93a83c3e6a520feafdf16b5e9c97a89f94d1285f68cab429fdfc92af495731a5

Analysis

max time kernel
103s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 928KB
Sample260810-tnf5jasfjc
SHA256 93a83c3e6a520feafdf16b5e9c97a89f94d1285f68cab429fdfc92af495731a5
MD5 a86f5ced6da82643e70c749570310293
SHA1 49d838e6ec166ff30f7700e2ec97fbd76f1e52ba
SHA512 ec95834e1f15875f03584817dd8559471b2738345b6a4f8b755557a5cbd60f7eefbf658be5c554a290030dc9f981d506e95e8fed353dabb7cf63f83606eb4b4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ9:A3k03kHRJi56rD
TLSH
T159155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4232-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c553-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4232-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1336-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c89-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-445.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-550.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-642.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-764.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001ba98-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1163.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1294.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c553-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c89-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-445.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-550.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-642.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-764.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-850.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-889.dat	aspack_v212_v242
behavioral2/files/0x000200000001ba98-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1163.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1294.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1356.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1336	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4232	2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
1336	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a86f5ced6da82643e70c749570310293_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4232

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 928KB
SHA256 93a83c3e6a520feafdf16b5e9c97a89f94d1285f68cab429fdfc92af495731a5
MD5 a86f5ced6da82643e70c749570310293
SHA1 49d838e6ec166ff30f7700e2ec97fbd76f1e52ba
SHA512 ec95834e1f15875f03584817dd8559471b2738345b6a4f8b755557a5cbd60f7eefbf658be5c554a290030dc9f981d506e95e8fed353dabb7cf63f83606eb4b4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ9:A3k03kHRJi56rD
TLSH
T159155907A6890FA8D11FC1788A968662E7737C161F2093DF1354AE253F72BD06E3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 4a14444c5a33962583aaec0131c0ef4a7319182bc457c6e2cf30593881d75c73
MD5 278ca622a1aca4fa61b17784e9b8b50c
SHA1 f5ccfb6ce77b9b653eae7b9d086f8e6cdf4bcfb2
SHA512 abb53bf3a2cd704721bd8f4ebd649939a4987f64818b5795ed56d4d7a8f9b076b503e3c0810bfd29e86757994d1a14aaadf22930aee05be28d4ba3eb17418fa8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJJ0Le5ji0hmxNrM:A3k03kHRJi56r/Pji0Aj
TLSH
T15D655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 942KB
SHA256 9ee0d9e941e568aa85831a7d742cf266ccef5c8b92658b918539b0ad387b971c
MD5 6daf1898389c14dc0bd0f06ca5f81b8a
SHA1 05d24e312bb05bb526fed0f02df36d50c86c19ed
SHA512 345f133b1fe5e1f40319af55cb1936c8a01eaf2a1e59b032f28442e6d07ac66b4a39f7d80ddfc2512b7c64d7ffeb14143d29b811488b3737d8dab4ce20bb8ead
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJba:A3k03kHRJi56r
TLSH
T176255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 976KB
SHA256 c75e15129b7bc2a97f493ea474f5a6218b30be5cfc63ea77751577a995d7ad01
MD5 eb4ae59a9ea21bde5a2b572305bb55c3
SHA1 d0e34f9d870987155faae524b41dad531a5aff50
SHA512 92e0ad1b509d83fde071d5f918452195e4eac704f49757a53f18cdcd5b5e40e047fed2b49d37cbd836d01b55545b9b7df20affd1cc56c05a92b8ac2626a7c81d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ4b:A3k03kHRJi56rib
TLSH
T10C256A03A6980FA8D11F81749A968622EB777C521F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 951KB
SHA256 cc2d184755c9de4064bdd6b47fe0113f35fd47914babfc5d0899ddfd6bea6b6b
MD5 2a1b9817943c177f0215946c53b1025c
SHA1 9999419a2c03f1b6d5412b43b6bc71934ace8003
SHA512 bb54b0a860b159bfad9faf65fd6da16c39c56908a1ff2b8ead7451f329895f66d524ecf658657b4699347ec30377a49441fb0f08f6d047ba2da328fdda66ceed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ66:A3k03kHRJi56rH
TLSH
T1B7255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 951KB
SHA256 bc791a0a9a2631a83bb8cd40170a96bfd5df3b952ed3924064ec72b3e6101600
MD5 6af596874230886868872bbf9e325d11
SHA1 8879886549ae69e0479a6f7a5d8796203f502ece
SHA512 9a2dbe5cc99344f9d02da137058020f24cae57f1fb61abe4f72a1bcc2a7e350c3c9e0784ccb58b70fde63d934e17bd5e3c95cc1546fe9f964de9c361583a0c42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyN:A3k03kHRJi56ra
TLSH
T1A3255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 951KB
SHA256 641201ea852e852230b220b6f7fce273569e2c18c47d0f1182ee37f646a0b889
MD5 b831ed7d77d7fe6aa81fff461473d30e
SHA1 75afe27fe12598581cfdb4ce7cd4e24d3d945ea2
SHA512 0b6d631fb487d511d2d5a325b2067ed3c961f187dccb8ecc81ec2df34e13543a0e8065a0ba5c5258ca17f9ea11704052d68a16d1d6eb44f0d951bf022dfcdd8b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJof:A3k03kHRJi56rW
TLSH
T1B3255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 951KB
SHA256 78d5793a0da1b2da48d3575528db3d5201cb2e6106d29b6a145c6ee5a1931f0b
MD5 d23a64793e3735c962d0c2afe4dda793
SHA1 131a89c532cd711ae6e11729027eb5adac2aa61a
SHA512 cb80dade5861b090b953dffe29bd63025ca93eb7cfa81dbf6fe963cbea109a8770bdc94757e3aee7afe10af3b36c09d5dba0e1282f25142941a470f67bf7ef14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJCo:A3k03kHRJi56r3
TLSH
T170255A07A6890FA8D10FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 951KB
SHA256 2cf293fda96830a621e6a1ee40c6d14d96170c52d0b9d3eba6a137f170635aeb
MD5 fe38aaa487922cdee67e0989efd13e0c
SHA1 ce97606c04f10c5be2fc2461d000034b0f311557
SHA512 ce43e885ca38830fd4816c2b750bdb2710084461d8a59f38de3e80c0ac9c76be97719f0c93ea4287515586110b459639ebb36fd2c8a0b44e58328460861d307c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ2u:A3k03kHRJi56r5
TLSH
T15F255A07A6890FA8D11FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 951KB
SHA256 bc14de61162b5155a6932b2eab3309f8b97acc875e8da49eebcb73facb08ae0f
MD5 9c2b123ef836964481116960c6d92389
SHA1 498e323d6069e68282112d1a8a9113549d5e653d
SHA512 6f3bbd6323d77e36b4d25a4842ebe440a6f3f6658ea18c03842a551d4f80569710ecabbd225c490c45b985f2bb67cb6c17f915f03047ea828b751958344fff2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJq9:A3k03kHRJi56r0
TLSH
T124255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 951KB
SHA256 7500442f76fcecea1a4155f18bd5b4d7e9d0493bb49618964cc0ed6fe19bee5e
MD5 6d0bfd550dc3c47ef59e324ebf6fc7ef
SHA1 becd7e6133dcab286699c88c2e7c2ca98f26a99d
SHA512 5b61744b4f36a9ec631bad7972e1975fa43a634c75c6fa716def01e44b435368d8890c53170e195d453c0bc08a3ecd568e9cdc00b32ea33e92b6348b5b97169a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJqc:A3k03kHRJi56rd
TLSH
T1DD255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 951KB
SHA256 16d85f421a37f25d343babf83f415d449ca93f2ad877003e3ac566d78e05cc0d
MD5 1da39844564bc6586b01290849412461
SHA1 78c8493a01cf9503d4523d6a5ad01b8b3223366e
SHA512 a8866abd7f18ca94f15609632032a2f787cd8a2356da37a5069265ffc696c2da4b744de2a56b2c749cc94ee1720c9874922dda47722ac584bba008f58a379ec1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJjp:A3k03kHRJi56rD
TLSH
T1AD255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 951KB
SHA256 dd5f750df541062e6bf5ee9cfb6087e692d43706615dcd9bd8c9511902708f38
MD5 9a55a063ae13c6684f1b0d4714096037
SHA1 5fc83efaa054d874b5ffb58987d1a207eb4a6a7a
SHA512 66731937b1805d49c76f78b11c4b3b009788c4600ac12dd710e1aa0a2a3dddaca0897ae20d0181df71e17b9f999cb462bf86358b215afa931303c941e50d3986
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJEN:A3k03kHRJi56r4
TLSH
T1C7255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 951KB
SHA256 c055d324b03c4599968dc8d8f2663993b3523d4fb0e812742ceb5d58a62f5b5a
MD5 44ec64f9fc5ce20775c9e0444905a77e
SHA1 aafc95143af311d7da0bba31ea96dc1f00eda90c
SHA512 ec071618a271aeca3eda9dc523b20b8dd13f716e541dc0e1a9a4ea1dcace5c4bf7d54cc8ac15d32f2279ecbb4fecafa74855a35347d451376e549ff53625845c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJsF:A3k03kHRJi56rO
TLSH
T162255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 951KB
SHA256 37e2ff47cabdea51eb45005e7df654f499138e66bf2ca510c4468913bd54ddc4
MD5 64518ca4c42273ae543d1c92b19f90e8
SHA1 1041d740fcd32fefe677ee86cc36184199c0878f
SHA512 f2a5a3b9a3d1c9d23ed86740d9ee90867f7afc3f53d87f5e0d7436dc53477e608d782260740c01cce787c7b1f4a81346353d9877ed79b97eece6edcd1affb668
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJZC:A3k03kHRJi56rq
TLSH
T16F255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 951KB
SHA256 4c0f497d34586ae591053418dff5266b18e25dfe617f26fa22c8c806525fd2b5
MD5 70be16253faa5c8bde56b58f02ca3f61
SHA1 6b89ec3826bb3e557e1622c3b8415d9f71f0ad66
SHA512 91c085cc026f86e208e3b5356e82542b2af6058fdc3dcb23949f841f89cb3c76af236417b37e3bc2fd04bf511d1b392481276f4a37027626c99ddfcd46471ae1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJaw:A3k03kHRJi56r/
TLSH
T142255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 951KB
SHA256 07b237fc291f96570d5e565f122250d9c2fc5816668756cd77df9e8d06db909d
MD5 324d25ca2a0aa220669202824d1e8cdc
SHA1 30d7ea7f4f75e8a11332f86968e543433ec6c7a0
SHA512 d87eb818ab2f98bdd63e849e408790bab4f78eee496c24a836a0de58b8d46c865acd0289a4f6d0b2c84f4dde304121622503d966da1815e43713455f7a4e4dc5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJhT:A3k03kHRJi56rb
TLSH
T1A7256A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 951KB
SHA256 f76555fbfd97a381088ca5137c3a6eda3fedd1edc9d818cecb7b1ed70d8c22ad
MD5 d3801331373d357b5ae52f948dcaed30
SHA1 f1ca7e904eaa577717205c554c06cd6820fc8b72
SHA512 e87f668a67a0529dbdbd90cf7387ee630cdc1a825c07ce62a9c7a2f6698e1873a744b26585684c3934745afef75a4b4eb76b8e9b8039dccf0bab823defd2fd2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJPu:A3k03kHRJi56rc
TLSH
T15C255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 951KB
SHA256 3fbc306b2daddcb53ee114a837c6517bf1d6765c2f3f3b5f9051da12378b6c99
MD5 6be7d20ec2fbd68743f02b0ad1cc50dc
SHA1 b8db418edd29be1063a58b6e81fba1c1cf6e5576
SHA512 b73446bfb4fd58cbea434425f5e88f03c3487f4e74f937d47c7729fa488a19ae4073c5b12f77781669e4e62e3b607eed0be930e55a00c9e53652186301b02cf9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJzb:A3k03kHRJi56r1
TLSH
T15F255907A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 951KB
SHA256 2f76cfacc2ef8c63d099c3df8422aa92b85d3f6a686d6da37d100f7b87a2afdc
MD5 292d35390591e64e8f91bb4f5bacb2da
SHA1 c660269f6308feb7d7a4192be7fc5b647ae02f8f
SHA512 59d0463f99c39f8a74b36aa6e767bfa57d3b9d603941bd749a57a151146c46f63f93988a7044df77a5f92cab31bf9a05d8201bb99e3aa5d79276c5c6edb63e92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJHf:A3k03kHRJi56r1
TLSH
T169255907A6890FA8D11FC1788A968662E6737C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 951KB
SHA256 a3d717c8da98736832be809d0ebc2f387af1c11186345ce7624a497c463fe722
MD5 f54924ce884912565567155c5b9c112c
SHA1 319bb3ec074175299581ac7d936fa89b7072340f
SHA512 c3b9b1988c911d133fa00bda4476a6d73e2805b4e77087afaea8835145d176e4077b58e648d798568a1b30ea2a75738385e19d3a0bcd3285396cf2504bb69c0f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJwK:A3k03kHRJi56rt
TLSH
T111255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 951KB
SHA256 cc468402386e84fee657b57feab450d21739757edea502cf26f3eb26c875b2cb
MD5 12119be45ebbe8aa223f8504f98f98bc
SHA1 2e5ef63302e49172245edc31bea4afe432cdb3c2
SHA512 e174e12159e721edfaef5cf52670e6e2db84528e27c22a46d5840c6d0b0c7eb810316b5c43d6c21d5b5eb229c44cbb3f2e381f8cd16ef7a92a72e3b0e26210f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJtk:A3k03kHRJi56rE
TLSH
T1A8255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 951KB
SHA256 ec7a72bcee457f4f87b10a154485f39c0907e77ebb4ddce5ca27309836b63762
MD5 8f3e91e106a08eab2601bb7f7dac9b4a
SHA1 5d0b62e21d9855b8319090c170f971cf3404966f
SHA512 9e21143f16973e11db682cc84d375e8d104dc15bff38aeae4a15d69a1e3a7bbd40ebf7c078624a585bf7511d93b61a0f2310eff59f86c4af3936815c60995791
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy0:A3k03kHRJi56rt
TLSH
T1E7255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 951KB
SHA256 bed027233151a425014bc48b4e0ac4361fcd8e54c0a5b6fdc26053b031b266ef
MD5 1798e951ea061a1087fc887e598daee3
SHA1 67544c40a847b5ee3313c2cb1b192028e54ec5c8
SHA512 d580bf9c9c1bf3d17b3e6c37d1bfb4ab345378f159e5343c78ee9036dbef2576d4a8e32e94aadb45f7b66f49315ff9b3bafb12db1e247f6b3f84a6569093c6dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJBg:A3k03kHRJi56rc
TLSH
T1F1255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 951KB
SHA256 d34a040d6e8d93aea24df436b5718843bbda15147247340cc8a04093dd6c868a
MD5 8f77d595da54e1749b8e39d23671275b
SHA1 54b0c9d3f0505c959dfcf1f9c7c05155b1092fe0
SHA512 3b2750fc12770cbb27a3a99c5aec9fd9e240289f2fbcd144290992c2a9dc9ee488d431d66d66b6ad13602b4692345cf892016f5bb55cffa1ca33076dd25c996a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJor:A3k03kHRJi56ru
TLSH
T133255907A6890FA8D11FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 951KB
SHA256 40bc81474e1b3d78146500bd882ae66e36ab8f2f74b9348ed1bb2a73d7528a51
MD5 92568653440b941a2f937b25c3544390
SHA1 6cc26a6676731f7875ed62e6c4d5fd02554d20b3
SHA512 eb70be0c62639a378c7fbae5a2ee6e0017e74e10d1580e3d207ed26f4b4a81c9107c1bba2eff7007648ad1057bdd0549b9be48811d2adb897075e14562b50d09
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJGn:A3k03kHRJi56rY
TLSH
T1AD255A07A6890FA8D11FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 951KB
SHA256 3be54283a60ea620e6f41bc303e262772fd3e28f95474946834550c5ebfc0d4f
MD5 6896bb55092704df32a296c0f35a4db5
SHA1 c5f6e52cc876e138f784f0d7ec94d733b0776c7e
SHA512 e3f98a226ef7b75f9d987f198764ebc6f1fc38b80af01a7e3aa4fb0d3ffa43ab9bb694402a346e0fd7b5b30ef96eb2bf30c17c2a8ff6b5df0eb151a06b728330
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJMx:A3k03kHRJi56rO
TLSH
T1A9255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 951KB
SHA256 5e494daa439c04395f2b7e1c8e54e686973e3d4afa48241199b89f8e07822d40
MD5 a49f3b8471cc05e55809512db9cf93a7
SHA1 7c1b425257cb63a31ce8f50dd3ec5f1fd2047e3e
SHA512 847910e7ec380bf4743a46c0d71f36c3a2d05286b4e6c0ca879a7dd894abc04c1f38819a662021e9cc5616d096ccdab736d8924a8953d4be15639ad148391927
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJGA:A3k03kHRJi56rF
TLSH
T17C255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 951KB
SHA256 d6f1ca816480e095c75d8e31bbf351f55013726f52d8832a2325286bb3643de4
MD5 b573a480e85d2bcb746c19a7cd6ba159
SHA1 fd5c680d03f2009ea66ff2fa6667af6ad802ae3c
SHA512 507bff01458a2923f42399e697f090cfc649766f1cbdfb6e08b296797a0a9d4122378f030c3189073df523a93baea562d331a42822305c408847a306dada805c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJf9Q:A3k03kHRJi56rk
TLSH
T1D5255A07A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 951KB
SHA256 f60235d97231443ab4d55957241752ce8a65dbf85a30c634ff802f3361e5c0f1
MD5 feec5cdb00563522fcb0008726e776d0
SHA1 66ac8680272ef0d5db1c1a9fefde79f109c6bf33
SHA512 61de3a8f6d30d4fc44fb498f4a23dc663d5c42bf8ddac4fc51f77ab6916f1cefa5466479f06243859a614f514a495e442d263963a493af86e0e0c2cbb97c7d4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJW4:A3k03kHRJi56rP
TLSH
T1D6255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 951KB
SHA256 3a81e7e6940c4d52fc0b3048aba5f3e7da49d48b4918356d1831b77e041128d0
MD5 e4cdf68dec995ef80491d5eab7fb12da
SHA1 59d02a2ca0420d595af7da1a9cdbf8650bc2af55
SHA512 3f73a5a37903cc82f05e4d9b6dd15b4bc701ed3d1391431b9e7d0f4342736cc09dbe814a14111b7da9dde0210620ddf5766a0bc372ae59d9487374bd28fc8f15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJFu:A3k03kHRJi56rC
TLSH
T11E255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 951KB
SHA256 303f3db6d73319023720592b0d382667274db2dc7faa9820f83b14c965301403
MD5 bb1327bccd863a34d6280e99d988ad7c
SHA1 244fff2ab00666c093a4f9f67245e5e1d2fc8d06
SHA512 a4c800238734bba149d9e370de59eca3f9394747d911b94b3d28682ea966f084c614d2388dc17363f727e42db2e9dba064e3e9f63c944f5bbba809f2b89ad684
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJYj:A3k03kHRJi56rc
TLSH
T16E255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 951KB
SHA256 2207a811c9fb979254968880938e11d8cc19baafe71364fc6609aa71adaebd02
MD5 883b1919a6bd4a2ebf6c5b9a015f9be9
SHA1 ac4ec51f098fdfd6ce53e9416447c6dbb0fe995d
SHA512 a0c62f55481b6d7b016a65f5d9a78f3a5b4c6386dddb55cece08b21a5a31d69f3326397e8abeff8ac36da5af0172079d2c44ce322548a954a7bcad42173133d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJpg:A3k03kHRJi56rU
TLSH
T120256A07A6890FA8D11FC1788A968662E6737C161F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 951KB
SHA256 498808409033d32c3acdac758e8659d296f1563ca6c879490478a6fd54a631f1
MD5 95621c0cdada7e6cc3fac681ba1408ee
SHA1 2a80d8662383004d0a9af67cebc1e64fda88700e
SHA512 cce1e34b4bab740d26481c8658f0fd4303a48f4e5040d885a3f8e543b88d0195e581fe10660ac01a82f39af3d76ecdf5b0e59f7e22ed59b99b5846dd7044aa7c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJwI:A3k03kHRJi56rd
TLSH
T100255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 951KB
SHA256 bbda463d542823eb23f919a848754f6be86bd54b9a97d984c62d4ede2618e266
MD5 cdcf1699064095a62350387109ba47cd
SHA1 8d52657c6deccf3f935c97af756280605fa51b8d
SHA512 e7802434e3bc424d5ebb712fac36876e6205055e02388b285278bfd73443f9d2da06f6594436821c23c603b2290041dde6bf1668932dbc05a71e730b186c77d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyo:A3k03kHRJi56r7
TLSH
T1FF255907A6890FA8D11FC1788A968662E6737C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 951KB
SHA256 ac5ea125d86c271d53395277aa17cf25febf13fd585f251f6defbb682ba9105d
MD5 b11339f237ce52abd189ac5b01bd9a6b
SHA1 d8f22598042c9929cb53c45de7f4ed62e61eebab
SHA512 e8f8a47ab8221d49ebac54aba08e1ed496d49a0695e82f10ab0518169452bfd6b322f97d1f2e9a698460407b7cd026dc6a32f70e72cf0278e36d0acee844a4e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJp+:A3k03kHRJi56re
TLSH
T140255907A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 951KB
SHA256 4efbe0b997e70a21cc8c9f5b1c4e5d1b67567a57124a4eb9e2fae6d5d6c95312
MD5 36784962cab4e0d60b3f67bbce989156
SHA1 31904cb3cfbf8dd0ed39a7bfb8c181a077290763
SHA512 86efd35d2c7cc506177f15de0e586908f1789aa70d16da6c424c0b6a805a39de957b00e65206398b15ae7dca54fe19ea71cba3e35cc2829506c2414e36764527
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJXQ:A3k03kHRJi56rK
TLSH
T1D1255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 951KB
SHA256 4be890ae12046d07e255451891f367c08ebd12152eff469dda616557183dae1d
MD5 cbf3b03caf59b7eb55c6a8468d1c2e5f
SHA1 45d0c0b5ec3192377c8045d32dc3720bea6be95c
SHA512 2868a73bebfb32cef922298c2ac56b0e89bca1d1bddb39dbf130d29eb5abebd936f770ddd06a2d029ba5a72116b5cf964ad114b23cb066d48e397670bb6dfa6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJsX:A3k03kHRJi56ra
TLSH
T1A9255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 951KB
SHA256 901c9da8f63c1a032c57f693da246bf5289fd495c1b4ff0ebd84c102b3b614cf
MD5 249eaf56c7b03254b21437d9515deaf2
SHA1 3d6f2da7da5e46825ab9e4d961e4e6f49b307562
SHA512 83e81df20cdcbb250805bd6b15f5830844e7ca50fb0484c63ac6eee8ca8e98cc186556cbe7b2de1b96a16f403fbdd249f57fda3392841d595a4a9270144c9caf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJKL:A3k03kHRJi56r0
TLSH
T1A3255907A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 951KB
SHA256 e0eccf3ffed0ed30e2e58172197cf6c7ba335c19a778ab134f57e8b6c5e0214e
MD5 dff846c2d3a0cc7c2c7003b152fd1937
SHA1 1250eb6309c85d92de0cf174a42042df3a2a0ec7
SHA512 9d82aee4e6bd9f06ae0b75f73649b291ef7d928b2bd002756925dd5f4bd3bfff430e7448b8ebef3b31aacda5bb8c3f5ff33b952c55ce584c45184cca2612afdf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJuM:A3k03kHRJi56rV
TLSH
T158255A07A6890FA8D11FC1788A968662E6737C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 951KB
SHA256 99da11986ff8f9a6e321cd6164e78ff37fa745955a33524bbce5e011eba8b51a
MD5 2cb13c80b1dd5a537124bdf298d9bd2f
SHA1 b335ba77e7d5828955915837024999f453e02ee9
SHA512 e87b07d9431975aac38ecfa0e77762787b2cab8434293976d90bc743b43bf3509505de01d032bdf3dbd03ff9f3ac1253cbcfebb6e60b3c4c8b565e7c81567538
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJ3h:A3k03kHRJi56rv
TLSH
T1E8255A07A6890FA8D11FC1788A968662E6737C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4232-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4232-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads