3f088440c9f884987ad160ffc8d8dbe2270bc457e4a06db43cea464e5875b92a

Analysis

max time kernel
96s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 903KB
Sample260710-whreesdz9q
SHA256 3f088440c9f884987ad160ffc8d8dbe2270bc457e4a06db43cea464e5875b92a
MD5 5dec6520bbcca84dbe09926bb09fbec9
SHA1 37f9264acf67b1974b9eb917d876ae6248157723
SHA512 0e72e10b1df54f2bcfb5e4e0be3f2d0ae6a9f98509d2d333b86813f75e5096d3657422b85dc0a1096c74f243c9524b18b16439e60545d60b75541926d3c3e6cf
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3A9:A3mnXoZjzyacNVOI/QPzy8w9
TLSH
T170153807E69410E9D01E8134CB964A12F777B86257E096DF13E4D23E2F227906EFA763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3280-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c526-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c529-33.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3280-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4660-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-680.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-987.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c526-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c529-33.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-680.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-987.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4660	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3280	2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
4660	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_5dec6520bbcca84dbe09926bb09fbec9_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3280

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 903KB
SHA256 3f088440c9f884987ad160ffc8d8dbe2270bc457e4a06db43cea464e5875b92a
MD5 5dec6520bbcca84dbe09926bb09fbec9
SHA1 37f9264acf67b1974b9eb917d876ae6248157723
SHA512 0e72e10b1df54f2bcfb5e4e0be3f2d0ae6a9f98509d2d333b86813f75e5096d3657422b85dc0a1096c74f243c9524b18b16439e60545d60b75541926d3c3e6cf
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3A9:A3mnXoZjzyacNVOI/QPzy8w9
TLSH
T170153807E69410E9D01E8134CB964A12F777B86257E096DF13E4D23E2F227906EFA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f41cc925c8752b788dbdb15de074f4c72021267cc78c20e60984506f619863b2
MD5 196316bb79a29cffc6035cbfcd59289f
SHA1 7ca523a1f63bf0a0f1ce27ca996e58dd19556d37
SHA512 3e6d1f40a9a8acef5b32a9a06bc0eaa8b62bb392b99d619fb36a22cdff84dea3088b05eb30f8bb51b2e100d2750f9e220455e36da711ce1748427ede1e8ee7ea
SSDEEP 24576:A3mnXoZjzyacNVOI/QPzy8wJ0Le5ji0hmxNrM:A3kMvePji0Aj
TLSH
T175653816E6A402A5D02EC178C7D2965AFB73385217F086CB13D4D63D2F236D19EBA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 918KB
SHA256 43db1ec98ba29f781323147176489d98f2b7faa84fc4822db4c032fa921f102a
MD5 84cbc97728ee9373864e74f025e0543b
SHA1 fd4a1a2bf499f90f723840540e984bfe0845393a
SHA512 d503ba318cc9fec06ed2be55bddadb0791c017cdf38d1a16ec9e2adf1f78391d4f6c4f30e13e7f99fcfeaac7f8e9fdca9d3e36b89bf19fb6728175de4316ddc0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Aba:A3mnXoZjzyacNVOI/QPzy8wba
TLSH
T152154807E69410E9D11E8134CB964A12F777B82257E096DF13E4D23E2F227906EFA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 927KB
SHA256 231d41b8113c8c81d8abdb46fec2bfb51064cf7e4c024f78a75544318d2c7ba8
MD5 827023d1038d30269c655fac7a261f41
SHA1 b8869143012d3037b6fede4552dc1955a3703a59
SHA512 1c7a1025b829f816148854c41fb7e19cf922ac11e1b6523f2d2d141670d19d2aaf5cba33946ea5adf9600a7c22ef3f2998e15f6f3e81d0957da73b73ec5abd33
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3A66:A3mnXoZjzyacNVOI/QPzy8w66
TLSH
T1E6154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 927KB
SHA256 e5f5ab3226fa64b9aeb974a39dbb47963f0422d8375a931530f9b668ca31779a
MD5 eaaf5af71190b0cc236f173c37f94a2e
SHA1 8a3fde2722d0f628d92259fe9aa0e01a4283257e
SHA512 1f45a7f7d6dc44589925d44d9334556271bb67e10352ee33f9382226662a642306f6898b685325772d17a186169c46055e845f7d6396ccbcd43ae284c307efff
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AyN:A3mnXoZjzyacNVOI/QPzy8wyN
TLSH
T193154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 927KB
SHA256 a4b9b3df2b40980647e61aa1c33019b1bfa1cdfe93c5826bd6cc5ef0e99d64a0
MD5 156ebc967348818ddc5bab874405a1c4
SHA1 4b0eb5ecbb73823fbcdd53c99e6ee9eb2bf7e12d
SHA512 9ac06ca83e7ed4c5c5fb500e817c2a20084df5e606bbc17ef0a8f968eb1a9e208f08e1676e8a9b7b8d424171ab82d011601ebad719591fac073f2f25ddf8912e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Aof:A3mnXoZjzyacNVOI/QPzy8wof
TLSH
T1D7154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 927KB
SHA256 fda402e6e462fa85c19ce5c4a3fa509fed8e19c4cb8d0898325b163dd24ade1f
MD5 1eac3a02aa965daa81dd2af180b2f5eb
SHA1 e221fcda524f86f47642d05a657c7a408b851bf1
SHA512 e1ca7a229be2e5f11165b12d770cbced895220e531cc60b92ece55f236284adcca148b01c1f0ea3cd4fd09e972c0f88ee7b4516ec1c1b930adea07d9b5e74786
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3ACo:A3mnXoZjzyacNVOI/QPzy8wCo
TLSH
T139154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 927KB
SHA256 4139edb745d6813881a75223cc20e3314eb6fd237c91af1aa8be99e4f8794354
MD5 45f3ad09feed1f82d15eb44a2d1a9c28
SHA1 fb0d36e5248ddfd6fa0d374b7b2d19dcd5a95cf3
SHA512 e64164c795664279640e1ce80e80c90dc8dd06dc94a4a6b0368ceaee21f9a40aa9d2021b7e9b4df69feee4534c7ff5c0090ef4512ed4b45165123d856737ce71
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3A2u:A3mnXoZjzyacNVOI/QPzy8w2u
TLSH
T145154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 927KB
SHA256 cff456091725432bbd066f4c9cbe72688254d9f50dcc94bc904b5bef090351dd
MD5 4c829c18380929629c7b6aa2d3f6648c
SHA1 0c6ea1056bfe5775f552e951f9a9e80d17719830
SHA512 1ac9daf1d9f973c36f43ad6e906ffb44a8afdf732344dbefe98a7ca44171204fb00cb6e3f4c3429114f27fe685ddc57db67cbad3e41cdc7baffd7a3aed8539bc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Aq9:A3mnXoZjzyacNVOI/QPzy8wq9
TLSH
T138154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 927KB
SHA256 e17745f45fa4a19376e54ba9e9938ac868e366313b7c98c74e5d881ede5567a9
MD5 5facacd24a044cc588e465640162e457
SHA1 ad962889ad83cfcc70109d85206e92fd2840557a
SHA512 0cef0c543f9a8040f64945f44d1b9fa204355419b7ce49e9b4d4a50d0c81420e39cab10712e3060e943c687ab8eb846c28d0f07c145d0942c0b707eea8f47a9c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Aqc:A3mnXoZjzyacNVOI/QPzy8wqc
TLSH
T131154907E69410E9D01E8134CB964A12F777B82257E096DF23E4D23D2F227906EFA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 927KB
SHA256 71dcefcee0054cedff46708670ad3002c4103416f36e2bae8e9e518ec88bffb5
MD5 41725f5c2a8fa988b9672917b2c2748c
SHA1 7a55a2da33e8860b9d5b4de7be3581d5cda6eb3a
SHA512 af98e56762d701d151ef16f651b4dccd132fc77cdaa451ddb5ff72b4c668c178c3a9fc1ad5e2112fb43f55b7da7843e237be0ad6a3c90f759d1b2508c028e776
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Ajp:A3mnXoZjzyacNVOI/QPzy8wjp
TLSH
T1D3154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 927KB
SHA256 11f138eb675d77658b3e6911b6743439b89d6dbc3d0d17e6658240420220647d
MD5 33faf906764e382b7d2233d32ba6d4e9
SHA1 def1c488b582fde252ba8e6fa846dd6a56c193ad
SHA512 1246e3b0cfe2942066d37d33420460a50d0a22567a2dadd40094ac27150aabf1041fafd4a2b8ac6d5de8e552f26a084e4259c9b4438e213ddaa235ebf5eb2d3c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AE0a:A3mnXoZjzyacNVOI/QPzy8wEN
TLSH
T116154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 927KB
SHA256 4d3e2675221b1535394d09ed0e3ca4da35f6e56ed7f84a03723f102b558180d7
MD5 837285f56c8b0a6ec10ab7fa150f30e8
SHA1 561dbb365aad49ca5f6119fe701c575da04ce3b6
SHA512 22514d1f092ada5fb2d18a50eeeb5b544848ed6dc91e677dd285fb27855586b936745d948240018db004457d7acb85ec92221a322590bc1d036137e1cb5ee6e0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AsF:A3mnXoZjzyacNVOI/QPzy8wsF
TLSH
T1FF154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 927KB
SHA256 2465f13e3f9637000a5c9c0b63ab391f4842442d5d0e65b118e64192fc46c095
MD5 285cd84d9ef37ac940dc6b3e1082b607
SHA1 56c0c7dceb8301835a9dd3071089984e07616ed0
SHA512 783690b22a56ece11019383053ca561b748e8f72183bb8af91542b79ad898cea55c4ecca564be950267c293149471d25eb8a08f85cc57901557e29d537bc7dbe
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AZC:A3mnXoZjzyacNVOI/QPzy8wZC
TLSH
T195154907E69410E9D01E8134CB964A12F777B82257E096DF23E4D23D2F227906EFA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 927KB
SHA256 4269d6dc7ed531f0b3b450be9fd8e49947582eb05a735fd016ecdc62814958ea
MD5 da4b067e45c5028e8909856d75ce39e6
SHA1 a3ffbcf695ef03c49696e193ee6b7d20fcde27b6
SHA512 db77cf233764d2fdb7595ddb7002536a6106c82c062344f681f568b617078294c7846bb6d9732227bd75a33bffd42ed3ea9ac657e316417c50c87c2768177185
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Aaw:A3mnXoZjzyacNVOI/QPzy8waw
TLSH
T1F0154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 927KB
SHA256 98b85c4772aef46fc39c04c18616b4886fdc01866dd09c831562591207bb7d2d
MD5 c218ba0323fdaa26e0d9d4189b0bd9d1
SHA1 3eb1e82fc43485a462791853a1adfcd6f8f17718
SHA512 c0f96e94520d7dafcf68b8b91697f2d7b604c7c1db7961cd35bf53a4ed7bc3057b3f964fb265c9f678db2c911c08b06e0db29e7ad68fee35e8493ea4c7f04f51
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AhT:A3mnXoZjzyacNVOI/QPzy8whT
TLSH
T115154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 927KB
SHA256 fdf946de5fe7f689898ca36afad68f8affc95a608cbd56652a4227724fcfa335
MD5 e67fcb8ee8cf179d61ddbb56d7cec8cb
SHA1 e9e62c7711febcbff9a0a39043d1a92f1f70f595
SHA512 6b93136e86eb64a37b37efffcccf29ff924829b88fad33e283b8e104d6e5d0f4587f1c75013ce4c579de5aeade3de02d19046cecdd2793072832666a37393d55
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3APu:A3mnXoZjzyacNVOI/QPzy8wPu
TLSH
T1D5154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 927KB
SHA256 571dbbb877ff89919546178a3c89a35cb159e72847782b2d2ad4a538581994c9
MD5 5c7a7fc224d07b04043aeecab19cc467
SHA1 decad4b2be2078d580a6c4f42ff5234c5d47626c
SHA512 be0a6993bd1721ddf667b8a6ed55ca96b55b5851d495c2cdc5404452e38a6d3f0dcaaffab0c97d5d407068d6a7ea7bd3792ecd6e11648e125c97ee14dc1b617c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Azb:A3mnXoZjzyacNVOI/QPzy8wzb
TLSH
T189154807E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 927KB
SHA256 e8fcfd7b5ada937fabae5df81b61c6b1adf01fa24a23af2a3887a5bc6acfc253
MD5 260deb62d7f49412ce191df5a370f4b5
SHA1 74a0667086cb76fd7c706a8c87b2cb969eaef1f7
SHA512 5c80391d4489736485549e178cd017dc65d6a7f0e9d2c7b1956e9beb8ae683e31de30eb02f2a8074e0a9caabb9cc8931bfcd2310fac6352b89984968fd168fe4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AHf:A3mnXoZjzyacNVOI/QPzy8wHf
TLSH
T118154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 927KB
SHA256 457e59f7fac513fb6b0d933ef19374613d593c6342ff82d90498e161fa3dc749
MD5 0c494a5c90c79175599a889e8854e3e4
SHA1 0a200abc5ee3f8a33107d7240c39f38b28011335
SHA512 f6299569bfbcc4c2613eab39d628a843ab5db22f196d3610290b274978774ba5b99016e75f67ab528b9ee927eaed711a8e924260c5227ef285b540b90f326bdc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AwK:A3mnXoZjzyacNVOI/QPzy8wwK
TLSH
T14B154807E69410E9D01E8134CB954A12FB77B82257E096DF23E4D23D2F227906EFA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 927KB
SHA256 98d063117bb7db955f65ccb02bdc825f73b43fa4c1eeef17021b5c207e848375
MD5 d9e11b9d8ddf851d88a86364a6d324e2
SHA1 2a6d94e8d7f0f1ec32438e2e08eeee37eb192e84
SHA512 d8a302504f2be7009c43cd577f48058289fa924e03add5b62029f3379c502b208bbea0d79c0be16b9d6800555d6e02b18023994cd8131f211f0b4aa1224a38ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Atk:A3mnXoZjzyacNVOI/QPzy8wtk
TLSH
T1D1154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 927KB
SHA256 097c58ac8caeaf18af8445e7bc5a0e7f3573329259afad59b1e96bae539e239e
MD5 30c70f18eb52297638459ca1239a4205
SHA1 9ab5ce39a15a150fe1a1e71c45058d872e866eb4
SHA512 8f7a901dd02a5bb9ad710497c17de5669a36b89c01f35d237cafcbefde024a797442f86f22d6fe80083111dff9e18130569379a4d3ee284a703b7fba6af07d60
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Ay0:A3mnXoZjzyacNVOI/QPzy8wy0
TLSH
T14C154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 927KB
SHA256 46760a60fb558ca79c4e660087e528466b96cf2dfbeeb005e4aee47d65db20c4
MD5 d1e754b63047c28a3f00f704e77b54d6
SHA1 46cf49a2d98973d40ae19d00ca29c5b3e075bfc2
SHA512 9c188e3dc8094d9f72de250abf8dba1cfce684fc01a122ae374fc56ce204de94b6884fb439a0827adad65214980937a13fee86098af7dfe6bc3af6755c72bb70
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AB70:A3mnXoZjzyacNVOI/QPzy8wBg
TLSH
T131154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 927KB
SHA256 cb33fef794e5afe360813a6748b95521ad9553d810ad64f3718e1cee00fc7cb2
MD5 f946ef59f93828086d8b3856a11ec32a
SHA1 d6d197f45610fea05cada5ed2501588017891cee
SHA512 adcbc25fa7dc80320ecdcb346af71da63cff87d3186f49195663f8faf7fe02136ee51406c7b34b6879f3861d5f0f470598003c3806b2a69355704fe5655bcba3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Aor:A3mnXoZjzyacNVOI/QPzy8wor
TLSH
T1BC154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 927KB
SHA256 a01897551bc8b60ccad4f06531390c80ab2ad8586a276d7c015e22eaf32ec7e1
MD5 9eb1f5d6f19396474164d61e08d44b8f
SHA1 4088235be178fca6ad5ffbe1102b4aea4d04d3b0
SHA512 b9abdfcd389ad63a877257c5c1b39b069769da218389de92b08f1bd0280913c1ede72a50f91ec246f092015f70f9631e5898ee25a671fcf43ad76339f5770628
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AGn:A3mnXoZjzyacNVOI/QPzy8wGn
TLSH
T150154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 927KB
SHA256 f08bb8cabd159f231c711b54f3063011b20ac2d262d68bd3a6f688f73205870f
MD5 01206e1ad22e2a8f21d4115cf633b120
SHA1 ed7c25c254569823153647a5a1a3e39868893bc9
SHA512 3c78347b7fc140c32866727b364175f34ecf554763e15dbc1e9de6a10b91419a472a0d374c9241de16526745f05ce0e7d8d76f24bb5e7133c8bee64755e5a1aa
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AMx:A3mnXoZjzyacNVOI/QPzy8wMx
TLSH
T1D5154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 927KB
SHA256 83dd5e824a2d6eed5a678d913d3bf11d42b6e0a612c818543805c00a6fa93515
MD5 be7d252ccb678a8693a94b87c6570c02
SHA1 4dbf37e4a5dfd060093124a57dfbc555c29dcc7f
SHA512 d0ba043126b7e054baf146f0abad64295679569c1ea05f45ba646119cbda81a840348c5887e690bb830ab72a7fc510c0c6631c5f47b9b507610f525e71951af5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AGA:A3mnXoZjzyacNVOI/QPzy8wGA
TLSH
T139154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 927KB
SHA256 e987e80540062b74a9081f1a1efd92adcd07debc31e359a8dc236420158009f9
MD5 caa58a23b744b9def9b0e5e93066b6ea
SHA1 b95c19cd81a334acb23ec6ca1a4bb76bc1a66b27
SHA512 2b8031ce6cabbbafaf3b17f82932e8b96d404c81d695f62260f037d6f018914999e48017374e1c84abe9ea2bfbfa268ecab9581b183a05e768d87fb6beaec629
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Af9Q:A3mnXoZjzyacNVOI/QPzy8wf9Q
TLSH
T107154907E69410E9D01E8134CB964A12F777B86217E096DF23E4D23D2F227906EFA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 927KB
SHA256 6e0ede665112bdf28c56bb493f6fc76db3f15993060515762bed1e4ab588d476
MD5 55a4834aa02abf39c02e6b5a1c79df65
SHA1 c2bb947ba57ad670d8ba8a02f7f4c8c4cbed7a10
SHA512 6858906e2d6fca0db9330f5758c09509115d63e120e0f4098ab26ada03ef7aa3a0cba04ef54892172b2a494d3affb816aec9ed8666161a7728b19c1821cdf1ef
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AW4:A3mnXoZjzyacNVOI/QPzy8wW4
TLSH
T1A5154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 927KB
SHA256 d39f7735deb6dff0382e79afbd07e9f183c63d00746299f92cccaf146424c9c6
MD5 63034e1836fa0dfda24919d6720d6e96
SHA1 bd36535b47686de844f045a09d86e4210e9f1dbf
SHA512 7dd374c3cc3da90fe03080730d15fee21a79e8444d4b7f897dd58409f273ce6aa7fbc9166f978937aa2ff499cdcd03a9483209062f710e6a565d7a75ad52324a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AFu:A3mnXoZjzyacNVOI/QPzy8wFu
TLSH
T1A2154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 927KB
SHA256 cc7ace270539420059dbd55e40d7a594ec7d4d97aea6674e78a1a1933e14834f
MD5 73c4536e4bc9a3e3a8d2ca1ff9c1d2cf
SHA1 689835358bacefb9c6822b48a60ac558127bd92f
SHA512 bd944c6f5dd9ef6b31b7de92ad772acca3de19da6c788f98fef22c41767883b2b22da8ec0717a173181865078cf85b5c0ddfb833920b11d9acf8f88351de7a18
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AYj:A3mnXoZjzyacNVOI/QPzy8wYj
TLSH
T1C8154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 927KB
SHA256 defca1dd80c480d28fb51cfdd3a5ab0df2eba77a87491ff42353f3dcae2aee8a
MD5 f58feb4d2112cbe65744c00c94b4eb84
SHA1 b191b54ed17bd912a960e2d5b455a28847fc5e3e
SHA512 c778aabf20b4118d581de63930c12fca73b3086c75294cb6c3f4b7d2e66d3698571d0c84588ab8804df28593a2107e6a4ac7f2b6e21109caf5139d0eb3023955
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Apg:A3mnXoZjzyacNVOI/QPzy8wpg
TLSH
T15C154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 927KB
SHA256 f10a55e4b4dbc6860fda9317de1a4b040367afb09fa1bf1fe6880e469a13ccdc
MD5 59c3a095160fa9f5a29086e60b18e4d9
SHA1 cfb10e6051db969782a16f280967776262061d52
SHA512 1686e57ead2a4d03dcc8f74bc877216393ab7c9100ec00a632d3f6bfe8a86b9f33a16c5888fef035d12db411cee33561e96f4a6c1b543f6475c3664761bca8cc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AwI:A3mnXoZjzyacNVOI/QPzy8wwI
TLSH
T18C154807E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 927KB
SHA256 d0c74b91bb1168e65892f5c265a7ed544bc9c67c08214ffd86ae4f3f991844cb
MD5 78554134849f673e646354673900f497
SHA1 d79c65d0f264c9076aa163dbde1b2c58bee7bb44
SHA512 4d4e1359e6f37e8cc34a210c78fdb961a266902a4b57e92d15ade605383d7f6c3611ba69a06ee63c3cad995e82ea7597bef99caa8c627c9bc24bf8adfcbad672
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Ayo:A3mnXoZjzyacNVOI/QPzy8wyo
TLSH
T189154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 927KB
SHA256 f53e84e372ac1eea7a17872112da7892fdc0411ef98b915c2792f860d6477b81
MD5 a44f82d9acad18e2e4e38012846a7833
SHA1 87bda4b8d430b57156500cb2199212acce43dbb7
SHA512 82a9d7f17c8f124c1878ba9550489461f9a9523e15aebd63a6a953479e8eef2ad4f638dfc74b54cf6021cc8b691903d61d972d74c75c878e9ea84aeb926af6cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3Ap+:A3mnXoZjzyacNVOI/QPzy8wp+
TLSH
T1AF154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 927KB
SHA256 3e4f5a83bd54c73b17204d18f54c098d3326574df95d602c580909670c2fa93f
MD5 69317be921f5f5574ab808afc11f254a
SHA1 e218c82e7cc597cf8a3cacc2e10c1aa290999ab6
SHA512 ef9bbae9e30d8a272db05a797a5a85933421ab093d6f57d815baca0211d60c260299447d18ad716fe32a90ca2cfdf8d9470bf93b1736e2860b31bf05b450dd8b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AXQ:A3mnXoZjzyacNVOI/QPzy8wXQ
TLSH
T150154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23E2F227906EFA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 927KB
SHA256 4c53cbe205ecd78452b4d81601eddb40b66504a9d5034304c260db66da1fe324
MD5 8efbdbc608194055e3758622820ffa0a
SHA1 ce1a2eb76d93bc5f5525003f66599784e6745776
SHA512 200291a4cc0c28bb01ef54aa121fd7456688ad630f33979cc76c4c08d70977753d1770f95eadfe4ee3aead1229ca6abde3b14eb3f969ec587ddd0169ff8bd868
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AsX:A3mnXoZjzyacNVOI/QPzy8wsX
TLSH
T119154807E69410E9D01E8134CB964A12F777B86217E096DF23E4D23D2F227906EFA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 927KB
SHA256 014e458f5ec7144d2b0bb3c4c856d24242917f54f12d27a427e5e34b7c4a4f20
MD5 d1b67cc643049f9d6d13e132b18fc0f5
SHA1 911f107e75da2417733f7419ad326cbc4089de6a
SHA512 a6de2bd2baf8ee5e5a902b8713233860e1386e4bf2d7fa1b1fff51bee81dc55283d3f7bb11b4aacf6cc683af5ce4ab4de6f76dd24323db720c46f4d4bb737e8e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AKL:A3mnXoZjzyacNVOI/QPzy8wKL
TLSH
T1BE154907E69410E9D01E8134CB954A12F777B86217E096DF13E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 927KB
SHA256 bf181352b8f4ab6230017691dae6099a52d49bc25f18d2969b3965953342c6b6
MD5 84cab4a7e30ead01576c8d98caf4ee63
SHA1 0e927942c7bd755e245c5d8e5733e2d3f8af3240
SHA512 d5cdae4322211d401d4b161e48b3aed9b5b719c9069c686690b99b1af3c4181a0e7c2646f23a7ceb2db33eb6eca531c6645031eebeeff24688f6ed4f50d583ab
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3AuFC:A3mnXoZjzyacNVOI/QPzy8wuM
TLSH
T1A8154907E69410E9D01E8134CB954A12F777B82257E096DF23E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 927KB
SHA256 c5e29e6d5eece86e1a5e68fa6f248e67b11ccd7fe181d86cba64fb926a339505
MD5 7a5b72629ac5d137abb575e17a903002
SHA1 1d45fef29601f6c0a5a605b52871e3707c6f45d5
SHA512 1445d68ad699ca84741868c4fe02120a0abf390ba2130134ea65576451390e39b9a7c2a6b8a45e3e85a233d94917217284866a46b3e9ee9c5746f764fea79390
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfQSyPz5L8JXsf3A3h:A3mnXoZjzyacNVOI/QPzy8w3h
TLSH
T1CA154907E69410E9D01E8134CB964A12F777B82257E096DF13E4D23D2F227906EFA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3280-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4660-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads