cf1f4538872e3a8683165d359151b3aad3577703551b6fc750db9593a09434b2

Analysis

max time kernel
89s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 845KB
Sample260709-t9367aex6w
SHA256 cf1f4538872e3a8683165d359151b3aad3577703551b6fc750db9593a09434b2
MD5 a6ff4f219ea9aa5b8b1d22104a7f9dd9
SHA1 76121dea40b924c6bb7e1a7c7764c1530a91ea52
SHA512 5328ba0c88b8cffb2f3a1a61ad17d3d1d2b7b16bb3511106ff1ac940202059e1172c19d9cd7b9a8ed3b64362671c6a183240d12093f1a5663af2c21c73af4e38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60N:A3k03kHRJ2
TLSH
T13D05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1312-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000600000001b6e5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1312-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6044-228-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-434.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-521.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1120.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1290.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000001b6e5-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-434.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-489.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-521.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1078.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1120.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1290.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1385.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6044	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1312	2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
6044	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a6ff4f219ea9aa5b8b1d22104a7f9dd9_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1312

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 845KB
SHA256 cf1f4538872e3a8683165d359151b3aad3577703551b6fc750db9593a09434b2
MD5 a6ff4f219ea9aa5b8b1d22104a7f9dd9
SHA1 76121dea40b924c6bb7e1a7c7764c1530a91ea52
SHA512 5328ba0c88b8cffb2f3a1a61ad17d3d1d2b7b16bb3511106ff1ac940202059e1172c19d9cd7b9a8ed3b64362671c6a183240d12093f1a5663af2c21c73af4e38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60N:A3k03kHRJ2
TLSH
T13D05AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 eaa6ddfb1d4cabff61ffe696f6c64e5dcf0492caac725950ec20ccbeeee2f7d6
MD5 19605c700dff8edbe71e0c61d01a52e2
SHA1 d8589acf32743b0b48325a83071adefa46047f59
SHA512 df1574f745295cc305f2c1672f113cda8c4c68839d804d6f41139d8527ae72906503a275958cd6157ceb43fae76fff2241987f8e645972d176a641bf79770a5b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Z0Le5ji0hmxNrM:A3k03kHRJ2Pji0Aj
TLSH
T14C657C17F6A402B5D027C0B9C6D6966AFA713882173086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 de8204c7cb7b699d82371f9e8ebb8bb918c96f5c608d823469720488f8719e13
MD5 1f0cc89136b7f3a2b007ced9aa23f994
SHA1 d0980812fa5e193ae94c461eca9b8ef4c2896c20
SHA512 71a43f98f2a0f043dd1c22f174218fb747d933cfba2fdc892324ffe5e3f0c46da03b365e0b9ede0b3a6c71588e8f395d16f0fbd00dc2546567eac00a35b32b60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60La:A3k03kHRJ
TLSH
T1A815AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 68af0bebee09c9509fa788b120b81e3c3d4e0230e26b1a8026bf9ebf1b04d513
MD5 58dc771c311af7a8f8369e9ad27d3a77
SHA1 57e59c1c0e3a4b329bfd453ab9beefaa5b15e3ed
SHA512 6608a55bff131cb1336befede17d0d86cbe312ffbecf267d759fb704f07cd71ec54c1cca1632dc57b1974c4ad92a42bb315532511dad0167c7820abf4d442467
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60K6:A3k03kHRJg
TLSH
T1AA15AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 868KB
SHA256 2b69ab3cf65a06b1d4e9579c78cef3a6debbe782cdc9f629fe035dc1aa40d1f8
MD5 0a68f7307c6c2b2a84712a7b26bc5856
SHA1 0c833011e22c2f5499916343697d62f5aa22ddc6
SHA512 806a039af29baaf7f41164e58fa85ef8c57ade5df764b78778c2e06876db64e381fce3f2704f9b3f9d8f7a176522a60ba2075cf5261f37917c7216f34352e2ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60iN:A3k03kHRJd
TLSH
T13C15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 868KB
SHA256 5d6ae008762c28fa86002a2c682741eb2d071819a1b1577e27dadf5e0b72a5cf
MD5 8144157bd193dab98825d0d1a3a2ed01
SHA1 c23b39706cf84bbf468a79efa39a497ad80653af
SHA512 5f2831fc20f4b19d3d6362270c99bdb870ce403dad94ed032095f70f29ac756f4b7111770df9ab44a38a8f2baf54a70d3e3f70b7a5c5470b7ee5afa99e7a868b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Yf:A3k03kHRJV
TLSH
T1BF15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 78acd60425bb960b8a7a1a19b4f352cc6c1bc0c40e53edd279b1a2322e975890
MD5 78275e9c9b766dfa6ab4ef6f7d16a828
SHA1 7394af059cb93dc31d13ca4ea82f203168093f47
SHA512 df8e5b09b60b3d01cb72b71d80ac71a287881cc5072c357cb3cf7ef48fc4c60effc8b1b27dc4d9efb4cd9bf679ab4686c4a852ff92830052b715a907aae0de14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60yo:A3k03kHRJg
TLSH
T12B15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 49cb8decfebb056dcbb2b01e2211e4bb4d0a894c9261e94c8a09e208f5dfd056
MD5 ccc0df577d17f9a66c7932ffe18611a0
SHA1 2b2dca7c124af19528f2ec2ec747c7454a03a104
SHA512 8888afa4aee88b972c1c08200c01f27d7f2134fdaa789c392ae6c7f8256ae1c6635a60045630ca3c33ea802619d5519e2931e9dc03043e6097d73fdbd8f6b9a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60mu:A3k03kHRJC
TLSH
T19E15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 2fe226f818e5b34e02f0796d8db11cf1b24f58f95bbb9de06f1d44c73244829d
MD5 541822333c233b1c65c283c55d382440
SHA1 5dbac07e52b4709e98e556cc62e9d9a21071096a
SHA512 fe73187a1d2df9665eeb6ffdf89676665c38f05f15ea8ac52f2ab36031e5d9aa9756f784f823c8f506a0e9e1269439c7f664b984770757267f70f47243509afd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60a9:A3k03kHRJj
TLSH
T15B15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 7d3603129c0f1af019f328cda39aa234272d4890ebf18daca34b8aad44274467
MD5 6f570dda78e061a140b928779f422102
SHA1 89b2181c21d5b8cde74311f23555c43dc8abab66
SHA512 b6ef5c0ca78fb758c97bf972bd1e8ce6c661fb1e3810ef67cf5be641ea9652677d4e6d88ba281e7f0f0c521e38730c80d389cc0879dbf0f23fd5a024c6b56075
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60ac:A3k03kHRJK
TLSH
T1DB15AD13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 7f136d921e42a772ff823f832b13139834ae080bd7066c279e903e47cf0317e5
MD5 81f27a9be88f6d420a50c2497b1b1df2
SHA1 1568d61fa4abb6ee47b399a8786597cc7d641865
SHA512 5644ab8d9ee8b3be2605cc8e577efdfbf71f32a963b10ad4b942d8b060f03a6da9b917e9c80b848231a25d0fbee240c9054a7e45c5982800252cfef99195d4e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Tp:A3k03kHRJQ
TLSH
T13215AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 8854148987bdb9bb85ddb413e88a10865ad26026e0d6d59fd0c914af7218f61f
MD5 6a6134eb76e22c3cf78040c1bde5e0f6
SHA1 bd7dba3662669533272fb06eb9dc056c91bfca1a
SHA512 1af9d66e4193cd99c8396cd3d2be29c05517c39fcd3b8b00f2764aa3fc6bdc602dfa31d2bfb3285c4f23799154b07527715622951aa21277d5c86963d356659c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG600N:A3k03kHRJv
TLSH
T18515AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 1001dd2502a5af4946fa1175381821266be96a54a54e3f8d905a39f8d45a3d08
MD5 09da96f7da111ddeac248d83fdf14679
SHA1 4f7aabd286004e29430b6efc29300ed035a6243c
SHA512 fb0d9a921122db0b43ef867fb660faafece026a1409ba6f81bcf1018f2c74917896924f8ddaf7f1f9604ec3e794fe34920a182fd59bf63e04cecf4be503730ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60cF:A3k03kHRJJ
TLSH
T15F15AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 b96889cc10492933bba6af618bc9fb82deb01dc9f749a42229135893c76ed1c9
MD5 cf409b2be1c4593460df1bf3d367ece7
SHA1 0d499f86cb947f1738abd867a03e2e0b083dd31b
SHA512 c21b58f0a8976648035c048855b3403f07882ef07fadf70291aa86073f262978af21fdb900c763b7bc037015c25289df2076d94ea2a11215b34436854e64d37a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60JC:A3k03kHRJV
TLSH
T12E15AE13EB9500E9D10AC1749ADA8A23FB757C561761A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 b9f961a367fa6e94b12743ccab144dbbb6ecea9e4490d46aeec2c56986610066
MD5 7613c3641d538132e7a2d3c981a03707
SHA1 19e3fc56ed114463a27c4934e50d60762d1f34cc
SHA512 273f45909ceb44364c1a0c3bae98675bb615b64c49f880d4c91ab6fb27f645887db91dfb6f1bb9001a8820c10b9e8e720bf1c861d814a4de0b9c0a0aa3088e82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60qw:A3k03kHRJ4
TLSH
T1F115AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF6358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 1f4da4c4bf376f8b966bb6f61261fee50bfeb58ea8fdb4efd1d9015c2fecd89f
MD5 120794a2d9b21b722e7e37436d2ab87c
SHA1 d57f9258c69ff6b48e3e391180c5762f421b73e9
SHA512 6ee6de9fe81c1246ff38eaf06295752c14f5e1642a8ad794d4951efed8f8bf239a1cb72f5d8fa0a54fb1028fe2c4b9de5b29aab5f1fe0d8c61b0fa3c761de84c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60xT:A3k03kHRJw
TLSH
T11A15AD13EB9500E9D10AC1749ADA8A23FB757C561761A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 f683446a73b640ed9a6453eb6bedfd0fe39a8367cc3bdc227e5968e15fa73f1a
MD5 a8c5b7c792b3c912803c8d9cffac7291
SHA1 ad8d03cc0ea6af3ddefaf2d0cf0ad7b3710a0bb6
SHA512 463033a5f8330e4713407738932c6aa75b90d6a5832bdc62d249c7205d72be47476282d761b838eeacb8ce5e9ff31ec258c95d857805e4a4b18726a816cfc70c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60fu:A3k03kHRJv
TLSH
T1E015AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF6358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 0e03dcd766cd1f830bd45d3a62244f68728e858bc945b58c6257a94a25a48cd0
MD5 0d906eeef30e424e70b1b565029e119a
SHA1 c734350c5086adc6e28afebbc50e33eb8c1569f2
SHA512 1d119e337d2831061c14372d2f0fd11b1f60c10bdbebe433c3bcef6b423c9892ef250cd47192795c10b5270913161ed978986cf723b7f96e6889f8ae794d6ad3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Db:A3k03kHRJW
TLSH
T1F415AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 af1ece19abcc91bd114f7620a5df6afdc490fefc324907d3b44d36f6a8425d5c
MD5 9416ea6e3ecb892a73c05f625db38aad
SHA1 e7e073a4ad29d939d59802c3487fedf8c078d5c8
SHA512 5cc57ff7a7dde30a6a53016c26f79f1e58518509c7b93f3cbc2e879743963fda26f0370e2707e9780c7344ed1c4d4d81c040628890d234688427115d44d8ead9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Xf:A3k03kHRJm
TLSH
T13915AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 c1b7617b7fee9d888ae8a13438868044359a74bddcaa97fdbd41549a09fbd2f6
MD5 93d583487ea6ccc8503b2556d2c4a0b8
SHA1 9741a612a88d6b450706bd0dc527df2d8d5eb962
SHA512 0e43ccbe0156292526119bd54ff9736bd3dae8d108e695da045239fe453c3a31bef66a62a7629849e1c15b80e175bf2ecc979dffd9efaf4e930dec651164610d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60gK:A3k03kHRJG
TLSH
T10115AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 078c7c7986b8227726487772c8d31fa47dd8be798afa3729e2aab2e2b38f835c
MD5 17ec5c023bd9797d2443e5d41a3b4b5a
SHA1 48cff1ad1cdfd29c3e66a8674c799f1f137d6a54
SHA512 f7a2a18c2018d3432c74f1ffa4b263592a19cf094d2a20e5c104f5eac3589ed2dc649186bac17f635fc1efcaaa5303847723338849ed624b592c73adda0aac98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60dk:A3k03kHRJ7
TLSH
T1FD15AD13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 b0180122f340817923e61fb28cf93f24546f1538e8f673350d697adfa5c13a6c
MD5 52f8f568aed1970824a23cf07a93d86b
SHA1 be168de67512a9ab66cd2581c631f428667aa883
SHA512 d9e65d9955815e5d981e653111e7e425fc6c821915ec3e840798b8176bed644868e4cd15554bfbcd3551a0021909e9c228041484120fb09de32eb48ee3f01fc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60C0:A3k03kHRJq
TLSH
T1D615AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 52cf3259ca10da8f0717e47c076a5f02b1ac5e4c7889c0d73764e63ee0e98863
MD5 391cf452d355f4d1597882c102704e94
SHA1 cab3b97a0d8091b384cf99b23beff8abb4ae3c25
SHA512 6deb94a0de570fa6e7524912dad0b08fd82adefb1c59b5683cb42a8a99c784a79128eb1986c88174b1facc2ef08ee2e1f309b7b8ce77dbab64131f8dc3fe86e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Rg:A3k03kHRJT
TLSH
T11F15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 ca7de35f5cdc09469a4076143c2ddc68418cb7e9569db0a1e9e129a011b7a7cc
MD5 4562b47bb88744f628d62850899f9565
SHA1 610188019a51024111793a45ce2ea029877dc139
SHA512 4fe20c2d67312917055049d34d1a691d9ce5fdc089e14ceb05cf65f9f52d1ad34f12242efe80184ce15eb32cf6492396e4688901a21148f8016bda627553c4cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG604r:A3k03kHRJl
TLSH
T18D15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 f80ae2627371c9471753f7313f2cf5fd6d9d0fba71e4d9e1ecec178eb92fa159
MD5 e10138aa9152409643ade66970ff9abc
SHA1 3c9b559c9b496dad2c504e62f6533b15436ceab8
SHA512 a5c8f0f99b9bd46ea1017aecba2ddaa1a84fc898508ea956059cd354048fe459241117c4c2512c86fe1c8f377071c66eccb0a6dd22e387bfc9fa8d634f48b01e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Wn:A3k03kHRJ3
TLSH
T1F815AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 c4cd667c0ea05e10bac380bf531481f037c8b09324a75c3854d63e480fdb98f9
MD5 27921e09c9d390de8d4d098664c6ab58
SHA1 6c425e510031e828aafcf9e522bc1b9a4a3cfef0
SHA512 94228bcafb695da89da84f9f34d1efabdda9b5b4f55fcea1cfec9eb45fa7f5f8e65b5cb8b9b7de275860caa253e297f44626e775110e0a08a26881a0715e0e35
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG608x:A3k03kHRJt
TLSH
T1FA15AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 defe056fc02fd48c4ac3db18d6b0d4a503d1cbba5a376ef663784c65a8c0e8cd
MD5 dde6f7f14a86bd59537c6aa3b57a7bc2
SHA1 edc81e1fc93ee3375b7bee1c67d571de50470cf5
SHA512 9e771518fcc4ae7af64315629ff9cad87c7b68bebe82efe87d61bbb0a41bbab9079e70b838206867e5e3da7ee5999bf6c197153df8a503b29dab1caa336e09e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG602A:A3k03kHRJS
TLSH
T10815AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 42f019e396836465ceb2655dfac68d52e110615cb5bf25e132a3d45a14a0f007
MD5 6fc14ac71833f8eae8de096ea785e7ec
SHA1 0c23c05d430bc5e3d2265ea3715954f84fea4987
SHA512 2457ec48ce0866f8836ced6b35fd9595a464b9d28aafe7007f3ac5d083bff10dcb48a70720f538e2781e089623fe46abd3113b37a3c5c1d389fb9edc80a6395b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60v9Q:A3k03kHRJP
TLSH
T1B915AE13EB9500E9D10AC1749ADA8A23FB757C561761A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 161f945921cd4f91383729d59606d56caab946f5057715c4ad9b03ccde1a6566
MD5 d5a88b2783e552609c6268fd5ddb364d
SHA1 1da79428b301a202b91deca2ccad83c5397f6a49
SHA512 344d002714199dba8f9e66d7a966d7218a3185d9f4fc1de3974d85e07589276ad897f22c20bdf370498814092ce6101226a00a43c7cf8c67d87e003d94f1e1fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60G4:A3k03kHRJw
TLSH
T16515AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 a7f481489f1b9c9d6edc9b9bcfd8728e43feed650c20e9bf869c87eeb72a35b0
MD5 3458e878fb33dd4ba896d84e91e8ce81
SHA1 4dbd88967da7e8cd753ff3468c701a8cc6d51542
SHA512 11f6fe1a4ecc8f349af7701b391695bfb5f1475d7d3803633f94fd180a9d1a77c1766ed375e7770471681ded122c3242b9ac94fbb7a9a53b23d7c6278b7181d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Vu:A3k03kHRJR
TLSH
T13815AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 55065ca5f85c08b9da656939debd32b7960f95dcb15713d68faac9fd81487584
MD5 6819b951f3d868be4da8e8ea15780cf3
SHA1 3ce515eeea0d689411c606e6d48098ac4fe7bdc3
SHA512 6eebd85fe1335a80145027ced2d1e255fbb20b9171dc23d5ea5bd6d81ba3513331a91e9d949fe6842cb7b3208b1a5d1b1cce46fc44eb256221579cb05255b366
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Ij:A3k03kHRJb
TLSH
T18F15AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 133dac97662df10e2f6ecff1e6334d43d4e1939d7d199e4258c339ba3d2a5819
MD5 3d350ba0887b971242bc39bf3e4f95f8
SHA1 d47d738d87ad27a70f8bf33acfd1a89b0c8cfaa8
SHA512 1e78e96a9aa51a5fc8bdec8937911fcd6add0de27f2045e3a12b94dd6dc145576617e61d491421c6df47a6f9e6c19bc761280ea709a9535f8878e9b437c77e31
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG605g:A3k03kHRJT
TLSH
T12915AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 b400fac90da27f29b7ce055fcba6b7a990a3029b2b9552248c43c6520d4ef343
MD5 9bcfd953d87317a0828d51f29c5bf289
SHA1 bf597cda12ff667177fce6b5f7858f6784f99a80
SHA512 7c5eb4ecf5a67265f46087f7f324496e3324c146393196d128d9be6b4ce5d4d8dc238f40811c84a0bb4b24406ff090334d0045dfff2b1cb6a409e7bffd24bec9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60gI:A3k03kHRJ6
TLSH
T1B015AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 145b723235a375eb1db3024bf4a7faac3a0119a86cd73dd92f13ebd8995a7dfa
MD5 8c6e80c0d980bf20cc665073091e49f4
SHA1 c6284a06d0d9ff9fae7c288b83e49b23c31d425c
SHA512 5a39b30128929682d1d0e0aaae3f23065adab5ffaea3899184a12217f4022f4a81461632db24498a2a50a47f964ca70d35b4ec7eac6eee6dc98585a1f65af6a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60io:A3k03kHRJI
TLSH
T1F215AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 3cb76f720f40ff1398e979e61df5bca7859c4b5333367781b01de2202bd56611
MD5 b13dabcd2a1018111093dd25bb1855ed
SHA1 c382b99f7e8f48b81111fc31a79588b225418fba
SHA512 af5baaeb3991bf836d3c9dc0d30f4a5431a6201191706ef8e1a06c1a21e444cd572f0d864018fa9e315b1a9cfb00a516f40e61605c3cf3b027b1ec2e7e79dab2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60Z+:A3k03kHRJ1
TLSH
T1E315AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 da460b15484cb3e63bde1bae6cbbca69f7afb142ab3ea73c4f553e4dedf1e1f7
MD5 3a02acafc69500a2fd8cb90b54f239ab
SHA1 3c5f2fc0397088295deb9c06d925f239d33e9b9f
SHA512 a2b527f75e0896ef1397dfb180522306b5df3fd716a44e39f21f54c51a535a105b238969c7669fe97cfd3851187c6c2c260a85316160b0c6ad0689e4b5048cc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60HQ:A3k03kHRJ9
TLSH
T1DA15AE17EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 dc07f8807ba93ced4831388b8e484a3a8523e8499dea77a872ac0f30d21d74b7
MD5 4231489a80fcb56e6e21d8719386ded9
SHA1 886f363a2598fe70e0d1c257c9df18cde21e1c76
SHA512 250cbae6cc1895dd2248a816218419cca609e350a73794e4af8314107f3cbf4d0a4561035f5a18f52fe6a3d30b1e3c1d0199f64cc2cef9f46a99eb01c411db12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60cX:A3k03kHRJJ
TLSH
T1E215AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 cf9fc4220bbac7690076c551ac0efc44cd64096646e1401fdc154752a67775af
MD5 0936ff58f06b66ef5705e9b7fc71b14f
SHA1 c434e693b55852d4f225a0038d1f2e779e16f1ff
SHA512 4dfcb4e574bf4af3cbda072a12f7cf3cd7d102465530a21ed290bdf0d9967f531d2ea03f63f5d290a494412a2817178deb46eac06ff235896d503914f7b07450
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60aL:A3k03kHRJD
TLSH
T13B15AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 b36e15fcce0bb9b85214436e0f9f1196d1146e21efe41cf8994f80e06d3caf44
MD5 8a1f7e048ba56656c485ed96c47d6198
SHA1 17def77a2273a62b155f1ab23ad4a6da06476201
SHA512 837afc81b3ea25563e1a3bcf3a9c5288f42cb9cacdde8dc80aca84ca81981bcaed9213c284c9434ff197d1f041a416234a68e2e70a34d689eb407c87793e08bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60+M:A3k03kHRJu
TLSH
T11F15AE13EB9500E9D10AC1749ADA9A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 cc60cdef57043120ad01a8a238421e1b1f6592ddaa2f0308f49218690134b027
MD5 f3cd7d86c4824288aa2d97d22cdeecc4
SHA1 1df62d88f41d29e3b317941a16d1faaef37b4dbf
SHA512 674188771940074c1a94269766f83803a94e93a1de2005661200a3f4c43947eb3da52e0468232dfa8901db2bad7a9250bf9639629a11f2d147ce9ede67d9c63b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9NYG60nh:A3k03kHRJA
TLSH
T13515AE13EB9500E9D10AC1749ADA8A23FB757C561760A3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1312-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6044-228-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads