d071f0690c26edfd22a63f566d062562129d025a6c5adae35574d3e804fbd219

Analysis

max time kernel
98s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 951KB
Sample260710-2ese7scz2p
SHA256 d071f0690c26edfd22a63f566d062562129d025a6c5adae35574d3e804fbd219
MD5 7acd9ba808e197c537053723e1d0fe3b
SHA1 530028faf5530dcc8a8aed9b83d6d4d933817fc1
SHA512 47395cddfd2402f9eb284b1d9a732861d2944ecf6e87feddc54afeabb111d48f635607e35ab2ab1da766450f661a6a8dd93521d09995f2c46595ab491468ae08
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogN:A3k03kHRJi56rG
TLSH
T181255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c567-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5544-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4260-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-696.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-998.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1072.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c567-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-696.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-998.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1072.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1345.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5544	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4260	2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
5544	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7acd9ba808e197c537053723e1d0fe3b_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4260

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 d071f0690c26edfd22a63f566d062562129d025a6c5adae35574d3e804fbd219
MD5 7acd9ba808e197c537053723e1d0fe3b
SHA1 530028faf5530dcc8a8aed9b83d6d4d933817fc1
SHA512 47395cddfd2402f9eb284b1d9a732861d2944ecf6e87feddc54afeabb111d48f635607e35ab2ab1da766450f661a6a8dd93521d09995f2c46595ab491468ae08
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogN:A3k03kHRJi56rG
TLSH
T181255907A6890FA8D10FC1788A968662E6777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 162bbc0d5c980beef26f6cbae1739f13882d7c48c263ab656aa45db34b41aec8
MD5 8ad35df22464792eecc8a238a347bb9f
SHA1 db35bc7001cf46bf5dbf0f4b4140e39fb9d59d92
SHA512 8fb5be83ed2f02522475a4b951409c8898d715aeab00d8c9a9fd9b3b87604389d9b9143139c8137fac972dab8dca08efa3f397b58d83ab4b694535a7b956fdc7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogZ0Le5ji0hmxNrM:A3k03kHRJi56rGPji0Aj
TLSH
T135656B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 6949d992e5e145d3f4958c26720aa5570bb2e74b40674bddc11c047db425497e
MD5 816d383823c2a99afb78d5daf7d8a72c
SHA1 13e4a182ab5e8a7311beed86ecb723157437261e
SHA512 adfc1daf2db7d8ce679d583e7fe1a7cbf62d09eaf21c786c46bc50d0ae413e99d86d44cdcaee368c789fa22b9c181505fa169b4472f0fabdff53332ab212d544
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogLa:A3k03kHRJi56r
TLSH
T128255A07A6880FA8D11FC1749A968662E6737C125F2093DF1354AE253F72BD0AF3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 07f13aee4f39f61c7b1dc909dcb9b724615b18d80b061d671badd92a517ab209
MD5 d3c6bed4eed843c1301a41bca09a573f
SHA1 946b9c389a75d80b9db4989e2a3e7db616bb5527
SHA512 d83225413448fa7ac1c3f793b4fe7d5a3e05b764c9bec31cb266e3fde6e64a8f867866fd100ee28e7b2649d3cae8bea7562fa23587567e843c5dc8a37bce98f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogK6:A3k03kHRJi56rw
TLSH
T1BD256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 975KB
SHA256 212f3816331282ee32b47b5dfbbb7ea8a05352f31e8e267e1fe0383e32e728c1
MD5 97cc03bc49afa4449e0cf522f9da3fda
SHA1 235a5c3acbd26d8651c57c9c9bf1ba25bee457e9
SHA512 79d975f13dfc49009c7c4c00fc0b0e56cd757ac260a0293ba015e25ec4ca9bc832f832cff30e6eba8ae72f6e28c4d548e4ef3f1d2df75ca7ebf43c40db9dbbac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogiN:A3k03kHRJi56rt
TLSH
T1E5256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 975KB
SHA256 cc2eabd8c37d4b9697b65df9b8b611296e26b9840af83fe6dce2c2c9a47788da
MD5 dbc165777b3cff0d8b118d9cea863fb6
SHA1 fcb0d0a40cecb530b9dcb2b214b17dec04a7d83e
SHA512 095d3010f6f87ce4f4f2454e7349811e289011c254c79360a9e95ed38ec959124e88ab17dc295f5f08b3c6cb6fba94d4801d579443c3142bebb9008bc68e772e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogYf:A3k03kHRJi56rF
TLSH
T118256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 3a8e9404b946fa3f896e61e3d88315e26e3d9716a955a62385fe25b0be3c62d7
MD5 9d1548e1ff6d9d27f6ed40bd81f87eaa
SHA1 a46a0eaeae11ed387214c17846346030f4c164de
SHA512 de85b8e172de37f81c4ec3fa8569276187a567de1d26a7fcf7aa742f9a213301d816ab75287fa73bccfca1064babc5ab6c36c491c0435ea4d7b3e392a8d7b058
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogyo:A3k03kHRJi56rQ
TLSH
T1FB256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 4172cd72cc13644daf487c1008afa5b4467e253023231167b0157707fc06ad56
MD5 2178e8bcbeac7c1b2b83032554fce8ee
SHA1 4cd5da2e5f294b020bb7c5737db3c40db44544c3
SHA512 232eb35da1e59fbedc77a64ed4a36e8c846828fbfbaba733a220b14998569246255cf74f74ad850c8b7f06ac84481cf2718d10c1bdc12e101459da10e801d841
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogmu:A3k03kHRJi56rS
TLSH
T1D8256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 26c9ea2dfc9083cc92af85d838baa5739103946ebe2f9f397b305c167b31faf5
MD5 de9075544ee9fecc82c2dfbcf2e8b632
SHA1 08e41a4347f489bb34a30cc317533f458cdfda77
SHA512 82ffeba5b962998ff81698ee73851843f26ff27573212dc4dee2a2733d6d0d716e6b5504828f787ae2c64fb769d48df8317051367e5c0743d0574d89a2436864
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCoga9:A3k03kHRJi56rT
TLSH
T184256A07A6890FA8D10FC1748A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 497da4b8b8b7bcbb73c15436d0e3e6561cd5d15a2ee1267e051bd5a3a02240a0
MD5 266acf4b67cde868c2a8384214e9344c
SHA1 6aa822c2fa2d96f8c3ba71f8ee44aa596b9c45d7
SHA512 71a7ce293037f7c8db1270eef3fb1483bdd182ef0f2c89a0629533b87346c42300062839871514b0376097b2c05437e08bdf18fbb9992dadb44e9f0c3a0e872d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogac:A3k03kHRJi56r6
TLSH
T122256A07A6890FA8D10FC1749A968622EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 328d0204527dc77b24725b99c52099eb12574bf4a204c03e3a890bdc70bd6d3a
MD5 e97ec17bfcc321f4e6137fce907d3fbd
SHA1 4be725b46d9cbc2fc5b728ebf89b0fe4ad1cbeb1
SHA512 3fbb225447b32b47509fe48395ddb629339f424fa1b7a19b2103db44b283250b51ca501ef9919159c1ae2fc0d82185fd10e0793c53c10d45fff1269131b7b5d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogTp:A3k03kHRJi56rg
TLSH
T1B0256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 8a8263c03fc44e3c915c4dfa16e4f4e85b607804a2a41884403be96e6968166b
MD5 0bd9dc76a29f84cb8d16aae2fa9c8f98
SHA1 9b3582bc8d9babd02f2770f351dfc1807f06cce0
SHA512 f1625d68915841f5090a9984832ede6a8af71f1ad7fbba7e13c04199bb159e07d8e96cea56dc3948604109a752395827e5882b5b558fa8f89376b24f32dbd37b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCog0N:A3k03kHRJi56rf
TLSH
T1E2256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 e0168614f8f5554694b0eed4b75d0c3429d767f08b8cb9a85c4583c11741be7c
MD5 4eebaad8ef8a437e18349640480ee7e1
SHA1 7ebcba82f54f830351ffe81b1a38fcc2dfa7a8d1
SHA512 dd5917ce4ff904a87e1219b9dbea5e0ec679b185988285c839eea5d8b26b2dba1cdef4dfea536dddb5dd13f12727a9a935c0beea5a0e7f7f13f66c0509151551
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogcF:A3k03kHRJi56r5
TLSH
T19A256A07A6890FA8D10FC1749A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 79854ae17cccecb4658ac8f8c5c184b0a88544b655424ff52e83bff1b10179ce
MD5 529545694f55749e24f2e1cd66b3626a
SHA1 d711d1ce3dc2b1f550c1d54cba0f3dbc236cb7aa
SHA512 3c5525606bd4d4adfc31f0f1e2843b6e62ab7255807d175982b752b335ccd3b80567a5465396ce6c5dbb17a218b17f4e80195b8c8f43ffa63e104c453fe99be2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogJC:A3k03kHRJi56rF
TLSH
T1DE256A07A6890FA8D10FC1749A968622EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 24c6cf85ab44268f3d46422019b0744cb7640cba9d0b01b9a8157a2be3459d50
MD5 736c85d580fae1dd1032908714d8bdc6
SHA1 0eb0f62a80a6ba581b56b325b8a41fee7945f7d2
SHA512 295572b3fbf5711ade684a55c1ead86fa1fb2b19a91202d6eac205c9fba72d725584591bd9dd3fbd2175f71aa61180c7f9282eb1e21bb0633de7975e5c8fe71a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogqw:A3k03kHRJi56ro
TLSH
T19E256A07A6890FA8D10FC1749A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 32887d0b3290dd1daf9aae2c358aabc682b2754f362d0ecfea2dc2e8a4f58115
MD5 753e1c05434b43b2a69edb63cb5ee815
SHA1 b1aa9d83ef802bf13fa81e5efc9a78d8c140f3b6
SHA512 5afc485ebf84b4a441f9e1084bc75cd16982c35f9ceac1376ab05c499fd48f517a9e531ffe2a8439bd1df86f53718158fdd6eeadf8af50e9466ef247f11f7b3c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogxT:A3k03kHRJi56rg
TLSH
T15D256A07A6890FA8D10FC1749A968622EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 3ed63449b8967319c4c955c34ef1cf8178052f0d6ebcb2d5e9aa40d3f0d5ad3c
MD5 5bfda18338d333bc4d170f4d7f2fef28
SHA1 e8f22ae133566d46aa76116871f65a2ba8700c43
SHA512 b0e09423b70f3e4385eabf126e55e04c5cd04afa29bcc10c696a6f496f827ee04ef34a59d6700840a573a7a6d9540a7c288d47e8ad1cdf9445721f94adf420f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogfu:A3k03kHRJi56rf
TLSH
T195256A07A6890FA8D10FC1748A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 fe0399840891907c886f783759634e3c1f98b156ae388dd24defd47d830e7f48
MD5 f4ebb38083c67d885e1c012512f75a79
SHA1 2a506fa7e6e060f438063d76a45909a41c397184
SHA512 a4e35c9e108a200ba8f66adf62da992c7817022a7570d82503eed9c2bc19c6f3745c383537c7b5d0f63ac8413c23c5ada8630e6fdc10ec6f3df3f2ce4199017e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogDb:A3k03kHRJi56rG
TLSH
T11A256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 dba42f791df8cd25a53a0fbf1d41b4fc8654b50be035bc589fac1cb2db5ebb70
MD5 8223f0dc82f77e995ac234f488843783
SHA1 47b7d629973760b50679f73cd2dab986a12c231f
SHA512 f886adf0c1b8a09dd2b90fcb2f44ab2f62599cdbdf49f83579c294f9142a5c4d4a1ce6de29391433c87f78ed5040b7cece6938271f0d7fbe0522f6b215c5cbc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogXf:A3k03kHRJi56rW
TLSH
T19E256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 acc3f136edda6764a7684d63a0908b0bb44e5a42bcdf58c60d96fe06444b9d0e
MD5 af6ef1736ff8f875b1496ec627e66218
SHA1 0e95a6aebf01e0823cb6b190b26f785ed8ff3be1
SHA512 ed006eb22c39b052104c042a93a3642732ba0155021016555174447eeb6015578515fdcb7b8511876d2a8a0da65865ad051b4832eeb20d194082d3323495ea01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCoggK:A3k03kHRJi56r2
TLSH
T18A256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 002f2b2a56880f5a06c8f5920ecc6cce046c350fa30d105b78f4550f4fb64ab1
MD5 dcda4a6d257adbe9925541ab1f14cc7a
SHA1 bd0b16e21e3873037c3d07a7cdbffc90963c1e8b
SHA512 34e1cb74784d81f37baac8d4ee63b112d62cc7e55239b6bf7888bdf0833accc7f9719a28bde622731ff0284fe67f8e02dd831d851d51184df56b882d4fe6404c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogdk:A3k03kHRJi56rr
TLSH
T160256A07A6890FA8D10FC1749A968662EA777C121F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 14745decbe7e9a06cfe5adb1625b78bbbefecf40bd7d14f14c54d47e437b1597
MD5 61ecc875b650317baf5a92aa98607f39
SHA1 d0727764bc185237c5629d3aa4af4b24bb6e93b7
SHA512 450f02601e63aa5cf01bc02371a6ccd52afc2127c8207236e88483b9e134cb46324dfebd496a9cc1257fab70d5c1ed26ffd4b1d1408f8ff4fd01a9244a14dc07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogC0:A3k03kHRJi56r6
TLSH
T1E0256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 7050ada542c80cfb765b0eef0aed93cf105c271e32de6f6a303fa8f1823e69fc
MD5 52804e259d8beb66970c1359a6995900
SHA1 0dea8bd99f9fddf56f61d7bf6f964d70522f80d7
SHA512 56098c651c2dc6b9d9e2bfe548eed5a3626a32caa29d0bfa9decf9491ab4ccc0b4ac2543b2fdd5abfa68b989037531a4f634ac9aae82018704becc5b57e7470e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogRg:A3k03kHRJi56rD
TLSH
T142256A07A6890FA8D10FC1749A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 5d390202b24e52702afcb62bf4ab187d7a2825625f373ed2da35f1d149cf48f5
MD5 bf2fd24ad54bd9603175a594b4a57fe9
SHA1 90002615ab5866b723feca4f454146dfd7bee4b6
SHA512 114798f9ba718e54514a194dda27bc74d66039fe1a5134a41a738373f5058fd12452f7dd4e956ec2d5824a6140e989228007112758d1685f7d969bf8a5b013a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCog4r:A3k03kHRJi56rV
TLSH
T17C256A07A6890FA8D10FC1748A968662E6777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 9212e4b85abb64781a2f43440946259aee8efdf52e0b4edc76fb08cef53d5603
MD5 4564af9548ea770760cc629c8723ddc1
SHA1 e0f2d4a7925927bf8892c5c845b0a18b258559cb
SHA512 d894503d5ba736592be23a1c1fd0c45ad0ce52b587f4aa22cfeb7bea447c0e056f36f6ab0ff8064391f774ad210b8afee4cdce87d07067faf28a992e195d8fa3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogWn:A3k03kHRJi56rH
TLSH
T1C4256A07A6890FA8D10FC1749A968662EA777C121F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 aa4ee62f7e57316eb2b9c9bb425c568287667252370e3d6e80cb2be5fec3617d
MD5 c2aeaa4d81264eb11530a3e32f83a55a
SHA1 e73c7a0a560436a9ed4ffde6bd9ffef1be5f37da
SHA512 7c1e5364bf12272b77718e926a1cdd7bee94698fa195baefe5e438e278f70933d8e253e11b1c7cf9f60eba7acf8f78ff843a0ca4e14e3986b748cbf47c29edd4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCog8x:A3k03kHRJi56rd
TLSH
T14A256A07A6890FA8D10FC1749A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 fd69a71d24e06c1cf4546581ae7a29a27235591607ba6267611f8d5eb7ba8624
MD5 2fb1d2a93ea4713f3fff4e9d718f6826
SHA1 2e139e35af7692090103da99779ce88b84afc8ff
SHA512 06ef99caaa2bc64fb1f1eb8a2acb05327cccf35bbf1ce95fdbeff0c6673597a253ddc3c884368cb2f43f32d07d911a1b982fcf7c889ac2d4cc672eeb759047cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCog2A:A3k03kHRJi56rC
TLSH
T1A5256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 a27ebc264ab9e73b3f31b34c52dc2c4341ab020a7228668f1f701a1f9acbcc3f
MD5 14ce8d342354e15cd9b708fad50e632b
SHA1 ad9d774c94e752f95fa7f28c3cabc76c31829b1b
SHA512 1060d2cc085bc3a0fd26f90fd1846d217e60eb413979490cea88a21b17c296fcea240d4e3083d17d6ae8ecbc4683c487ec143d64ad7935d241933015a8c53fe5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogv9Q:A3k03kHRJi56rf
TLSH
T13D256A07A6890FA8D10FC1749A968622EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 0ca051da15b424b0da7a60ba933783ff8ae265b47251977b86c0ec4a7b280fbb
MD5 15df6882191dbec72e2d12087b98f02b
SHA1 807489ab724323beb80f48c08b92b62591e52d46
SHA512 bf863bb486e5d777a4e92165045fe6fb30192fb0fede9639b921ad2cbbd35307b5acc9d0a0138a364f8848db3d106238a196197264752521d2e5ccb65245eb55
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogG4:A3k03kHRJi56rg
TLSH
T19E256A07A6890FA8D10FC1749A968662EA777C125F2093CF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 c19a14975de69e73dcd921495f3eb4d288185fb1d3f4052dc2b6f8b1afb0b38c
MD5 4258eea82ef0ebdc0866cbf877094014
SHA1 0b746f59adbd8d7bd7e8a2165e94463208810d76
SHA512 4eb11435ecd768300e98e441c0de5357f0a7b192ff6fca7a9a3de346a201d328615d5401a4420468010b756f501b94804c715d138b2bb570cf57ca539a4bc411
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogVu:A3k03kHRJi56rB
TLSH
T1CD256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 90077b4e506962bbabe8f3e1187d6e640d870021f93704933717682ac2aaab24
MD5 96edc603c2f2428ed3270bbb76f07015
SHA1 d82afc5d68d437ebacaa29ebd3806f585d5d61c8
SHA512 5883076ca8c8eb04b93e13d3f33ff36fed0c47d1a8856d2c7a1fc44ba3e873ffaafb5b624a5e26109bff7f880a67dea27f977b19cf8a1a8a593bddca4e319354
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogIj:A3k03kHRJi56rr
TLSH
T122256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 52730da961a898fd6f9d682c3cc90d1d260ef815735193b4d2d892e406044f48
MD5 611e93728eded0cd478887e3487b4eae
SHA1 dd228056ac55e82743d2a976036c79c7e58d5cee
SHA512 6d6041f04361e4c9e9def4f86cd0efa794c6013363109883bfb2773a7a3fa16c57ff9ede6fdd64c4443bf245fae94834a1bccfe5fe7090156ccc646860c658c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCog5g:A3k03kHRJi56rj
TLSH
T11B256A07A6890FA8D10FC1748A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 84f7a3d50cc757b1932806c9b8443afb6024e62178d2a2266a7da0400daa46d2
MD5 97bb2ac7fb8c636b7a6367b676ddc47e
SHA1 76363056502655648fd4d2cc5305297e982ccb38
SHA512 d718afc5903dff4dbffc497417b78b0bf97dd09b9ebd18a039f38fa39ee952888127d20e83d13c280f6922d90432a31e6d84d1f5ec31d48f357b7aa4b6b5464e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCoggI:A3k03kHRJi56rq
TLSH
T1F1256A07A6890FA8D10FC1748A968662E6777C125F2093DF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 cf52fe00b4870afff1c5525c3a3caf4520a187b81cef5f0a82353349c77ec57c
MD5 717b766ba12f5f5847ab5d66a1fb81f9
SHA1 142e449ceb359ec3f9cf7b7513e0409febc367ec
SHA512 448c381b627cf6e77952d0283d266bc303dfcc58c67a724ad41e506fead11f6635d6ec064bece90e1ecc6d7e85c99bf2cb900b35bfe5192bc0bca2eafefb6141
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogio:A3k03kHRJi56r4
TLSH
T1D2256A07A6890FA8D10FC1749A968622EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 21fe8e1bc3c470062907daa782d291a4a6be75bd46cd120c874de2adb16c50c3
MD5 c6e4e39bd1913041eaadddcbf2d8a436
SHA1 9958166400fa962f69eb6e051fc94129db33cb40
SHA512 6de4aa99442b5f8e47cdc41220794e2136e49673c9ca25ccad1eb4d49d4ae8ac99ef07737935806f33f3434a25379dc01c7d4a47346106997b48a4e1a992907a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogZ+:A3k03kHRJi56rF
TLSH
T11A256A07A6890FA8D10FC1748A968662E6777C125F2093DF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 6429ff38991b7a2fef82ab79e00983bff95123fe97e749fdbb9da90e9d5fb17e
MD5 3864995620367685218f951470081010
SHA1 7f91e64e3b5fcedb7639298756c31edf5d4167a8
SHA512 c23b18033af3923ede85cfa124d5345b13845cdb534dc0cdf85e634546517ffc00f1cf84b5246c1d0198efffbac35b4c6edab432a2bafdacb284920d7735d0f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogHQ:A3k03kHRJi56rN
TLSH
T148256A07A6890FA8D10FC1748A968662E6777C125F2093DF1354AE253F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 807be827c4e57c7ae678f1cdc8d6b29563ac5e47a6849b576f4ab5e8b9c1d1d4
MD5 00f98e1fc1d77aedca87b23863a2fec4
SHA1 b516fee9983d500dee736ae836e556002b9c2474
SHA512 4908acd427bd3cee14edbf98a253d67b5038871e53e84af284559c883e8be087ac144e508013d836a2907008a04134356e0c9e26abd0361885abc554e7ed73d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogcX:A3k03kHRJi56r5
TLSH
T12D256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE253F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 bbfbd29f579e6a207708a4012617ecf15162862ed0edb1a630da4b021d571b5f
MD5 a16fb2969aa52a0a75889fd6b4f29c94
SHA1 c1713e7941e44efc5498e029380d6391956d20ca
SHA512 642cc8de46501c04096bf1c6cf6afa769ffa8f6b0347c0e5b01e314a0096636c357263900664a0e317d41e81e7d3f006646f1ebdec92a94a2974a322a9222213
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCogaL:A3k03kHRJi56rz
TLSH
T167256A07A6890FA8D10FC1748A968662EA737C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 7ceb1e7217125cd66bc53d465a00bbb7e22c19a34209ea98affe59a9d4d00d33
MD5 2cd30af8b35df5d8c76ea862e2d0ac67
SHA1 9e191f13f2b3f0a223b3ac75679ad9bc7ef19d0f
SHA512 848835442de757feac0e44aa4f0b1eecab0f5c5869a5f2568af71fd3d2f5b231aed3faeb4ba86b4ae5aa5829b016b621b0b5f87a3a57cd99ae5d646cc9e8bb46
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCog+M:A3k03kHRJi56r+
TLSH
T15A256A07A6890FA8D10FC1749A968622EA777C125F2093DF1354AE153F72BD06F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 0cd3c41423a563b89140e2bffe18d6eca7e5bf26b5eb0876bff893f92f09201c
MD5 9b0acb0c39e663d73f3f6d3b255b9d44
SHA1 c42521a1925ecc847faba900b4131fc09317a993
SHA512 b9106ac5b1ccba232c336511c891ca2f52ba2876d63f58d47a9a0c9cef911788fe48dba243c6fbba9dc61c0d1191a614541224c2468cc709cf25dc5cc11c8cb7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk4lCognh:A3k03kHRJi56rQ
TLSH
T1F1256A07A6890FA8D10FC1748A968662EA777C125F2093DF1354AE153F72BD06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4260-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5544-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads