4990908ea77cd6fa0ce1d4da5b7d0c6a02c69b41172d048ebfdaab0d998161ad

Analysis

max time kernel
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 909KB
Sample260711-qa99nsbs9p
SHA256 4990908ea77cd6fa0ce1d4da5b7d0c6a02c69b41172d048ebfdaab0d998161ad
MD5 7cfa9e5421dd029f1355db5a0aff99ef
SHA1 7b40e0abce1121aa0d297575dd032601f96bca7c
SHA512 19a52b618ceb208eeea69f59fe0d3c809f6e632e3603e413e96c9389e801bc7ea23c59121e2a302b2e64933b314cfd850e08c7f49664b5674169f53048035d80
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4o:A3k03kB56r6
TLSH
T112157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5076-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c510-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5076-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4420-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-600.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-944.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-975.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1098.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1206.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c510-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-428.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-600.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-944.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-975.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1098.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1206.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4420	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5076	2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
4420	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_7cfa9e5421dd029f1355db5a0aff99ef_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5076

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 909KB
SHA256 4990908ea77cd6fa0ce1d4da5b7d0c6a02c69b41172d048ebfdaab0d998161ad
MD5 7cfa9e5421dd029f1355db5a0aff99ef
SHA1 7b40e0abce1121aa0d297575dd032601f96bca7c
SHA512 19a52b618ceb208eeea69f59fe0d3c809f6e632e3603e413e96c9389e801bc7ea23c59121e2a302b2e64933b314cfd850e08c7f49664b5674169f53048035d80
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4o:A3k03kB56r6
TLSH
T112157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7b090d343025e8de3cbc5c0ec2798252cf0b160378369e9eea2db276b3b716bf
MD5 309b357054797570dd87f997a5ca09e2
SHA1 340b9ab45738c7e50e47c979be17b10e7d8a9acd
SHA512 d0cc69555c85e4ec88097e531aea0c2217cb0d7f57e779f5c13dfaebe62a383dc7ef113e1506ed9314b240e4deef0a9a5ab13c2e34478bbe42f9f62e78d8aecc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4w0Le5ji0hmxNrM:A3k03kB56rKPji0Aj
TLSH
T102655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 924KB
SHA256 0961a11529a63dfae958f40c09fece039d7404fc3346397a7691bd9897bbab8d
MD5 facf4dfd06a4f51f2b5662d7a5f2d8a3
SHA1 bab8b3bb52c1600f3cd68b10721f4301c4016a54
SHA512 c61ad3c09262407420f6498a4aba8d4726c9c9ccb34e274138c7ef4ed0fb2b601bb6d57d4dcb28fe5057435d169c6350e7e7fbd29518947edfbb621f1254b73b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4Ka:A3k03kB56r
TLSH
T1C0157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 933KB
SHA256 6750f128b02a8a2d8ad436b748e9886addc0402f262d3b683ad78dd685e0fdcd
MD5 00b47c22a852edee83f59511fcf3e6f8
SHA1 22ceaf269e2fa56b1b5d0aab01cff70b7cac7e53
SHA512 214f61ab61291feb6d151fa1d61e8fb256532e9d2e51fabb2d163eed963ed3882d39ef48e5196ed97553288ec4f60571260ecb0350e6c5891714ef6383e1f0fa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan476:A3k03kB56rU
TLSH
T148157B13E6850FA5D00F81749A958662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 933KB
SHA256 8e6e0925e769d6ab6dd602e6ff1ec3ba4ac46c81e04472b6ffe7a3305a2c6211
MD5 94785c48000e6777ab073c5f7286f935
SHA1 ff868900814530a01a0567e43495b0e24f611867
SHA512 c006a9ed47d8013e63ad2807fd9db3bb3ab7740fbeb6b9f2339b4387c115048dc5c6ad4d026296f6ed127f37b55900b6ef08226bc2e75635c2331858068b90e6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4lN:A3k03kB56rp
TLSH
T1CF157B03E6850FA5D00F81749A968662EA777C465F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 933KB
SHA256 8b19c186199ee0f7739c14683711a1f41566386c84b43cd0df6b304700bf97f6
MD5 470be83518c1bde08ef45e42848b97bc
SHA1 07222dc5b06b67de2c587ea5567c9a212c402a52
SHA512 967302ca689e8b84a1a4f2f5df4bafd3db155e83680de75798df4cdfdc0df90231266643afcbbf7128c2a78180281fa1a4033a25e56ccf64f8f4f4fe43b1021b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4jf:A3k03kB56rp
TLSH
T127157B13E6850FA5D00F81749A968662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 933KB
SHA256 cbf6e85a6b3abaa6ac45604aa2e01e40a922cace04354030aead7b5e00be1228
MD5 6fbe51383bf2ea40a14ebe3e73b446d1
SHA1 26e2c09689eb16426c873d2d2299efa6f6e21fc2
SHA512 abb9714ec42068f34e2d1d7bf4369195106b2d8643253d9decdee99c8a7cf9447a51e9db25a2092f62de9722bbab57f2aa32282aff1a99c19cac75e58ebd38ae
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan41o:A3k03kB56rc
TLSH
T1E8157B13E6850FA5D00F81749A964662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 933KB
SHA256 a523f4be0c6d39c4461344a5254946bf0b86ae32b576d92834530f2a633e4357
MD5 0bcb6748c4040dd22eda4c6d86cd058e
SHA1 56a48fd866c045f9fb2a7f1e988a37435ce37f7f
SHA512 7955be04d6776069e832277e1a518b131d7a41b8cc52df33eca1e91ab507458028c03ef50b46cdd81e1046d5da7c8ceaac2e7164b82fa67a5993477fe04bc308
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan41u:A3k03kB56re
TLSH
T175157B13E6850FA5D00F81749A964662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 933KB
SHA256 4c60a91edd602dbe6fb9043b40ec0065122b62737c2bc049544bf51a6bed06f0
MD5 c53a8999ef893681c0722a56ea0dcada
SHA1 83b2bca40ec195fcc7374f7202177c4b4a9ca7e8
SHA512 3bd8c9b004b60b3b6c575cddd17b3f1793cf90bbae994ac08ac8790eefbc66bee6c58718da0245c2cf0faa1b7d0856236b4489329f47ced67e0df423f8d63e1d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4r9:A3k03kB56rf
TLSH
T16F157B13E6850FA5D00FC1749A964662EA777C065F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 933KB
SHA256 d7394cc7a82284c069c0dcc3e07684a09f3747508eb3943c0bffdd8487c03659
MD5 b70debb34c1bfac40a2cdbb03dccc337
SHA1 9b970c6997a6fe87cddcfe684cd580df08a18337
SHA512 55fb67fda333e8eafef3efbd3af6a9af81633aec4a7dca9bab4658eb71ba574fcf7eb17eb403a34a0fbcaa4997217a72b6a8a26ac169d2a3056399383d81b617
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan43c:A3k03kB56re
TLSH
T166157B13E6850FA5D00F81749A968662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 933KB
SHA256 9517f0faef2e88db1cdf50d5237f890b8696ccc9abff4613f2a9318c58912f35
MD5 91a02b99596741bebe51f881f015b42d
SHA1 f7ef9f871e58f3e6ab8f064949536925c94f4a69
SHA512 b10472a19e40380656ae1ded5e294b0f96cfffb320f74f5190d2d08a24b5d4d784b69b9bba06a8d46a5b3a11d588d15a72b0799e0ca83e5dc9e386eaf08cc9ab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4Ap:A3k03kB56rs
TLSH
T192157B13E6850FA4D00FC1749A964662EA777C465F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 933KB
SHA256 f74fd44064bacb76cf78af32fd276c98269505ee0b315492ab5140228d59c4bc
MD5 c61480e1a9c552a748dcc1e8165af198
SHA1 e9d09f2473cb59015b325928ebf49998406d97a4
SHA512 49899a81daa8b3f305a0866bb744cd30c82cb2602a92e6326b0bbcf2b582dd65792e4ef40739902508757801f97f5efd92d892a721c8b0849971622f32b8410e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4HN:A3k03kB56rr
TLSH
T1C4157B13E6850FA5D00F81749A968662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 933KB
SHA256 215227d0c4ff4fe039a4c56da5a5aeb852ebf0fdf16f2d6496c63991e036f79e
MD5 133a5590719f4f410c5b1f2754e77c69
SHA1 45de9cbe596196c6e04c7a55fd28480ef1d0cdf9
SHA512 5bf1987d9f96b4eed28fe458af118cd8de762489f4e411362a789f0658e2a7062bf8b0b307f90b06ec39f53446497f4b523c0a30851ce73a993e99c32445e825
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4lF:A3k03kB56rd
TLSH
T182157B13E6850FA5D00F81749A964662EA777C425F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 933KB
SHA256 382d5ff7c60a9baa37ea61fb257fc3d3fd5b513f88cefd90d3f1cb6bac770954
MD5 4273443080728479d604c98d0ae2427f
SHA1 a0050468d36080b977a1e0f19ba38bc065815d72
SHA512 a632089a1d383a8c47c80a5d68d2e36afab337cc259f55ddbb8db29204b7d17cd43927a79adf51a8141f5575cb4aa6618befaf66a0e2dd10777bb3e0a20bcd11
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4GC:A3k03kB56rB
TLSH
T1AA157B13E6850FA4D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 933KB
SHA256 ffe5c612f086f80aca1e4d62ba8aff3d3a2c2422ddb7a06a7a2f5c8a5b7acd55
MD5 55bae1e50c21619622e0743bb0fead2a
SHA1 a6fb990b281a655d399a141fbacde1a65c60b5a6
SHA512 a3c6953909ea2fc2061442933d2a65912634acb3ef6c49e58a18a97abe77a3d209f586b53af8242ab7b5a06b5fda8fb4063de16a21b4eae24156fa855932da36
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4Jw:A3k03kB56rM
TLSH
T19B157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 933KB
SHA256 988f1255753f302750eee0af94b69f1de7a499f39d692b7be8c6afe2b1d0dd07
MD5 404a873088b9feb686966586ca692796
SHA1 7a34377395ed089bd3bb0a247903ab617258d1b2
SHA512 a84e9ff19df684ab6438a0ed8cc97146bfc9892cfb04fbe0eeee4209b88657c0caa978af9d79a8f76b650869247470dcbb52bf5bb2aa0184a286901bf87c8874
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4QT:A3k03kB56r0
TLSH
T10E157B13E6850FA4D00FC1749A958662EA777C465F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 933KB
SHA256 384425ba3f1796b6b3aa3fcb94f3749c4d044731b6d926c15b22336fb56b4321
MD5 a0bb949755172599128ae6e0784288e0
SHA1 31d3f685ed0610eca2abb5434942232ad19dd833
SHA512 924a91d56524f02f93c1a9c2ce263369e6b576c8820f0925772735a0888adcd2e4daa8276743f065f2496da569f8280cfda3733675c5f36327b165c3f75a12c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan48u:A3k03kB56rj
TLSH
T145157B13E6850FA5D00F81749A964662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 933KB
SHA256 49168174599e997b30b391e93d74d9bf127990fc17c3aab37bb2402b056ba8a9
MD5 acc0ee2cb308f8ed86d2009f56de56c1
SHA1 1c44f4195c88cbafa366cbcccdce2c0d9df66b79
SHA512 0ab408001af96b570349e31f8b621c3658169d234b418ab689255c23ff9b7dddbe44c0e5a0594163a43e91a075e1bfb7150affd4e658e74f87e425f851fa1ad9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4ab:A3k03kB56rq
TLSH
T145157B13E6850FA5D00FC1749A958662EA777C065F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 933KB
SHA256 b07c8f721f164b4ee9ea3ee8162ff6d6b9a860e8b195661ce2b64063b49716b5
MD5 9b1965c71a57da84b53a135a95090323
SHA1 cc9fc3a5f891163138fa67070de39ef25f633a0b
SHA512 f1ddf4998735e3c5e5d902aa133bc676c0fcbd4bac82d485c187556ed6a3b547a27f9858f894986b7fca8b59b4b1baddb25c74f65521598ee834952e0d402249
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4cf:A3k03kB56r6
TLSH
T1BE157B13E6850FA5D00FC1749A958662EA777C065F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 933KB
SHA256 5daed9e5e47567098ecf479998ee8cfd1955aced6ec99d2459a453c56b38002c
MD5 eaa1ce5742040f14b35f473673dca7ba
SHA1 f35221a33c69448bf47bb5eb0ccbb90f2aa835ca
SHA512 668b8709553eff960884df49587b6b1fd92983442b384ff7d3f7b5fb18cc7c0c6cf70e781e21a21848e288bfd5f915af48b69733d2cbc0d955513e364fcc11f0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan45K:A3k03kB56r6
TLSH
T105157B13E6850FA5D00FC1749A958662EA777C065F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 933KB
SHA256 7279d6f1455bafb36bb5272183a426d9fda912c026f4ec93e963c5194911d71f
MD5 4bd3e73ecd7b2bb18deaa45549c1e2e3
SHA1 c365d2fe5c21d43f68a6f274d9f23f8b74b12b31
SHA512 c7a36b73f03f8de732ed8c604e7c88aa461f4ca6ad44a02fda8b6462bb75c3154d429bab8ae74d2cce05f03e2c6407ae4ebe66e10f530c309eeceda76ad287b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4ik:A3k03kB56rf
TLSH
T10F157B13E6850FA5D00F81749A964662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 933KB
SHA256 5e10190cb1181b713d1357861bf928d9cd3a153c780b922d2484006603304ca2
MD5 c2da4ef8ac24348475999aa3424db310
SHA1 a8500d6afcfdac52318444baba8551dc5a31573e
SHA512 a779a1bc837a68be7cc9bf1ee2c62f2999a2417a27813f176c5689eafc2a93fc7236ccab59b11e57469b8f672611f79eb65f12df9c2ee737d67be4fad26f3fe2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan430:A3k03kB56ru
TLSH
T1A9157B13E6850FA5D00F81749A958662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 933KB
SHA256 65840c1f71f5fa63168bbff7df82e6e9a14d581d41831bdc396d17485aa2b350
MD5 ce492e72bcd6f96c9eb27e3e3cdba022
SHA1 702e65ba519fbdf1024f34cb7503f272523e6825
SHA512 502da4e353ddb9f551c295e88711c30d0732ae55fb152016caa18a2382e216481ccf07df4b2f697e1479002344f155a51a7280bde3fbf4045aa56be24762f66d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4mg:A3k03kB56r3
TLSH
T1B4157B13E6850FA5D00F81749A968662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 933KB
SHA256 e1fe24e47d460b762d04e27d725a437e9a7c528850c9d5c79c80dc11609d76ef
MD5 bab898b2db8c072b5b5f0dd5de566f9f
SHA1 27b1de3186e8d5e36ef333aa609f38e47f890114
SHA512 82455f4a766e68324aeaf02c20f5f9c1a39a4984f014ecc3a34bed223dc81ea77109f787e5538381a7c28764011deeb27037b3d0e8272a06182033e22c7f1859
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4vr:A3k03kB56rR
TLSH
T1B4157B03E6850FA5D00FC1749A964662EA777C465F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 933KB
SHA256 ab1d16461758ec666d947de0b426b3bd13fb7f679e404d0f7570cf7416ba179b
MD5 883f6468add3b024333570505450cba5
SHA1 06dce1849eb6acc78f737f9a4afca13a32ad7035
SHA512 72fd015217e9eda46db940b6bfe449e326d761d0867f53703054700ba69f1463a41d722b94706da0671a23e72ff0ef06f95912b94d3b70336a98e1cd21510034
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan45n:A3k03kB56rb
TLSH
T171157B13E6850FA5D00F81749A968662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 933KB
SHA256 8d4aaa56ee02db9f94e94438c625b87211e411aabd5953e27a9cbbfbc97eb331
MD5 835ac150de609d71397db8d60915a69e
SHA1 88df8891fd020140c193905b1180725f4dd03d62
SHA512 366be9e6c9d0764fdbf1712cdd0f4ca985df7a52187aeee6fdeff2a0aa1e1e818d4dd38ab4018b2db863e8a944dcc4f10b9e351511921f6f460017ccf7758d6b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4Vx:A3k03kB56rJ
TLSH
T172157B13E6850FA5D00F81749A968662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 933KB
SHA256 8aeb0fec6d2783cf34f20c2c944460cc49917cabd5660efba21a0f1af8a3993a
MD5 1123c1cd097a5a32d5fa4db752db16ec
SHA1 8f7abe1a10a982aaf515348b0bf5a151f0df6e42
SHA512 bd5de0e43a3594cdc10f0e35b819769172ef42e07c6dedc5e65ad32f2819978ca93deb43f58067735279ba4d754432cc1ce4a8855d59a29f8ef1328df31b26ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4LA:A3k03kB56rW
TLSH
T105157B13E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 933KB
SHA256 f9f4e2dabcf237a950239bf0e800015450fadf88ba765a880d6d70f24685974b
MD5 2ec6c2942b0483e0297c998606b0ae3d
SHA1 c8ccf987b55ecad8e1af5ed54a239c7f486c9c4d
SHA512 7e2e6b6ee8c86da4ade3f05a18b20a90cef763dfa64a58f33b96a92161d449251d4b042861da9c3e14e6a84a02b030e5acc5f0e362d973aea8413d87309fd505
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4c9Q:A3k03kB56rL
TLSH
T187157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 933KB
SHA256 c50c4007e6eb4507bf498bad3cec5eed0033d70f099f24f13dfa1cd3cdef898b
MD5 771d704d6323dda3acd1fa7c90a3bd4b
SHA1 d2001bd056dd7c41b563f9fa174dba396a44a435
SHA512 c11d756d46c1c5c52e0eda7aa99063fc09a7e0f1b8b6e140df8186f552cd4eacae1ff5750b0bb3ff5573d52569da5d2bb5111d187e067b1e9a442b263ff79db4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4F4:A3k03kB56rc
TLSH
T117157B13E6850FA5D00F81749A968662EA777C065F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 933KB
SHA256 e3ab5f0256181a30cba323ee522adaf4b2d73c1af8672718279167df5f13db5a
MD5 54b6aa82fde703f643eaa8243addb324
SHA1 af814e826481b50b95d11b2275833944c47c7a83
SHA512 05373a79a08f40a9b12c11cb85106089f63a2a8879d1c6a7f3c945e42f5eb7aa812692e2aa067e9eb770a9f6f6ec76ad1d158b84eb3ac93a5f1edd891cb5a3de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4Qu:A3k03kB56rd
TLSH
T139157B13E6850FA5D00F81749A958662EA777C425F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 933KB
SHA256 09d120b5d46e2980a155e39cf47538b2c96a6d6cca9fd8961b91f4fdf6db5414
MD5 b5c33faf8f7bf7648495a6068aa19fa9
SHA1 6b6765a05bbf212d46784389a7acb7e2a64a5a5f
SHA512 d3c981563aab7e9cee552dc1de8ed09cf9d8ad64ec5890e118bf02424025db19936af3cbca20e7db86b05906ca0a9eabae966f543d3329ad09ceb1e55eb786ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4Rj:A3k03kB56rf
TLSH
T165157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 933KB
SHA256 9eb41219392544a67cf0298b8392de239f4dbeb84e14ce76ad6260ce534bc65b
MD5 84599be933619e55a5072b34f84eed76
SHA1 944c7699594eb6b3b433d4df01069b2fc1797668
SHA512 7e99965ca0974a6ed96c7cd7f336dc11b6ec62ad8328ce5c468c80927d1aff1479c8edbe32331dc438fba5089ca57e4fca5188bf74d46345ece0c0dea628796c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan44g:A3k03kB56rX
TLSH
T1AB157B13E6850FA5D00F81749A964662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 933KB
SHA256 3f17b40da80090060e000186378035502c1208c048ead8ec912c04e909af954b
MD5 ffd57ca712ad583ac4b4fd73c9b9d089
SHA1 01749fb274152eb2cf89936ffc87f7d0427275ff
SHA512 ee633ad674b30d0c982aded175c3a8d35b808bc91207c3ccd9d1d99314d95d0c93958ab52ff10cb5318f611ede943813c48b5c14674bb8641b754b0ee18671fb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4XI:A3k03kB56rW
TLSH
T1D1157B13E6850FA5D00FC1749A968662EA777C065F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 933KB
SHA256 b64f91f719efaac190b00294d41f9a87c21582a65e8e5230bf76eb3e288d0e11
MD5 bbcd37fdeb50c5e1539dbf89446a4114
SHA1 0a08c888b4f495f5ad3fc99406318b1c89ecf1f4
SHA512 cf3fce4a9c49e53fa044b724cc4dcbb91e91438f2df440cf365c66e6cf2d0e0ee07f86cebc5227bb4709a8ef32588ce441f37bf6dcba0be5071e9870b9ab3d2f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4do:A3k03kB56rk
TLSH
T137157B13E6850FA5D00FC1749A958662EA777C065F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 933KB
SHA256 c68aaa0af1a92fe7a7e268feb09109fe873e06e80593ab2918e0c1f5de1d929e
MD5 0402d4ded50c3b8265fdd27de1dfc862
SHA1 919a314d9b10ba4f09911dff795da07366f4875c
SHA512 e6463589e37e2d4f6c8f91b38291e6931151ff9250b6f55b1a5ebdefd2ff02a321846055dcfe6ceffad803dadcafa4bb9a793c07f0bb6b00662cb549ca6bad6a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4O+:A3k03kB56r5
TLSH
T107157B13E6850FA5D00F81749A958662EA777C065F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 933KB
SHA256 9c429709daaf669c017df8f3843fbe1defb734c3fc5a8715c4ac1679e1a67615
MD5 a9b393c7f569bf3d82633efe874c7de6
SHA1 bb6df585d76810a0a09691e5af6c810b409b5012
SHA512 12224ad02244b84381ced368d31f49c1bdab87a4990fe1b2088de2d27c772f07c7b57e7ef442c63521113133a2773c18951cd520623a2d025788e4f162d0d0db
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4OQ:A3k03kB56rJ
TLSH
T1F9157B03E6850FA5D00FC1749A958662EA777C025F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 933KB
SHA256 2f2ff1d2efeb8ce27d1270367442bc7984a91563bc6828a873a11dc6e5f93761
MD5 83398a125abe497203335f759aa71a78
SHA1 5d7bf473a3c5a7c5c988bdefa9d687e4043a3e88
SHA512 f641325f904677fb00b85870a5c7f1044a2fc88c64c67c65b8ecd04e36f90446a0cefb7abea09c02a399cd9d4a6c0f3fddaff43d5e73b8c8ff6b05112bf0d3ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4vX:A3k03kB56rV
TLSH
T15C157B13E6850FA5D00FC1749A958662EA777C425F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 933KB
SHA256 bc2d0ebc908089a97d6c527c15f2c9a194a6ef110b28567fa80ba97744db42ae
MD5 482aa613c1ea893a29ce01eb0154141a
SHA1 24bd20abe4144f65d246af2ecb0961ec65d83b61
SHA512 15557f1bea1c7fb2eb55f2874a03d14d687aed90fa0ff1d18507248b3214ef68df6afdf6f776af338e13498029b196814b4b7fe1412eaaed520e743f6709da75
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4lL:A3k03kB56rH
TLSH
T18A157B03E6850FA5D00F81749A964662EA777C465F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 933KB
SHA256 3684cf45f5cdb69123f52964c27f9b2829175a77a05d8cedd1a8babc1dc9ef82
MD5 892e92e838b96dcbeb0b2a7e11e5f122
SHA1 fbd6fce7e00ee2949c186abd9ee4dd5272c5e6c9
SHA512 b05e8fb0eb0f4b683996bab275f82f17540892a4fdc946779491ad44b6813acc097ef2069c5aae4cf5cc32beb59e908fbb52c50ccd39efa9df963e53749c8fbd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4DM:A3k03kB56rC
TLSH
T1AD157B13E6850FA5D00F81749A964662EA777C065F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 933KB
SHA256 3b1bdd60b228f6e888a8386b1e12d324403d24cd65db5e24a935c47a8133897c
MD5 0ff66b17a806276a3b9d2ea0f6555d5c
SHA1 7aff365ce725b65e7cf1e8c330695186f5109437
SHA512 fd2519c27a81cbbf64db205449b4a11fc46f79ffb079fe32d980516443b1b1b9927ef6ee7a94060dcd1257c518964fcf276e4428d9b3c7080fad764993fd981f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryan4Eh:A3k03kB56r8
TLSH
T1F5157B13E6850FA5D00FC1749A964662EA777C065F2093DF2358AE153F72BC06B3E29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4420-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5076-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5076-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads