cf99d462da84d872287dc2fa8fade2ee48d1a5437a6b251c53fe363b5bab5c8c

Analysis

max time kernel
90s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 811KB
Sample260712-lfzynshw2x
SHA256 cf99d462da84d872287dc2fa8fade2ee48d1a5437a6b251c53fe363b5bab5c8c
MD5 51cef20e8ea479f7e3082d2ae85c3a83
SHA1 246717706be8fe440f47f353d0f5fb2dd9b521a3
SHA512 2d4cde2a738471fc045ea0794d079e0165d2c26c56796b377d84e883436c3fd5362382172bd73141196c6b5fea3b74e99c0c2a5d94b5abe37cc9655559dbbddb
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdp:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdp
TLSH
T1A5057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c618-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4884-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5536-240-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-422.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1194.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1309.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c618-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-422.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-599.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1194.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1309.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1347.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5536	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4884	2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
5536	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_51cef20e8ea479f7e3082d2ae85c3a83_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4884

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 811KB
SHA256 cf99d462da84d872287dc2fa8fade2ee48d1a5437a6b251c53fe363b5bab5c8c
MD5 51cef20e8ea479f7e3082d2ae85c3a83
SHA1 246717706be8fe440f47f353d0f5fb2dd9b521a3
SHA512 2d4cde2a738471fc045ea0794d079e0165d2c26c56796b377d84e883436c3fd5362382172bd73141196c6b5fea3b74e99c0c2a5d94b5abe37cc9655559dbbddb
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdp:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdp
TLSH
T1A5057B17A6940FE9D11F817499924662E7737C125F2083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 ae981101238349570e70582ccc79c5264f3bbb4a35e1e564beb5de7cab19c3f6
MD5 72b8dc2ce403ad03dec51c80b75f653c
SHA1 49e2c1f6180080141b6d671e7898dad1806d545e
SHA512 beff803d9436f87daa350a5ed1ab9c9d0251f619d73b2701a032093f6213c00727ade984c9ae50241fb072149a7e8ffe43dc212c11e8f7f9d53eb6bfccdd6d72
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxwdV0Le5ji0hmxNrM:A3kMP56rPPji0Aj
TLSH
T1D4555A16F6A44BA5D02BC078C5D2969AEA733C425F3087CB13549E283F277D19A3A773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 826KB
SHA256 f199ad23c8ef4e81faad13782f1f71118ec23faaa6658dae545284f570c187ec
MD5 28403bfe9b366f7cc32b79daeb85a0ee
SHA1 be94935faa0912126681994ae1dbc527361488d7
SHA512 da79dc23e3fa347824c12c2ebefc2c94bd0d2fda2aa5a38458d6ec897e5615d8757a0b2dd064dd57ae3534b5cc6f016cabcde15e94195948c9053701cce48741
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd3a:A3kMP56r
TLSH
T1D1057B07A6940FE9D11F817499924662EB737C125F2087DF2364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 835KB
SHA256 267513af007baec342dca78c043512cd8998b57bfa12a53064a88aa7f4dc4dec
MD5 3b7410c8afd4ff8101ddfcde03e1dbf8
SHA1 e80bd7ef5471b466f7ebbb6f22a4206b34d47b98
SHA512 e71d039bd7bde51e91746808eb202ba76afdce236f04b3dd61064e511478385630b7226980fe63dc0399081cddba81615e3724de3c0515686372b47db247a5dd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd26:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd26
TLSH
T1F9057B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 835KB
SHA256 da189cee92c77d9b20ec87b0307e177fd0cd4f69e298dadb0ccb2be0ce45e4b0
MD5 d16d7492558570c65cbc0fad1ff7801d
SHA1 2967b58bb03651e3b26714fc40520b872a0297fc
SHA512 aca0640acd08451b9c6b52208d0026e8b338ab6462968519d1b301638a33e9c79c4c2d4344065c071e9951bb288a1533a6068542b26ac0a793da0f4d07683bf1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdmN:A3mnXoZjzyacNVOE/jeD5TvinrmxwdmN
TLSH
T18E057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 835KB
SHA256 b593dbc1d7705e390cc2dac94de8ca1cab48fd55c9bfe3c1b1bf427deb911b25
MD5 3a4d2a9e181a85a2eeac23849c1b5004
SHA1 d3f16d3570a68d926db1bbc2cc9ae02ddb81de96
SHA512 51ce1f19fa42c853ddb8212cf19ba48069dd3aff9f716838797dfabd86a3ab5b6bb7526a8d19f06f55f95a7c22d654b0f85e57203bd13be8fe64eb076ef6d48d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdkf:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdkf
TLSH
T131057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 973KB
SHA256 0d93ef8f34f7408dc079fdb33cddd62a44619e4711b8adcbf21fbd92affc9c8d
MD5 14e4a0fdd8971591a42cb5644840ab70
SHA1 4119a02bad9e90ed8612687ba7509094711c583c
SHA512 36ab88dd163afc5ffbb10e932a38b10d16ec1f0d68cedf78f5b8df9b093bb6c67930c87a4af11731ae388b6244c3843e7c0ce132939b820e0aa09631dfce5b53
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxwdPzy7:A3kMP56rhs
TLSH
T14E257B07A6941FE9D11F813499924A62E7737C225F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 835KB
SHA256 3e5267f6818137db2252aae5cbabd78a3bde6c680ce4b420824bb96df5ee4840
MD5 491055d5a35c90e75412130ae3566a18
SHA1 2d44d48a29c052d734c7169ee50378ec73895885
SHA512 a3bdaa91665a58b60d9d80fb4f2e7ef15a3df3b3120cd9cc26acc01d8cf14aa332e7a3e0c959daaf2f2bb60a9bb25a38ef1305d75deeebc123d322c68d4ec76f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdOo:A3mnXoZjzyacNVOE/jeD5TvinrmxwdOo
TLSH
T145057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 835KB
SHA256 8d5e47a016cc2ed710be5a40ab0c94e1b41e26dfb7b7e39433c417b9ac6ff892
MD5 dbe104a51339d2839bd12070c69f3813
SHA1 1629161121f2f620c3a27b8f9fe391e4857a9330
SHA512 2019b886499b4787c97c1b123890455fd970431115f68240d866d64d2e80739dcbb178f28d776d325eca4973f3d8b32e80019ba86b11ee0ff9fbec535138d4ec
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdiu:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdiu
TLSH
T18B057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 973KB
SHA256 f3fd3b0a62af1288841ece28f396e305c1f01ccefc2c00444d69c3c00b087b64
MD5 e06a730dea9be7df79fc5c7897687d2d
SHA1 c7dba9977c15527254451dc79995ab57db9c2158
SHA512 260dd35952a964cad9f7a6acd0b33125fab4801ccab2d6da9b4624b57beafe8daf1beca16b77cc32b6d87b3898557d781ec42c0dbe90aa5bbbfcf795135e7625
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmxwdCzy8:A3kMP56rwT
TLSH
T1A7257B07A6941FE9D11F813499920A62E7737C225F2087DF1364AE253F327D06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 835KB
SHA256 261b1927bbe0952c6a91b55765ba55dd0c090287a5c2b653fa6175981f4ad75e
MD5 9e469c0d45b08d1b1366dc1d5e8aaa2e
SHA1 d7a1656b94404b05023d9496f8a98fd5e5972bf0
SHA512 3ee43cd445826fb414e035c1708fbe0d4edf043a61450419ddcb0c42018d3bc7b0a97fbebfd06518644b8ceb51fae8a9bc9d99874a111b04ab593bd21b300ead
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd29:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd29
TLSH
T154057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 835KB
SHA256 f6fef40f6e96b1bd8a83dae9782808831a5d83381c142be7c44070d361005217
MD5 7eeb07b06775b2f9e70cb8e17f4855da
SHA1 174d8c2d0cd5dc2007e716b96387cd7db99ee3c5
SHA512 84522a4a2863f16ccce8128c08208d2a384fd7073eebb26de2a095f5d97bb625bfe0357a3f10e122ef0838837474d136abdc3ccdfec151e4df8f7ed0ebdd846f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd2c:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd2c
TLSH
T136057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 835KB
SHA256 41608cdd084c79481cd89d141f89683ddc157f61c871bf1fb42f0cb11a395b18
MD5 120752a222c36d3251f51ea842e2acb2
SHA1 0dd2a4a5f25c2788f090a363c3ef90d365743a66
SHA512 cf3e9a358852e58fa2c70f959994c6d12929dabe2e1ee65492615978dfa8e0890186a01689c07977641f189a7aeb16c3d34c7f31ecbd68727b5a6cd856b8a6f9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdvp:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdvp
TLSH
T13C057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 835KB
SHA256 6628de8540d789fc33babc3ced5ead8471a4a09c077f377309196e6308978148
MD5 8e29caf262c09be566355231b0927802
SHA1 e7b76573d8b82df81d4c1068ed1251832ffa52d0
SHA512 35fb6eb28e7f95d2f648d3c816703aa8020824f0b3ea0e11627c24350c1cadf4d0a4f5997dfda240b3665a6db25c46c805b6fad86d050e710a3102dcfd14d704
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdQ0a:A3mnXoZjzyacNVOE/jeD5TvinrmxwdQN
TLSH
T150057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 835KB
SHA256 b6cc3c2b071d5670239f5c234f3994137bba0b49a8ac3b27e3b85d19108a32b0
MD5 a849b21a34da1dfbe9b13abdeac1fefa
SHA1 ad8d268b1ddd35339ee9cadb1798d8bfc32b3139
SHA512 af4e78406fa52b36f6f10b166eaf0b114fbea85d16c28d13174e30ebf9fae398263e0ed0929888a9e2c2b28287504cfe2f73ff53f2d610834061031ad59438e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdYF:A3mnXoZjzyacNVOE/jeD5TvinrmxwdYF
TLSH
T1EC057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 835KB
SHA256 85ef222bebeac6a1c3b84c31ddc33852a9ae417bba4565477333d7761f55939a
MD5 79c8a67deb97b038855dd06a34cc2774
SHA1 09549ccdf69794c7ba4b21cbb49257ab53c0f6e1
SHA512 69d5bf1cf11949c4ca6c5ab9de6a43a2307d8826e5a21ba3ca63efb147bc284f75fb32fed2b44672b64aa5fcba96a679f966d718559297bb426096f86ae8aa68
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdNC:A3mnXoZjzyacNVOE/jeD5TvinrmxwdNC
TLSH
T1B8057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 835KB
SHA256 5d046675fab817ba0bdfed4c4d79ccb3b7ead15374ace2f8e31c8f74cdf64b6f
MD5 68bc18e437b36966a055d3d1910b7b6d
SHA1 96f18636e23ece9acf338f2059c0d84ee4ff8574
SHA512 f2031fa64f03e2e636ff7db7ec99cf03f8a26e268ebe28ad18403eaff7949436c4fce31daa107129d1894e89dda53e73a21e52a4f746c1d66485e4fc8065075e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd2w:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd2w
TLSH
T1DE057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 835KB
SHA256 6f6593a9e7c973c0d780c8ac0a85808da1084ccea0563ae4a5da9bdd3f4d1a56
MD5 dc899b8bc717d5311e322e902413fbea
SHA1 a519a4348e4d457822179aac058c272371fd9dae
SHA512 270cc1acf2a0f168b5681d5fea8b43f1554260b440e69220a82da6fae93828ec2bc223d00f4896ef8b3b803b9b5d1d0ccb0a066323d58085fd18fd45492d7ad0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdlT:A3mnXoZjzyacNVOE/jeD5TvinrmxwdlT
TLSH
T1D1057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 835KB
SHA256 5820115fcca4c6a2856f78f6d49b0ea2cae964a3b30b4c8a80e91b9f48ce51c1
MD5 d2037a4f15d818eb878e3a648953f365
SHA1 7532168318dceb007cc73a3ac7f2a6fcfaf2b2ee
SHA512 467192fddcc9c3e5ae4f4b7d8e97361aab95c41c1679536dd730e1096fdd90a3d8db6da136222757318d6d52878270d280fe90f9b5ac3fcac76e5758042eb4ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd7u:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd7u
TLSH
T11B057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 835KB
SHA256 4084d7ab575ca56007a6efc2b1b9d34eded4cc52ea04b12714f594ee5f914ff6
MD5 e2bb7243da1aa132912f2e5315e23c1d
SHA1 9be38e2ed19848cafc24a16730656e1d5ea25238
SHA512 f252e4b290cdca395604fc15390631c3983b30cca18f7922e7736de587e3a7fd2c0e20f9ed605f50cec5d6e552ee0670e304e748d31a26d67db64387de93f454
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdfb:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdfb
TLSH
T198057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 835KB
SHA256 9a15db65dad17d8d2071e8a50cbf8fdf7d9f4ce5828464137ed92b042526266f
MD5 50bd8d0151777e451af5dd2c1c689a8c
SHA1 a7e4aeace21ac93999233af2f3dd3f7fc0954759
SHA512 636e6c701d7155307782a42bddeca1aba915905ae70cd3f5f0640ba524a43404835765ebc639ceec0d6cee939489a4f238b2682d7a2c1d91913a945517256adf
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdbf:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdbf
TLSH
T111057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 835KB
SHA256 4f1670abd575c6bcffb1c16ac96fc01dc4d19fcbe51b11c48e9918431df30e90
MD5 e94824041d994d8612c8db6e796dfe0e
SHA1 2d835937296f35596fb2c05cadcb642a8643891b
SHA512 1d6d7d9091b3261bb066c2b1c38a1951003064642d2e29f3f01ef92bb09f3a7b817c4c82fefe3c8f586b240897eb8baa8f9649de813ecc453a330442ad5e8bf7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd0K:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd0K
TLSH
T1C0057B07A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 835KB
SHA256 b7e8a8a5db3e23467c91b746ec3609801ec675b49af637ca8fb408a24a7773ae
MD5 74c64088b9cb7e4dc9d9812e50bec662
SHA1 3e4a021aefb51bf2adea18399c87cb587a2149a0
SHA512 9596596cbc18de67233b1646e78ce2d243c867e13c82495ce618f3a3d8561d70887f1ea98a71b386d0f7235ec004d48eb6443186eaabee39118ec016a785af83
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdpk:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdpk
TLSH
T1F8057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 835KB
SHA256 7c848cebf274dc67113b7497240a4c0dfbaadaf5b027743a9aec0ffb6a4c08c5
MD5 3c23439ed962e72146d94124c4e5fc04
SHA1 a535fdefaa9f39a38aed5ab682b95015fe36b2e7
SHA512 aa4e909ca4fd768bcc846c87e93a1a73657106211d24329d5e230954ffec596229c1c62f4ceec19ae7b061d291e803c04909d27648637ac4f96f83c4dca789a4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdG0:A3mnXoZjzyacNVOE/jeD5TvinrmxwdG0
TLSH
T1DB057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 835KB
SHA256 242ad9adca6780ccc7effc0019fb3de84c395da9e3c2b28c89d76c61bb196bea
MD5 9ecd544341669ded76b8e92dd3aa7bae
SHA1 4cc3916a8f661e88f446b4193d21302e2a095ff4
SHA512 1152e865f6aa2d75f9167144b2201dc13d0f70eb007b96b3f767e585e2140b3778fff9adf9b6e491bdcdd1d4f55d986b8d1e93d53bfbc0a87cf0723e3c2ae3b8
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdV70:A3mnXoZjzyacNVOE/jeD5TvinrmxwdVg
TLSH
T1F9057B07A6940FE9D11F817499924662E7737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 835KB
SHA256 aaeeacb1b08802a64778d1370232e4b6a379dadb5b62283d498858a8eb8b9d0e
MD5 c56be0a38a9b0cd7e4bbf91c0bce2a83
SHA1 d0ec7f564cd80b7c046f7fc24f101bb47d7e54e5
SHA512 dec973f87eefe9976faa0ce6ff11fd7869cb52defac5f5d4f9067317ed90bbb0356621508c2f68b6834b787fca7ed35355be316f9988a259a8b0c6882d6cb5dc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdkr:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdkr
TLSH
T1AC057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 835KB
SHA256 4bf8ca6f6f71cd8b0e6723aa1e2784e658d68271b7bab91c39c4d21d237d9af2
MD5 2990d6e0d1bc1a0feb9e18be67adeb33
SHA1 98c0910f8d52d67ff0aab6fe530ca0be8c075a53
SHA512 3a81a1123c528f076948a928c4e6db8402a3d4d94811cb7ea6fee8795314e134c33380d8ebf645ee8bebbae4747e7e9eb279206a06d241fb2e03d8a84dc42afa
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd6n:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd6n
TLSH
T11B057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 835KB
SHA256 fa6767573b94188b913616a941469f7e1a8fdb8759b0db4aad72a9942e92c02c
MD5 802e49816340b03c6a234828205951f9
SHA1 1cd9ebf6aaa1c0525a7efb0b37ebc2a0956150e9
SHA512 6d8ff86b5e9562b94b09e9eb056dc48ef553a059472ce4d80e491d588c28c856ef641323271832a6ad5cc6d83a59ba377c42856dd9281e82640fd8309fa7741d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdQx:A3mnXoZjzyacNVOE/jeD5TvinrmxwdQx
TLSH
T19E057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 835KB
SHA256 60804ebfbb612a8f09c1b466c90efe5e7731e41d1d6401db74249bcc641a2d9c
MD5 73ef8654effae55054c010422af891a5
SHA1 0deecddcb36a8d54424cce562595742ed11b1123
SHA512 0f5bb880f2d496acb7159ae0c16d26488dc4588e8cadb34078f4762d5e1ba76d58a548bf19f6ea71385a6b0ac237b62f581aaf17541ee433c0b466fe0a32178a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdSA:A3mnXoZjzyacNVOE/jeD5TvinrmxwdSA
TLSH
T1FA057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 835KB
SHA256 4f455f97e23ca1fcb1bd02a4c945c57a943150a2af821a398bd8f51d7fb8d39a
MD5 8e4d4851b180a2c208edcd1625cc739f
SHA1 fe127db4f75c2916d17e72c805fc9113e9cbc161
SHA512 79a9431b5677a86f8ea18aefbb8d9af2ddb88d6356b25a5c9c7b240b61d2612d109e25e138244f88b79e38b1d0612f4bc67219fb33d424b42c6cc349a230d1de
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdr9Q:A3kMP56r0
TLSH
T10B057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 835KB
SHA256 fdf4300a8fe112f4aebb46bf6644d5d70933e21318c313251b5ba9723df070d7
MD5 799cf9411b52e047ff9b0e591014bf41
SHA1 a14214cd086f4de95afbb1f75403a80865c17ce8
SHA512 1cdc1a3bdaca25d0f4f3307eed4bf8dc9348294503bec1b3489ec5951a1594a25ece11c6c946a8fe62bd43b0684cc88b2b1be35e81b76e7f6a936fb9c6edbcd4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwda4:A3mnXoZjzyacNVOE/jeD5Tvinrmxwda4
TLSH
T173057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 835KB
SHA256 4fc515d48aa864f17b08e0174daeeec88c3f68d2e7d66cdeafb117eeb2a181be
MD5 bd4d7b57df112c183691c919d8bf2fc9
SHA1 f531a047c83e1f8ce8aa9316c599ed35caa0c7c2
SHA512 68b082873ad578efa38cb3416e79b9b5599a6bf665d810a19f66e96321ee2de9a625d6924e45e622daf323ce9de72a0e9f3c6e4ee773706a9a5c4bbff50c45d7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdBu:A3mnXoZjzyacNVOE/jeD5TvinrmxwdBu
TLSH
T1CC057B07A6940FE9D11F817499924662E7737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 835KB
SHA256 086580be993ce20aacd8ed143247c84703b4dffcfb60b18ae820f12c70604da1
MD5 18c7d55184507192865b400d2555881d
SHA1 dfa7151a1466615fce142ff01dd24ea161674a5c
SHA512 e1d1ca303d8b342fd7ee7f8c5c05e91911f64a718d454a83fa8e3368a26a24fb6df35c9db31a7a5902ea4c36f5e45e47e464693c79deba802549d1ee1323faa4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd0j:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd0j
TLSH
T166057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 835KB
SHA256 1e45db0dc1b43f9a41086e103320cf4d5c45f8425bd1a3a4a99abc075c25679a
MD5 1aba51bb98eda62064221c226b625b20
SHA1 4890ad6c97311344a1dad03da344e3f32d368b1b
SHA512 7ab7d1a198da9828625b629e6689da88e539af60506d97e821e2a8ce23fd2e9b6202e20af17b6d1d3ce50b1744fcb2ccf2bb8fcebfc91746fa87ec2a40a878a3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd1g:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd1g
TLSH
T19B057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 835KB
SHA256 030e93a086c1f34087ea350b17e6db8b8c4e641fa8ab0c8269f0e3af036d72ce
MD5 56e5601541f3297d6c0826c15e4886e1
SHA1 99928ac7db9d1b966d020a04146201352aa6b871
SHA512 cd4974e5530f8c5414afb4c962f699600d55e4d7a3869f97c238802bf04eb26d3a587e962b8ad3c19b392470b177a40588ed73e35944a4a852a9f1c1b0f86624
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd0I:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd0I
TLSH
T110057B07A6940FE9D11F817499924662E7737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 835KB
SHA256 64ada3e63dc25e113e01258a0cea2e9f24cd623592881f1e0f2119c3761601bd
MD5 c0a7a0874b76734a9ab56e4888e8cbfe
SHA1 4cfec1131e78a63eb9fd67835ffc9300779ca0bd
SHA512 9fddc9e4bf162c2fd047e29de032c96067bce80d3b5cda53c74b38f9564173f8ace49cfcc848e3d77b96e300b0380d49314bf42fe15daec722d27997fc89c4eb
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdmo:A3mnXoZjzyacNVOE/jeD5Tvinrmxwdmo
TLSH
T1BA057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 835KB
SHA256 aaf382e57034113c0f956a8dcb20265c86bbd93a0ff3ac14867c04bf76f321c0
MD5 ffb338ff98bfbafb3ac57d0e94fe95fd
SHA1 7a18e1c6b41147b4f9c8684e069843afd020ccb3
SHA512 382c820a8c9d1aad9083cd45f4b68a4108224fcc29022f9ca59de076962024508bfd0b9bbe4b6ba2ab9beb8ac4a245ecd93cd6239c5f2e1acdd1e3c0ba628b16
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdN+:A3mnXoZjzyacNVOE/jeD5TvinrmxwdN+
TLSH
T18F057B07A6940FE9D11F817499924662E7737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 835KB
SHA256 ac112be9b6c1a8d1b975ce8f31aa33ca5aa5c30aad3b4616a3c71dc755b87450
MD5 7ff13108ebaaf485f02a143bdba47111
SHA1 c2daa594202e4b8dfd0bbbb68f1a873c59d43acd
SHA512 023ea63223df53f1ab31b92bb1cff29cfba15e605e43a0719c0cf764dd066218dda7db522e7f645a35fc130029e3a870b803a308308154005caa40d8715472a1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwd7Q:A3mnXoZjzyacNVOE/jeD5Tvinrmxwd7Q
TLSH
T1AA057B07A6940FE9D11F817499924662E7737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 835KB
SHA256 dea2aa97cd9ad255b2f2896b4b58b266f66dcca6654f758e63e4d08e25c3b22f
MD5 1139dfc97586fe8698eb7be114f46ac0
SHA1 8f1952533a15908ce6c8a586deef779c05d23560
SHA512 a7386870bc88770bd0379d8ba7f60572ac3cc39e517bff111c22e879ce0466bb2ad0994e94ab326fb565c6a3b3ea6fe21d9b51461a2279b64e73b02cc7f06611
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdwX:A3mnXoZjzyacNVOE/jeD5TvinrmxwdwX
TLSH
T14E057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 835KB
SHA256 c89cd461c63b1bdb0faac12a4509163c8359060becd19b8ed67c48bfcf638c6f
MD5 d00581e1fa852b8eafa4a8005c2dd357
SHA1 ccc359b038d83ac3158b139a6a0292b86a630b63
SHA512 fda76489a03c2c145e27f1a3bb88ac1dd74f4c8ad468f92d9a05dabdef4d496f14eb3a88e7103c6ab05ae84e9f00d38126c4cc5b96c8b552ea2eaa5b366a252e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdGL:A3mnXoZjzyacNVOE/jeD5TvinrmxwdGL
TLSH
T11B057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 835KB
SHA256 8d3328ce6ec93f4df8ea57bf9cc36f85f325ad6b9c26fce6d8b0374e05d6a4f3
MD5 95c5dbc54e821188e4581e22b6cf1df2
SHA1 abcf5d609f5c3d24f547956a6305e41a6280ecb5
SHA512 62d650a342f3c978f0010d4cc955e7e5ff3d6093041f5437b0aedbc9805f3c79d9fe6ac3f30c7d3790456c3f796d49b193738a5dc1af8d74dcc2158a148d93bc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdaFC:A3mnXoZjzyacNVOE/jeD5TvinrmxwdaM
TLSH
T198057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 835KB
SHA256 4dd1493a3a2632bc5a64f66abd35883137bed95c8339ccbf0a529963860dd6b7
MD5 8f3f94c10451731ac95c2cc0f2d039a6
SHA1 af7896272ea89ef7871adfe7bc89237dbff79078
SHA512 9affd861fa28b7ab7d46e7ec36a8cd21e82eb20fd3ada752d5c0098f720c989d7bd2ff274997d1082c74c1786435c8d7c6c124b0ffbfb294b61dae6b26272b3e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmxwdLh:A3mnXoZjzyacNVOE/jeD5TvinrmxwdLh
TLSH
T1DD057B07A6940FE9D11F817499924662EB737C125F6083DF2358AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4884-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4884-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5536-240-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads