7386578ea48b65147a88dc6a1686ff7112c6e425e3b5c2a9813a698ef595cd6e

Analysis

max time kernel
93s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 934KB
Sample260717-ts8eksa13t
SHA256 7386578ea48b65147a88dc6a1686ff7112c6e425e3b5c2a9813a698ef595cd6e
MD5 fce760ffc1693ad5264ad46155a71d86
SHA1 20f4ca248a55297fa693f97e63da626189226bcb
SHA512 15844acf371fb830bd1743b08259ca2733b2ce21d47b64f8712992c669733e47597404fdebcce993f3f6602fddc905b46642beddaeae39f2d6d3c12de6feafa6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZf:t/sCv7rTiw2RYwZCUsjKplpGZf
TLSH
T1BD153A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1264-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001200000001c544-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1264-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3324-203-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1089.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001200000001c544-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-495.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-978.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1089.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3324	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1264	2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
3324	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_fce760ffc1693ad5264ad46155a71d86_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1264

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 934KB
SHA256 7386578ea48b65147a88dc6a1686ff7112c6e425e3b5c2a9813a698ef595cd6e
MD5 fce760ffc1693ad5264ad46155a71d86
SHA1 20f4ca248a55297fa693f97e63da626189226bcb
SHA512 15844acf371fb830bd1743b08259ca2733b2ce21d47b64f8712992c669733e47597404fdebcce993f3f6602fddc905b46642beddaeae39f2d6d3c12de6feafa6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZf:t/sCv7rTiw2RYwZCUsjKplpGZf
TLSH
T1BD153A1766EC4895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 a30f99c26db3f334a299ac21c6b71bbdaae25812d6823cffbc90299044bd393f
MD5 fdbaba67ac4ac93c03c2517cb22a99a5
SHA1 5feba166d49089957845824ec84b9432a4f1f50d
SHA512 2e93f52fe2c01e14ba560497784904d9353dbc494d22de1196c390610b73067569e76fc28dec9e796e2e25a3a66302aebe33d9d3a821f8fb7d01f9f1d64bd5b5
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGZL0Le5ji0hmxNrM:x7iw2ePji0Aj
TLSH
T1F6654A17B6A84661E073D174C5E6864AEA72B4461B3087CF1268C73C2F63BF1AE39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 949KB
SHA256 eade7f77a0add4c12b1cb929b9c84e28322baae0f733ea5510156aacb4809e3b
MD5 e3034f482fb47b65156a1c712d7477e3
SHA1 9c533780e512e2f9931e2a620bfb4be60b5e98c1
SHA512 f698e0226f3aec31714c97f76f052e47009474b2d1a44ba438c9989296fefd3832ca508a22072cfd35af91a15bbde7fc7b5aec7a9f70bad0bc11c31b8db818ab
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZNa:t/sCv7rTiw2RYwZCUsjKplpGZNa
TLSH
T11D253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 958KB
SHA256 764795bf08fef2494274bb6ca032da1619691b448f6009e18f6906cf8f5cac69
MD5 18018d8b9fa9703e9b7ed43cc66340d5
SHA1 4cf48d5913edefefc9faf0f4b6ea47e89ff53f80
SHA512 ff595c2751a7f02431b3da323e51e9c2b69c592222c0bf2d0c473a19eed2dd0011d80465d13a69e5362b81f9c618b148ca56dfc59d10e8e6c9eb24012369ea3a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZE6:t/sCv7rTiw2RYwZCUsjKplpGZE6
TLSH
T1EF253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 958KB
SHA256 c82a004ac270fb1b0f36790bfb43f4664fd4e20fbedd8aeb2079d08c2200287e
MD5 d27007e17f2bce63960667b934653ced
SHA1 ca1d49febce463d159a1564faa35791470e0d611
SHA512 cc7d32e76c2283fa1120cc4599078ae4da8392803d5331a877ac7215b1df57af6f80953b7ea92484cbbb317c01715b5c8b9f2c9de29379c5c4b297cd8af7fb3c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZgN:t/sCv7rTiw2RYwZCUsjKplpGZgN
TLSH
T172253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 958KB
SHA256 b438524fc1421791ed1d9b8608aa58fa9fce9ece3c7424c0f0d0a1e1a211c99e
MD5 9cc70716c1380835d52229a26d86b416
SHA1 5bc6922d229995d0df17c19895e802b671e59187
SHA512 2c939c93c95610ae8764e31af40f1a0f14a54e5c09ae41274d591283b2e97497d90a0f98254de3b7e4eafbc616c3d0007a1c746e2f7e40eaf7864e55896809f8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZOf:t/sCv7rTiw2RYwZCUsjKplpGZOf
TLSH
T1C6253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 958KB
SHA256 e715c6a6f4c4466f4ec10345e2a4e684af0848801e6df4558caaf1fd5781e2df
MD5 5e73a47c48d799d650538e35c10d3336
SHA1 0949a9ab583f485e01a909489078a728e4e4b457
SHA512 bc72ea95266f84be4cb3416b947179a734b5cc4be56fdfe463c79e1f8fa752dfa775a38ea9d29c6bf8f35868a8f9deca84668e16b01f2d4198a7fd7c82858d1a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZ4o:t/sCv7rTiw2RYwZCUsjKplpGZ4o
TLSH
T122253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 958KB
SHA256 d2c3fadaac531c5ec76a6da38092aa13cdee457aaf876a1b23ce13d299149453
MD5 ea996485af1b011fb79741b2111cb2c6
SHA1 9ac1d91bef5d34d0d2f6b1078afe4c27af5d871d
SHA512 79a25198e91902f77946a72abcbde555185c90fd7ff7cb0150a0b3871f95e54d0391303d10a6e1fc5474c1ddd850aa20113e9ac7676c42473ca1b94629190a4f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZIu:t/sCv7rTiw2RYwZCUsjKplpGZIu
TLSH
T150253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 958KB
SHA256 00f676e4abd7abc1f837cd1d47441511bdf6c4881302d9a278ec6e599a195378
MD5 6ec73b1bb2918f319cf49611eedb56c1
SHA1 13a35a7e9c52df23d5b838119f0b298df5c42ec5
SHA512 9263a35a198b013e80e499aa4eb8f73a3a2edae643c8ca29db0109a0a1c1273acd3d2060569ddb5da0d8f162b0b8a145118612767008afc98b46a4404c113b1e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZc9:t/sCv7rTiw2RYwZCUsjKplpGZc9
TLSH
T1D0253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 958KB
SHA256 e29566336879d0e46cee127edb66bb4bea6507150d5627fb390397b6bf47e830
MD5 f11245671bc136c21e4a6ba3e0443b4a
SHA1 03de41d51d53f100a370b67925212c54cb04f292
SHA512 3f8bd8ffe1038d1cb3993ace6c4dc16e0e33eeb20e41c49cb7820a88597de1ac78c1082d26f7c658ffe976a3e696c95d5926d31760b53686ee40e678f1f7c87d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZEc:t/sCv7rTiw2RYwZCUsjKplpGZEc
TLSH
T164253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 958KB
SHA256 857a3e740c65d1a9ed141faa3b7c7fcd64e9b3c0573a834b2af4fe0d1bad974e
MD5 24c9b6cddb77aeb93a32a678acd22946
SHA1 af62a04dcc6a6b4af79d64884b1f9ca5ade4bdfc
SHA512 ce7d50eb3f146cf2d9d8e99a3d860eeed7a40ca0eb74fb332287a73938e8126a7bf20a0f79594cab326bb3a68e16ec04198594cc8643b92daafded852e7160a9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZdp:t/sCv7rTiw2RYwZCUsjKplpGZdp
TLSH
T113253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 958KB
SHA256 d358a8dccdafe1e97bbd07ce2532d67405a64f540692cff4e3c4e809edd7c219
MD5 3c577cde648a78081594cf1a5075e013
SHA1 ede6101a8ad61117bc80ee37fdbeb8abb975f86a
SHA512 c7afd0ea47964abebc942da4a49e0ad771ab015a7be983d363826d5dd35f3ab636443b08b5ae141dbe680810b841afa4274a34e1d99fba89b69138e251753906
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZi0a:t/sCv7rTiw2RYwZCUsjKplpGZiN
TLSH
T141253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 958KB
SHA256 df75c9dbb75b51a42f7fe01b47dc5ba660458f8aeb6d88487785f6c782963e3a
MD5 f3c661c3815d6bedfe61cbfbff5ced10
SHA1 1536fe5e18410c3eedbd9cf116f0d1811adcd815
SHA512 f676ff10c375eccc02f0449eaea87bffd5058966171b6521003be55cda4fd599742dc0bd420cc979acae55049ec742bba72b6d27b598c71bce8ed366bc3b6e16
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZGF:t/sCv7rTiw2RYwZCUsjKplpGZGF
TLSH
T163253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 958KB
SHA256 43e202cd6abdc1e53fa795c743fff09b3b0e0fb482a2da66a995fb905e6f33a6
MD5 81b1fe709458999a3949f8adb7ad306f
SHA1 116f4c43fb82b4963954a830aef72d8d24e30139
SHA512 2a8ffe7981c88743a77b30d7e627f8e52898e052a1ef38b616ff8eff5dcfd6806bc4d74b170191fc938697399bc3e730beed6cff4ce2a8b900e466c194369313
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZTC:t/sCv7rTiw2RYwZCUsjKplpGZTC
TLSH
T155253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 958KB
SHA256 18adfd07bd8775af59f1f8a5cf4b15b86199672fdb8fd5cbe8ac07d5ada72b33
MD5 73f85983a135be4fad02d745ccedc0fe
SHA1 7059dee452eb52cf6a1184685e22badf0837e5a8
SHA512 29947a07ce7e0f02cd8faf7be3f09a01d5420a8cb913749f51136b676a9c0ca5f538ec97595d894217dfe4dcdbb5aaa4a4a88b531782d149829c6a1e240f304c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZcw:t/sCv7rTiw2RYwZCUsjKplpGZcw
TLSH
T1A5253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 958KB
SHA256 526b415ad29a90585137adc99459d4da695b0150c0ed043c755e88d0f1453501
MD5 e5f5ef0147054002b496f2b76dac876b
SHA1 cd150bbfaf789fa5ca3272188c3a6896414b0626
SHA512 19b4d8ce4df9bfe84496533c8d9b5fdbb7d0577cc0bbb920b4e050bd3daaa27f77babf2ab5e5d3ccffa1e890b46022662e9001d3460fcf5d907e8a9e1ba313ac
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZTT:t/sCv7rTiw2RYwZCUsjKplpGZTT
TLSH
T174253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 958KB
SHA256 a328a762dd56af212ce653d9ce88a25f536daad69779c9c5b21dc718cae680ae
MD5 4dd2c285f076f63b732975bd50d485a9
SHA1 059e63947d5bec77217e1fcc97778453aebd99ca
SHA512 8f8f12251b8c342b547131e9d9bad0325de1cf0eaf2d5ef28c61572494d786553c049f6f8a507a1a728df47fcbd8484537f4e629bc22ad1188954991bdee008e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZlu:t/sCv7rTiw2RYwZCUsjKplpGZlu
TLSH
T133253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 958KB
SHA256 3163062277cdc6dcf2d4ddd185570d79268e8e71657f094e885617a802cd432d
MD5 6bf3a270dc19b2fc17fe16a4d432e30b
SHA1 ed200fe93326790a32a49548a70842169b99e72b
SHA512 2daa0993d2e4a5734a264a6a2b9b18a9bdfa2e45899672f8e89994f584732b18a7ea3d5d49b5df426a5e4a44967096a2947e1d011899e7d053d25f3fbd591d4b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZtb:t/sCv7rTiw2RYwZCUsjKplpGZtb
TLSH
T1E3253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 958KB
SHA256 3636fd872e0429a265780767085e3f9588780e53402eef217b8307a57279e2e4
MD5 757a709e97b05010de3f4f7586a64e12
SHA1 39a4da7e3a9a5c68ca3c33d08758e4bcef0a210d
SHA512 7a9193921fc982d6ad1c8126459f1a5a8c47f1a5dc604c19252fd1399b96080739b2aaae8b74442a023329dd5e3adc816f9913a653ecbba46947163108841538
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZdf:t/sCv7rTiw2RYwZCUsjKplpGZdf
TLSH
T168253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 958KB
SHA256 e546729084719ff0bfe0c2d512c431822409709ed9c38c7823024d297033e0c2
MD5 678debb0275af4aa9f4abef07c327d5f
SHA1 3c5d8643b6695057843684c2c9af861bd0871646
SHA512 219c43a7197e8d4df45a932177446f8fab7fe33f0ef05cef1aeb757cef13071aae1f66a96a5d4cfea9a4af34c5b347e3b23ec27fc761b86a11baa2e968ab7997
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZGK:t/sCv7rTiw2RYwZCUsjKplpGZGK
TLSH
T1D7253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 958KB
SHA256 61d7e59688220e6ad5dfd6e9da049f26b99b93028d1297757d650d9dae105ca2
MD5 b7042aa4baf8364393fa860695c92c88
SHA1 ef8c993a5c2cebf407f1a5f05a64e7642e9dc35e
SHA512 d9ef78fc7dbc69d5e8d3d39c62a288fbf05e826b3a3486028aad3123500ac4fd6363592b605e8d5a92a8c12e16e53beefae2fae65ae5c3e6d3caf5205cbb35e5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZzk:t/sCv7rTiw2RYwZCUsjKplpGZzk
TLSH
T178253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 958KB
SHA256 e515cf5095f471507b94dae82ff4c5b27a54c42a27dd62c350a0c85ec9763f9a
MD5 0c1ceb1eed91897feaedb3f6f92ab40b
SHA1 818c45c50dc3bd40ccfa2b8499b90a2a6b33b745
SHA512 b32ba5679b822e7b6e6940135b33af3248ac4ea3af98070902d8f186db109f7d1005e85e0c0e902e312625e5e4cfaf7223d6b576a18a78f770f445f9e4cbc8b7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZE0:t/sCv7rTiw2RYwZCUsjKplpGZE0
TLSH
T150253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 958KB
SHA256 8ac5af6c3679ac3c7681bb74a8183df3304aea0e7567477876a1e57a663b82d5
MD5 9b7b7b4e5de8da9b677a97905755b566
SHA1 6511b8a41f16eeec52dbc4e4a53e5ea49eaec817
SHA512 0cd288e015440bca8a6698a5e6172ad5ee610134e76545d8c2ee04126232f85f20daaa14e9ec9afb76d080c628d90918929bb86b432e78af5316cb4b9a28a84d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZ/70:t/sCv7rTiw2RYwZCUsjKplpGZ/g
TLSH
T17F253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 958KB
SHA256 bc3a9c0b601aae68b83881fab13ef97d6b445a9e3e6a1f536496333bd217951d
MD5 a50d140a97888588226ffdf5c0373ee2
SHA1 770e6b783420999deae889276bf6a5d1c661f11f
SHA512 3cc0c41fe72768538b51dec72df0ae6dd14e2fd738fed2bb9c4bb6edbbddaf2231777a5cccfc54319c5f6386f5967f16a6071f10721dba332314e4ec66d0dfca
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZSr:t/sCv7rTiw2RYwZCUsjKplpGZSr
TLSH
T1B0253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 958KB
SHA256 abffa6e37836767e9e401ca3fe08dc9db08e15001033bdfc463040c71e5e4d0c
MD5 8a5f062dd185edc1a75dbb648377fca7
SHA1 4c244677a9d261c3f34b2e216bb5e27947a6c882
SHA512 855a237baa6c5eb319feca0545b21a7abda3f9b596f9964283c5acc171e32a5bc79f47cbcbc8826a17e4854136979927e22c83df605347675ccc069148ab58c7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZwn:t/sCv7rTiw2RYwZCUsjKplpGZwn
TLSH
T18A253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 958KB
SHA256 18dafbb0e78a04e2cbda9e12abeddbd1b2ecb38bb37e968d21541d4616730040
MD5 9e0c0e9392bba6a7628d9d6b0a126e95
SHA1 595955ac18873d900622feda655fe61f6c0d9396
SHA512 067cdc9c15600cb7a965627858fc579df09bcb531df6af26bfd93ccdaf4845a3d78f1832d4ca69d495f154cbb3f59bcdc2401eb53667f78ba416619d1b84c7b9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZOx:t/sCv7rTiw2RYwZCUsjKplpGZOx
TLSH
T1E5253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 958KB
SHA256 4ed3e71bf87396c27f44e097fa17613f859f2a60d2dbbb792425b4111825277f
MD5 98b81d2f94cd3672740dc9040a0dfafa
SHA1 17903451be3a79452e8257b9b2b607de3cdca894
SHA512 848409ea66761ac8eadd4cdee41efcf32fdcdab43d0c869a781c71c50e134df2b0fa719d71a6fd4a3c1b13c87baf6664e1765f17358228c228a86aa83a5d734a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZoA:t/sCv7rTiw2RYwZCUsjKplpGZoA
TLSH
T173253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 958KB
SHA256 876c3e079e6b8049b2ca0ad709e3eda608abdfbaab23045a589bd41ad97c0c13
MD5 c19b9106e5306fc3371b6fd9f92c50d3
SHA1 15910ab49e597a8e9bc57008ec818600e203695b
SHA512 7cb7892d2e5aeeb0f676c8ecc60db49d6ceceaa5b1a9a355595c5387521214eb56bfeb0056be2d0fae8bb636f622c23fee019a1c753d72a512b77b259c16cf09
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZB9Q:t/sCv7rTiw2RYwZCUsjKplpGZB9Q
TLSH
T139253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 958KB
SHA256 16b201f877cbb98c700a3ba530f6b565d25452462d606dc9d47686f56166216a
MD5 9ad528c6974e9b9c13d079782625f5cc
SHA1 6409cfab9caa1fa28c2477f57b3f517e839ec34b
SHA512 c586d2e8e449d8a68436ccc75e2acf48d7bbfc624bc91f48297209670a1700324c2a97570fdc66fbc27965b13fdb87e5dd37729370f387310b036e53cf53ed1c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZ04:t/sCv7rTiw2RYwZCUsjKplpGZ04
TLSH
T1F6253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 958KB
SHA256 4c28b4cb89489a75d5f4e787454dafac874b35045c814fffb72421095ace5256
MD5 4b852615695a6816de7f3322d8750aba
SHA1 d338b7e6c2c73d904b75826df7f2a150f48f64a5
SHA512 998b75347f95f89b751980aa6ac6a80a203d976ac939842d6ee61c8892e604cd4e45dcad4672580fb4b62c7649d92ea9ebaf5410fdce07d690f76f5283915395
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZfu:t/sCv7rTiw2RYwZCUsjKplpGZfu
TLSH
T1F6253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 958KB
SHA256 0bc9c8b3e232ee9fc2a54e4569ea93e22358d14a7c74862a4a8109a620fd69d1
MD5 76ba218df1cfee06f28af188e497c77e
SHA1 b57c7609a7958b393c5071da5a98844ba1092520
SHA512 43caeb5ab5a5adadccb494d696a31c6e1dde38ff715f3c0204e84cfb86e7f91d2643794a9f7b15f7e95da892dbba5cb95b485305528e9c0e1fce89c890d60757
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZ6j:t/sCv7rTiw2RYwZCUsjKplpGZ6j
TLSH
T1FF253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 958KB
SHA256 bea8b8b1d1a2122fa4e88e37c2b049b8856ee6b93dd3455b9a11d310629e806b
MD5 52876130a3622587ec3223e444623c09
SHA1 45588982f25b1bddc1eaba6d765386d90d462a62
SHA512 2536a6abaef017e30d493beda0407716505dca7c52c2a68d9c92ca3749db9eb9c35aca6d4996dd1adde5a08a41f21ca85e46247ade7ac5d3836463c04d6bc073
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZng:t/sCv7rTiw2RYwZCUsjKplpGZng
TLSH
T156253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 958KB
SHA256 1d1bb39f72a428dcc8f72aad960edfb10060f98c288459a471186e0442f406e5
MD5 d7dfd20eb1d9806a2ec845ebb439a45f
SHA1 7d935aa2e6c1f94b188dc85f536430a0a589dcc5
SHA512 c9618dcab4a6885f4b23204e07985eb9b01ee166b611a709de62126624ac09ac59058f60f63ffb21fe69359ccd0c34da6711cbabccdd2ea9d12415453cb7c197
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZ6I:t/sCv7rTiw2RYwZCUsjKplpGZ6I
TLSH
T1B1253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 958KB
SHA256 8216942936965d36a14a01a24f02803a3433011dcee5a452ae1da187ca6c8289
MD5 25d713824e92cbee530fbb196f2501ef
SHA1 2169123b2e8c41e824c5b9cf0e30be274ff39731
SHA512 ccf687f7f9d90764c3c9108f95423f4920d8f9917f2cfe402bb06d345df5ea126f426e072fad03ebff904d6a904c39b66744f875850b9cb2e0b9e8da86290094
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZ4o:t/sCv7rTiw2RYwZCUsjKplpGZ4o
TLSH
T11F253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 958KB
SHA256 fc32216c57460e2830360042b54e1f1691893390b5234908d1606244a16d2b6a
MD5 a91bac9f150217fdeb6c31f05a128996
SHA1 163d23932a23c2db1933cdd8a60b6d42f1ca2d35
SHA512 ba554f0692c6b9012919ca3f3d421dd7898230fe8c58035f80b85000801dc280dfcb4779bff8a38d475047e284ba78e72a70a2fa123fec2b3d5a843b63a2ff9b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZL+:t/sCv7rTiw2RYwZCUsjKplpGZL+
TLSH
T13C253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 958KB
SHA256 838c4261ab112ba391be25a5d53d10332f5ade25fa98ae8d02ae1dd441212f1d
MD5 d308d54d5a56f72b5d87c08530af8a73
SHA1 c80d40cf324577d41d10a940d15d90ea5b20a213
SHA512 5b1cc74bb6030f41f1b3b0a4d88bd829e887866192ded3983619949136fba84523662c4dc075b55874b84fc5088c0f8474d057818e284d1b7c2d9945544b073e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZBQ:t/sCv7rTiw2RYwZCUsjKplpGZBQ
TLSH
T1ED253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 958KB
SHA256 7aecb32c1f617e98beec8608eddd2b0b8d18b455d9b53a6d19a3c43d71a9bb5f
MD5 b39efdb41535210361a0efdfe1a65efc
SHA1 1bda3cfd3287d3587dd3ce6f64426ea72c02e26d
SHA512 cb4fdb66f7a1442834e42f1324a6fbdb09bb9e5e3a5fab67cb3f4173ae104a9faea76b862ad378f01ca542fad3a8007fbd1942425885485791a79d85bb882746
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZGX:t/sCv7rTiw2RYwZCUsjKplpGZGX
TLSH
T1C7253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 958KB
SHA256 f99d08f8fa4d8293c04e16040ea8c96dbd7f433d138d8c0459e154cb4c1e4ed2
MD5 969f17f757afa6ce38d9a928b1eea5fe
SHA1 5f965a2333ac85c8ac300251810eb981267f1aab
SHA512 ce104ded1a6b35d855fb65b2c1d445a0ba3c375927b842869eda63e4f125f2bf94a46828753d9cd80079cda946c57fdd29da240c0da3ae1f43e5f7c05c0e0ba0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZAL:t/sCv7rTiw2RYwZCUsjKplpGZAL
TLSH
T1B4253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 958KB
SHA256 6cc0d608139a7e87d22ece7561c3bc8855290dae5226ce172b5b72217c2da230
MD5 e36b538535c519b071915ce4062ca9aa
SHA1 5fd8e70ffa85f27c3986dc42dbfd473652df250e
SHA512 5e7a8ffe41744022d63fe78ac3629777a65a2ae67d69a78bee2aae0dae6f6362cb28923409593d88bc7560029dd6a22fe760c3778a0600f4825fb18eb0b53a7c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZsFC:t/sCv7rTiw2RYwZCUsjKplpGZsM
TLSH
T17F253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 958KB
SHA256 2b0b8f18c01281eec7585de88dc68b7be87bcdc715c73ecd15e9ebb7fb8c424a
MD5 eb5add947f0be70b27794fc7cbb22b1f
SHA1 4596f7df4398d24b4ce2d3571f1d17eeaad64bc8
SHA512 7b0d805a3f5d2e06f9e2a1e09961fcd1634133d9ceaa72759903371f912f9fd39d8bff463c1fe643a4bbf1166d648417ef583bdc7a128ad27ad18dfed8ab1135
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpGZ1h:t/sCv7rTiw2RYwZCUsjKplpGZ1h
TLSH
T173253A1766EC0895E466A13089F54606EB72F8561B31C3CF12788B2D1F63BF07E39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1264-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3324-203-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads