79377ac5167d7697a6655f
MD5 ace055053473c942c848527df08383a8
SHA1 0b96e183827845dd0073b9b458756af813d4077b
SHA512 1a9e9b1384e8156fab260668fc907bb620481e2fbb775cd0ada1c5ffbe7c4342ba79f8408c9118ae22b93d2a7d2fcc833577dc51861e1b0383573b4aba4c95c1
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0au:J/sCv7QExqatgl8beJTTx0yAe0fu
TLSH
T16D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 811KB
SHA256 310896390e40ea6adca60bd7e6ef245c3f58f66367fbf3e5673d83d332184dab
MD5 0c36c37f05861d368e1c48995c665baa
SHA1 a141069d055be64605c3e8ec94d270cdbd81f173
SHA512 da4c6d25d66718627fd3714b6074a274a11bbf70e31036727bde00bbf32dc0f3ccb145e36128f2b4b978844cfb2e7f6dc45368684fc66f3ccfcf8b0de60f8c7a
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0kb:J/sCv7QExqatgl8beJTTx0yAe0Db
TLSH
T12E054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 811KB
SHA256 f47158b514f21e3b80646c10f4082c227b15b3a151fd86424ec304755f71a4a1
MD5 d52ac4474ccd14ea0e3998e6c96d8676
SHA1 4a37b59cd555f32830eb8c413ef0f1d61a656f84
SHA512 a5fc92c636dc8c0f70fa08a6b3eeb392f3f218e25b0df51326b008cd7a60eba9a3ba0a137720d96b1daf73523722b61bee237f63226e41c75b96f41fc23adf10
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0qf:J/sCv7QExqatgl8beJTTx0yAe0Xf
TLSH
T13B054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 811KB
SHA256 7787aceeb5534f1df65d7ec070def215b24e7299549b909a3c7faac2c06fb0c6
MD5 868e2ea8aa9d3ce928017d3afe3e5b0f
SHA1 97fca8b91a3e1e350e6fe726571543622fde3e2b
SHA512 74c3c7206ec92c30f613d6222a55d113e8d2142312240d522f68c115ffbc1fd3a6cc87fb3daa406fb93ecc8a043efde05eda4b714ed78ddaaa600ac41f9a6682
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N03K:J/sCv7QExqatgl8beJTTx0yAe0gK
TLSH
T186054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 811KB
SHA256 ceea3aeb50cf82dcf6a747c81db8fb9697ace486e2631932f5715b6dcf3ceb47
MD5 f21df7422a1470f694ba522b4bd8c3b1
SHA1 063301a14226a9f3c4c23fb20a7b703203d52e5b
SHA512 35dc4b95e77e5dfc5620ac9a6f707b9e9fc4f6783ef59c16a4784a9fd7c5508f3efac0357be7dc23c02cf521d5d2b008287ac87e73f9ee8b0c4f4dc863d19d42
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0Ak:J/sCv7QExqatgl8beJTTx0yAe0dk
TLSH
T154054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 811KB
SHA256 949347dfc4ef1043dea6985886fe8a5a7a77edb6368d437da056790623f085b5
MD5 126b8677d1b1ea3994f5d5b1e63261c1
SHA1 0ce13bfbc3d20f3b530a2ba42ba79e1ab1a56e84
SHA512 14e4f77effaa735f94775b1b441e7ee24a0ca509517b6c1619090af4b66e9e050cb3071e402959263e7082373655b94fca8cbf75f03def8b34acd8a052dee73d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0x0:J/sCv7QExqatgl8beJTTx0yAe0C0
TLSH
T10D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 811KB
SHA256 f25c11dfceff24f7f5df6b8a4f19195b6ed27c17f0f5e26a1d379ea5c0d567db
MD5 45ed2ac5e8d2b1eb2f14f0f73221c836
SHA1 7e85a94c848bb4060c548c801c45906b70a3b3f4
SHA512 687cff7726546f6da3d9f04988be6b232d7409e1c3b7fc73293c6449ee1b33068e13d72087dc6abb2c02f48fa55ba7fcf8ed2496bb9b1d345716a19226984c44
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0k70:J/sCv7QExqatgl8beJTTx0yAe0Rg
TLSH
T107054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 811KB
SHA256 95595321dc536a56c7b17b12f24313a294a3d234cb8c77dad1e7a60667f84d43
MD5 fdd1e687091d85e5bcc77abdc24a0ccd
SHA1 629d4038b1dc18f8e19b6a44808ae786bd07b2e4
SHA512 f327256b2910b1a2f2e27aef192c42eb7fc3ea775ff7c5fd14c776beba0a137f316582b3f81d1dae315e68dea4ecb2cbc6e5327fefaed3dacbb3303be8f6747d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0Br:J/sCv7QExqatgl8beJTTx0yAe04r
TLSH
T180054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 811KB
SHA256 b33d7499ce030bb7e921aaedaecf970a9c2216a26bb61df4e0b068fcecd32686
MD5 0b7323a73a1024b699504fb02a4868bc
SHA1 5b4c8ecd6cc8d40189b1dc498b1270241919f94b
SHA512 4acda8eaab80d7eaa48568b7eaffc3b0c54c511ce162337d05ba0131f6288e56affee23529e4fb8d8efc3022174a472bbc8f3bfcc5eed2db7d986a4fdf69dd7c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0Dn:J/sCv7QExqatgl8beJTTx0yAe0Wn
TLSH
T124054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 811KB
SHA256 336eadbc27302907000b2f9f89eb3016f749ad68ace7b95bdcd8ce51e289f0bc
MD5 154334b7a5a8915485bbbb864598eca8
SHA1 9d329baf93975a7d9fbace5fdab5040f3e72a049
SHA512 21c755bdd54388e56713bad0e4742446218b2501bc2151e471ba1600bc22795f5f096e5a4108910f7482710b14b8550aff96a2465523351c4962c04d1a908ba3
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0fx:J/sCv7QExqatgl8beJTTx0yAe08x
TLSH
T196054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 811KB
SHA256 aaa16cee84cb8a8fe3c146d8db5087fe61cdd62108720cf23e3d24eaa246451f
MD5 69e90518c86beb33a3716a125c6ce8af
SHA1 a7487c9493b7dac06ec24afc526be06287268502
SHA512 f46823456b6cf2cc84faff1074846e5abcb944483341d80d10e258ee341eb79a91292b7e9d4d2f91c797bf3f0500efc1702e64106b9cc1f0053531b47e5e25db
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0FA:J/sCv7QExqatgl8beJTTx0yAe02A
TLSH
T1DD054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 811KB
SHA256 ee92be4c9b946ba2dbe844fc16de9108bd1d50eed0e81e06f3448524a03c35c7
MD5 9ea257272bf3dcb20fe360318e9ce3cb
SHA1 da12a3cc094ac34858d483b13dcb6cb608ac0909
SHA512 faead4664bb123784a6a077c689463cadcced14d0f10c60b1f304e73121162e0311bdaf0f681590fbaa832f672de01c1050273435d95615329dc9c646259bfa3
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0+9Q:J/sCv7QExqatgl8beJTTx0yAe0v9Q
TLSH
T17B054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 811KB
SHA256 53b78ddf9c37d0d019fa87f034d308350580f56ae66dbcbd50e0947fef2c12a5
MD5 3b04b8002194d6d0724e32420d67e1e5
SHA1 a8db5997d03942c597bbf5b3bc9e5201dbe958b1
SHA512 fe8d429e84ab8f4caf2da6372b6337fd496748b2dc0719e3ec1bc609102e6608c9210debc06391db983b5a0ec5e35b6b4c8eb363a8102838257f555b65907007
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0r4:J/sCv7QExqatgl8beJTTx0yAe0G4
TLSH
T1B8054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 811KB
SHA256 6e517a599604b776a52f69f3f647e552a66cec4446d6f499946a02f65c8198c9
MD5 8a16746c46aa922c0ed51e82fdb0f83c
SHA1 62456143d568f3394b0a176650cceac505add8e1
SHA512 c4dfad244e4ff94a937a1598068d0537bbcd6e360d7ed552be619d38d220ea7f234ae81a7c246b273551088bc6949db39719f275090bf45c84a407ef1a1da8c8
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0iu:J/sCv7QExqatgl8beJTTx0yAe0Vu
TLSH
T1DB054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 811KB
SHA256 a43738b05974b252d9c462c575120f4b5dc0b6c35db9120bf69fdbdb89ef9793
MD5 f248a18da1cd15875ddaeec35bdaf330
SHA1 6b353036f6e729b7a482402591a3fbf854e86367
SHA512 24a4544cdbd070452dc7d4baa445144acf2c75b8b41eaded2342b54694bf9c5b95d7936169971c6ca505a8c4c93ab784706a65a5d0089ac5ae965ba031ff9cdb
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0zj:J/sCv7QExqatgl8beJTTx0yAe0Ij
TLSH
T163054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 811KB
SHA256 c11495a0b156a52bc53aebabdc3e1190709b9099c689d0d31566e72805b4f99e
MD5 e77439935ccf366b8479e8770dc76480
SHA1 ecf75bfc048df947c660b8465eea28f56ca2484e
SHA512 e78ed91c1c754533e0164186ecdb61a8a167a274504f76f7df614a7cbab1afd96acd1f8b1f5f28cf17b9906b5bbd9cac09dd1289f0169f91f61101f7507952ab
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0+g:J/sCv7QExqatgl8beJTTx0yAe05g
TLSH
T16C054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 811KB
SHA256 5a7db38f49485e440a3c2aa34817524e949588fffd84e24ac41b465d6e720a82
MD5 466b0623a1c33cd70f1e7cf1b87b382f
SHA1 c3e03521745a89c7e89551f9dcf9b3c8f2ab0a5a
SHA512 c631c7803a4d727e488a38b18c0171e1e1550ca33ae384da2e14c3b9c3bdb5e621350ea781295fdb508abaa01e7add292b49b6e690a909557d23867d7197dc1e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0xI:J/sCv7QExqatgl8beJTTx0yAe0gI
TLSH
T135054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 811KB
SHA256 715d564547499d41d5b32bd28dc83f07c1e8d1a1451a653637474c82d656a86a
MD5 7c9ab507db5db0a3fd69460b730c1cfb
SHA1 09edbce884341a41e56157c67f6f251e280ba755
SHA512 876ef70c5510fcd002b73dfea66fe6ae8c2dfa48b4c1035b559056be3e64484d22135bf156519f4ef13ffd7453678b910384451a6d596af42f04a680af1c181c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0zo:J/sCv7QExqatgl8beJTTx0yAe0io
TLSH
T130054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 811KB
SHA256 19949c57beef5748e6c2635654f6d9437859b4282b8d1f97d6f39a0afe29b8ac
MD5 779c2cecd37dd0154c546c0932eb912b
SHA1 7db67ae040eba91522ea004614408bd34ac35348
SHA512 7fdef247dbfe4dc711549a8fc584b99501e1173e270e39088bd5bf2f72e8351911e4c47312a2f14ab507d5b279074ef6b3ec71c13e0b15ddb7c7f4b5e7fa60b8
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N04+:J/sCv7QExqatgl8beJTTx0yAe0Z+
TLSH
T12F054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 811KB
SHA256 a46f8a0c1dd760bef05bd8b32e927c50ffd0fe61e2ed989873d89dab85a56572
MD5 d1e4ef03a968b6368420dfaf0699d154
SHA1 80a18505587d8e565f8e78c8ecb63b9bb80266ca
SHA512 773b99f03f2c17c06bc06390ccf49eb6416f974d4b71e7fe8a3b7e7ee311e2c793be844bc41134d375e5d78ad53d7b8d207f2600fe3bf6f47d0316d6a91d9b53
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0QQ:J/sCv7QExqatgl8beJTTx0yAe0HQ
TLSH
T1E0054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 811KB
SHA256 54350fcdfe7a0c1c677c0b29c2dd566de5a8f715e792bb9d217f6b668e003895
MD5 74c7e16dffe2af8735628eef72303cd1
SHA1 1f3fba46b14aaae27c201a21143d250f8d4c7105
SHA512 eec5b3195b25463138e5b5e7456dd41ef28354b45bbabb273327093fbb1a633adccdd5ba46230772d59d8f37fdf1160b16be0fdcd53d33d04b681e928857e130
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N05X:J/sCv7QExqatgl8beJTTx0yAe0cX
TLSH
T128054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 811KB
SHA256 707301be5ca22447d0800314007fc2b6b223016d74d7f716add8c09b70803e94
MD5 9803a8ddde487d6549a6d1faa2e026d4
SHA1 3b217fd76a1a6741a3664d5e99c190bf2372c06b
SHA512 6900c9a211b35b8b47dcc46150f4ff69d40594cde3b56f6dc6bc2aa84723421cabfac385d07096045bca6b428c10854c546cbbbd5ebc8fbf4241a17389b692b0
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0TL:J/sCv7QExqatgl8beJTTx0yAe0aL
TLSH
T12A054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 811KB
SHA256 24048734c45b124614d5544d91e38d2e106f35c877b2edfa47f0fa070209530a
MD5 54cb1a8ae15c27cb6bc717160e269662
SHA1 a1b68fe048505f2f51ebcac5e8d7aec2b8909876
SHA512 c764af98ddac152674d98ab8438d42434f89e20aacd45b184054348d29b461f20b144061afeff866c84061bb816332e80f685c53de5f39a990a005857ffad04d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N05FC:J/sCv7QExqatgl8beJTTx0yAe0+M
TLSH
T1CE054A53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 811KB
SHA256 6bf200e49b942062f9f787cddb128ff6feccbc317c092693ab0032bacab24d4b
MD5 6ea2ffaa7a24d3ccf826df19a0747fa1
SHA1 23c0f21ef6b24b33c2b31d688b66d40f418f42fd
SHA512 e9de90f921c720e2005e23a8ee45436bc5d00cef480a4689410bf2e3822c0eb1cdeefb1237315cadac07a3968acbdf14b7ab6d5b6ba433f5123dd7d66a7ae48b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yAe0N0Ch:J/sCv7QExqatgl8beJTTx0yAe0nh
TLSH
T13E054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4412-1533-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4912-1508-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads