bc791a0a9a2631a83bb8cd40170a96bfd5df3b952ed3924064ec72b3e6101600

Analysis

max time kernel
98s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 951KB
Sample260810-ttylrscr3t
SHA256 bc791a0a9a2631a83bb8cd40170a96bfd5df3b952ed3924064ec72b3e6101600
MD5 6af596874230886868872bbf9e325d11
SHA1 8879886549ae69e0479a6f7a5d8796203f502ece
SHA512 9a2dbe5cc99344f9d02da137058020f24cae57f1fb61abe4f72a1bcc2a7e350c3c9e0784ccb58b70fde63d934e17bd5e3c95cc1546fe9f964de9c361583a0c42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyN:A3k03kHRJi56ra
TLSH
T1A3255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 19 IoCs

resource	yara_rule
behavioral1/memory/564-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00070000000243ee-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3988-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000500000001e4ea-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/564-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3988-35-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000022bd5-42.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000300000002353e-161.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212c9-410.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212cc-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212cd-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00030000000212cb-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212ce-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212cf-679.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212d2-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212d5-752.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000212d7-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x003c0000000239fe-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x003900000001e0ae-1560.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 15 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000243ee-6.dat	aspack_v212_v242
behavioral1/files/0x000500000001e4ea-12.dat	aspack_v212_v242
behavioral1/files/0x0003000000022bd5-42.dat	aspack_v212_v242
behavioral1/files/0x000300000002353e-161.dat	aspack_v212_v242
behavioral1/files/0x00020000000212c9-410.dat	aspack_v212_v242
behavioral1/files/0x00020000000212cc-477.dat	aspack_v212_v242
behavioral1/files/0x00020000000212cd-496.dat	aspack_v212_v242
behavioral1/files/0x00030000000212cb-587.dat	aspack_v212_v242
behavioral1/files/0x00020000000212ce-618.dat	aspack_v212_v242
behavioral1/files/0x00020000000212cf-679.dat	aspack_v212_v242
behavioral1/files/0x00020000000212d2-728.dat	aspack_v212_v242
behavioral1/files/0x00020000000212d5-752.dat	aspack_v212_v242
behavioral1/files/0x00020000000212d7-785.dat	aspack_v212_v242
behavioral1/files/0x003c0000000239fe-1392.dat	aspack_v212_v242
behavioral1/files/0x003900000001e0ae-1560.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3988	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
564	2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
3988	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6af596874230886868872bbf9e325d11_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:564

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 bc791a0a9a2631a83bb8cd40170a96bfd5df3b952ed3924064ec72b3e6101600
MD5 6af596874230886868872bbf9e325d11
SHA1 8879886549ae69e0479a6f7a5d8796203f502ece
SHA512 9a2dbe5cc99344f9d02da137058020f24cae57f1fb61abe4f72a1bcc2a7e350c3c9e0784ccb58b70fde63d934e17bd5e3c95cc1546fe9f964de9c361583a0c42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyN:A3k03kHRJi56ra
TLSH
T1A3255A07A6890FA8D11FC1788A968662E6777C121F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
Size 1.8MB
SHA256 6841bee9e0d7882785bb1da4a0c473fd696cfc11f49e1671a50116c386249652
MD5 83ad3f2e66746ffeecb0cea0672f7641
SHA1 262462d9c9f17d3748aab5787ea1a40ecd6d1a57
SHA512 784f0fe834f7ca1d54b1cebc0839e604bef75db24d835ff6411f440889fab07fb9275c43e8a9e61eac252e20ae9fc36870755b998dfbb02d0af301610bb51201
SSDEEP 49152:A3k03kHRJi56rUJp+b4Yf1rYKSlSCDO9a1BJ:A3k03kHRprUJM4Yf1cdBPL
TLSH
T1CB95CF13A6990FA8C11FC17886968622EA777C521F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe$

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
Size 1.4MB
SHA256 edb65eff941f9895bf6ba3957bc5b304f09b84a2ce526e401472d38d852227b7
MD5 d3b48905e8b7eb780761f5218ec681e4
SHA1 f2af100d2ee0f2d94e48873fe1f1c75ebedf4c4c
SHA512 2ebd57d12f97ffff77e423db8d370808b23f642d23fdde9716c3e3a5c3516dfbc963f917a8cf7c990a5d8f001b817ab3ae538c62184dd41c5395d088a44fe0dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyA86n9kAJ9tA3L:A3k03kHRJi56rVT9t2
TLSH
T154656C02B6980BE8D05FC1748A968662E6737C561F20A7DF1354AE253F33BD06F3A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8446890a4cf342c35bcf91cdb159573649bcb199952fb64ae5a8fe7c50418516
MD5 a2f2919bb0d3e33dbe6491e1b33cbfa4
SHA1 e32cfec386d47c3565d76b01104f0b94cf3f9804
SHA512 0fabbf44b696c2b8c3aaa8a9c952d291e3d3a4fb7184341b435d36865cd7c6de4bebd2e4fc7579b71ba7cae5d092665854b066fbd9d341b838c02f34228aa03e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyZ0Le5ji0hmxNrM:A3k03kHRJi56rqPji0Aj
TLSH
T1E4655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 27ba48033c6aa92f00c338df0d5093f46442b7cb7dc802861d8c23397b08bbce
MD5 00a1753e5dab365309d7104c8cec73bd
SHA1 9d7ece56e09f19db6ac60d3e2c3c9b75e05c5283
SHA512 d23d6e77a2d58e638a59ca534aa88b7bf0a383f7b74e4b0054a6e70f1b2fbffa65cebf4818870ccb05f8aa96997dd13a95bd7c4a80adfa225693664d1de732e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyLa:A3k03kHRJi56r
TLSH
T10D256A07A6880FA8D11FC1749A968662E6737C125F2093DF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 1.1MB
SHA256 117c8f5e3cfa4957df28a6965de99b75ee302099f6246e074d0e79072b432a8b
MD5 e7c61b85aea68b4887f272deacf42946
SHA1 2416ea04a9c21041e90c3438916c35c25f8dd878
SHA512 208679e75388779b70d4f762a923844d056c9590e464e604da77bf618238c06e51d5a94204fa26f5152adb6ed3c40601eacb23829aa4a70e663fdc4468e81f9d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyiD:A3k03kHRJi56r3
TLSH
T183350506E2980AA8C01F8174C7964662F6737C165FE093CB13D4EE3D3F72A906AF9657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 e96162aff821981a644848f1c35ee8454b6a8ee393d0ac12b67c1d0d2cd88e9c
MD5 9bd82eb0a830589611b2cba8773283aa
SHA1 f1018d0f305cfdb5323b5287075d4db69a5c68dc
SHA512 71222188083a118e2a9c2fd53059d91e103e72364bb264d2e3678e917e31bb7e5b4dea09b5ba44b4edd120c2dfe1b296e93517e0dfbde258875a0948df053cc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy5g:A3k03kHRJi56r3
TLSH
T1E2256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 807736c9a972d303bf32aad6689da715ad6df618b5bc7f7272ade36c5439127e
MD5 92feead5ebfbe2063758e45c28190ce5
SHA1 3f5ac39d10c705f589ab37a48c643ac3efc91ea7
SHA512 019ec1610f8605a642036ec236b6b4dba102e7136b22a52910b816913600e11d26f7363f08def0e0158eea41fed8ac3776f57322864b9a519e64a3da2314b826
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJygI:A3k03kHRJi56r2
TLSH
T178256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 0ffbf9dda849e71382966440dc821639c425060c40f5691c62a77252e56658d6
MD5 bb3ba9f5bf8e2880c93be12777216163
SHA1 f3e2e46bd0158d169f79bd298583d894ef69cf13
SHA512 13cbb9936a8a847f7ebbecd08e7ceec8a5ae2fb71a77c0eabc1e40c64c98a64e3aab39065ca4b388d493699299e15589fe60a5f7ce7f5f2376d133fe8949f014
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyio:A3k03kHRJi56rE
TLSH
T138256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 06e0b7b44e0e1c209bab81110ba99ebb601e599865e6258dd79b7f8b30c4bb8c
MD5 10c9dfc7b44be349ceca94baf311ffac
SHA1 57901733e72c40592ab043c47782821ded8e7e4e
SHA512 1ec040148d14f3adbd777c1ed72d7d7544330c4cfe2799070e8624fb2fc7a43a11e5fc8c23a1348ebf6e02bae8c0791a63ca938cb458840dbff67cc37baa38ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyZ+:A3k03kHRJi56rZ
TLSH
T156256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 65bcde56358a9bc0161037f4bf1ec596f4bfee81b18d28c81912c2ddd371f01c
MD5 101a169a4b2e5ba40f91668e5a9924d2
SHA1 96a415d8a706a16899823408b92ccbbbae1c96d2
SHA512 afcd9ddbf4bafd9bcb9796b995750e251829d214c28c76f6beb39d33f9fb4f7771baffdd9bedeb250ade484a2992d1e3411d6c939e448a8eeb15be94a0d95533
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyHQ:A3k03kHRJi56rp
TLSH
T1FB256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 7b663018d5fde6398283bfd6075b8fc9fc653f53d80e3fa35d3efccd768f7196
MD5 7b18d40161a4d182c6260f4784d2ab1f
SHA1 dcef15b347ec48d0d4c5dab45375690c546fe4c0
SHA512 d7f383fb26c0f999a226491d7c53291c4f1c81b82f49d85a0d0bccee2b3395be144646a8af8d7366bb9690379bc66df16690ff095ee33464c4ca705bbf9a73a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJycX:A3k03kHRJi56r1
TLSH
T1BC256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 f9b52fd6f7e914f3e946a93fdfed87634048bc567f450d4357cb62b9b90b0be4
MD5 c87c5ded64f3f24cd0e62e6500b610f8
SHA1 a24ed4a9126fa7511d45f5e98060fa9f16a4dd73
SHA512 260680cb582ff1c911c2c0899105f6cf61d108a012705b56fc76828fbb02719c77812a3e948afd3d5ddffbb55140308192c9b69fead85f44122e79f0c13b9c8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJyaL:A3k03kHRJi56rn
TLSH
T182256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 1e7c0cee58f3cd526d2aafb51394fd0e713e868be259effc01ed27db3798fb0e
MD5 322d99c0ad56afe4d6bc5319e80d77c2
SHA1 e69ab60bfe2d09e3645b07fe6a8f1d44151b9abe
SHA512 1b4533fd3a03db0b0e6a52b930da034d59fb6dc00b8d75c12151661a2fc6155e8a9e0a31c0af32ec5388146433be422a51d12ec15ab343e464f3479214eacb84
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJy+M:A3k03kHRJi56ri
TLSH
T1DD256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 71e1d5e992aabf0fe76dc2d86cf6deba3eca4a2d554b1cf42b76aa6425873f10
MD5 bf1e0faadb1085e8fdba5e3e5977f5bb
SHA1 9f0c8f3139960cfe616cc0708ffcddeecc5cb4dc
SHA512 61b06c0c863d92a9fbb1f32970a0661a6ff98e29a571fa4b328af6ecc4349e4080924985624a2b44b38d381bd4815bbeb4fdea4ba60b459771987ea11dfd5ab6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4EyJynh:A3k03kHRJi56rc
TLSH
T113256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/564-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3988-35-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3988-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads