3d40d222531b44564d3dd9e5dd6cb00cfe68b8127689acd9e0cf8ba5e86a0782

Analysis

max time kernel
96s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 931KB
Sample260718-a7ftbsaz6k
SHA256 3d40d222531b44564d3dd9e5dd6cb00cfe68b8127689acd9e0cf8ba5e86a0782
MD5 bc815121302497ac21e49686a8ff0b29
SHA1 872f5eb71e05eca531f497c9082e85e05b532b96
SHA512 c8901da5ca4e17ae371200d2aea4736be2f18fea4d97a64a16259a38d0f549e0e1e839063d99b7cf7c65551e5818dbfa50af304d69ae8a3991f37da21ca1a16e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOb:t/sCv7rTiw2RYwZCUsjKpczb
TLSH
T115153A1766EC0895E467A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4812-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5b7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4812-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2896-222-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1191.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5b7-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-690.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1090.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1191.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2896	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4812	2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
2896	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_bc815121302497ac21e49686a8ff0b29_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4812

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 3d40d222531b44564d3dd9e5dd6cb00cfe68b8127689acd9e0cf8ba5e86a0782
MD5 bc815121302497ac21e49686a8ff0b29
SHA1 872f5eb71e05eca531f497c9082e85e05b532b96
SHA512 c8901da5ca4e17ae371200d2aea4736be2f18fea4d97a64a16259a38d0f549e0e1e839063d99b7cf7c65551e5818dbfa50af304d69ae8a3991f37da21ca1a16e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOb:t/sCv7rTiw2RYwZCUsjKpczb
TLSH
T115153A1766EC0895E467A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e45a54438a9c0bd55300c4a642969f6929d487430dd35f8f61c260ad6d5dd1e6
MD5 11046cf662d1d9ee1333c8fe75b53720
SHA1 94dc5054efd8d41aac4592093def5e0637e20bd5
SHA512 579180020c672c69ccad8ad6ffdc886ffb751e0ada888b2300fd49da5fe1ee91473cfc7094b479db69635b6852b9a2bb192a2f5e1fd4d88b5b022c7d72238191
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKpczH0Le5ji0hmxNrM:x7iw2sPji0Aj
TLSH
T159654A17B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 946KB
SHA256 ed22ed64955fd8462fbc2467871efc0493131928265125ace37407151a05b792
MD5 1c3a7a3679b152ed664b4b41ffb141d3
SHA1 422d437b5371a7963c5d02cbcd439fbdd6d5abc7
SHA512 ca95ea3cf87183a6279f62955ea5dfc5c0cc8f7262d096aa2b0214da2bf3ae1805cc76d4478003ce54a4cb0a9b3c9940b54651786159765cd0dca6e37b31ab5a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOZa:t/sCv7rTiw2RYwZCUsjKpczZa
TLSH
T112253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 77d4e51039e14c7046d3c787aa977a52e8608ffd11313871a09d39ba554d5739
MD5 b95f6a5410a67d25a7e2d9cf4c5258a8
SHA1 9862d701de2c56523bd905f11496025c6a0b7870
SHA512 4569f1ebf998cb028da52578e577d219165f683595bdee574288d982b2ee7874cd0ba172e68a27b097d420e72fe85eb219121615f47f40209fe08667dbc72457
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOQ6:t/sCv7rTiw2RYwZCUsjKpczQ6
TLSH
T1A7253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 955KB
SHA256 b31108300dabf6ae97796b18352d526f54b8cdba933918c90a7848b21261a558
MD5 ea79d3ad2e857d6d25436df3f27bd81a
SHA1 55594d4d948c15a7b58079eaf1748e78a554419e
SHA512 b937b740f7883c80f1bddfe3785ecd68b9077caff7a29adf6c20eab14169b9b9113a7eb89994bad628f1b15901f316cb9e53def018877a5bc3d759ac16713c81
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOUN:t/sCv7rTiw2RYwZCUsjKpczUN
TLSH
T124253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 955KB
SHA256 4543c888a97e24d3cca1fb2923698e704e8079b67eaa2f2fbf91bd4bc2f730ac
MD5 8c485be9bd854ec28af03b979cbf951c
SHA1 43746fe49b1138f2d35750f7babe3faa9953b0b5
SHA512 5ef0e1a957f350fd0bece7ace0cba8d17adffccb653b89bb6b5cd9fdb6a3bb676c9fb9ea839f1dc3ed64de37f3aac33650299ba11114b4ebaef5a1f402ab4fda
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVO6f:t/sCv7rTiw2RYwZCUsjKpcz6f
TLSH
T157253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 9ff1fa751a58db59f2b53ec60e03c2a3245565c7614e4e190f54b72c7baabb5e
MD5 24146e6691d6a5a936c50b9b34df2bc6
SHA1 7f98deaa3a3d32cb3d8215acfb18ce4ce1fb1896
SHA512 50a6321d5316ae5a50b26d5e36573ca59fdedd351f8d702ba27068a1cc7ed211f878b2e5495a62399bc5eac829c66b962374171a68f09215023f1168faad2025
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVO0o:t/sCv7rTiw2RYwZCUsjKpcz0o
TLSH
T1C3253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 3c522240e63d5e76ef26bcf880bee080d7975103682671bde0c02cf0844b9c50
MD5 ced81215fc601bde130e53253212a9d5
SHA1 038bd1a3841f7381d0f65d6eee1db947d19f90d8
SHA512 6948d5c024b25b3774bedb0cf538fc364fcb8a6421f674affee1a6898e99146f52dc148aaf6df7a48b60971d140ddb34fcec79b90c3e7f51f49855ae2f087e88
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOUu:t/sCv7rTiw2RYwZCUsjKpczUu
TLSH
T13B253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 edfa5b2d9ae6e3661c11984baae9e59cd05a0b042c311e62ebfc4bf7ad2d72f2
MD5 7051161a2f7ba89d1d32f681223bcc3b
SHA1 b02659e477ba72176c8544fa698cf944f4edd0a0
SHA512 3e208b5cd6a84f9e43c2c7fd6cc271415a136a82f0c73cb6400a313a4195ca665d543c0e4a67919f97046e43cce86e59333a1673faf9bcfcf488bf7a5733a877
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVO49:t/sCv7rTiw2RYwZCUsjKpcz49
TLSH
T1B6253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 efe4ee5a4648ae2efd4e5ab7308434f4727fa52f563575d5d11779446ef00f7a
MD5 71afc9f86dce04d77f0e3dfad01f4051
SHA1 651c33534e1eecd15f8ddc05a52d9b2d9437ad48
SHA512 5d2d4c2ea2f68a15f1e78d96c138507f5a4e8b2b51340cab87c76f47ae451d75489ef1aa96e73649194bddbdc45ea07d087d7037f3725857bfe70b4a4bc3b32d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOgc:t/sCv7rTiw2RYwZCUsjKpczgc
TLSH
T16B253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 f7fd0052f2054ba709d6ce8504c624752848fefed2cff37d9cb962d4069eb36f
MD5 a70c08ca316c2a21a65342847d289b06
SHA1 dac0bf560c1bdf391eee74510814d84de672bce9
SHA512 596999d97125b17ce9f6ed78d5f598bd3fd57aeec9a2bb2b90ae6b206a9b93cb6fe16cd03c460fd455a3590508a7dc8b7d8cfc101218854e9e9d01aafe865f1b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOJp:t/sCv7rTiw2RYwZCUsjKpczJp
TLSH
T1F3253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 897b3402dd4d008cac79f05c6d7bd202c8f937332512b9bd271514d9266d1777
MD5 0c2861511bc7a288439e2600d95fa260
SHA1 d5f57469af5d8d1c1440654795353a18e6f9893d
SHA512 91725ad9c0b9d003d6507f1ab3f2c31024314c50c89937be69e10beb5a98a3b242b393877fc6ae27038cba39b5cbdefe85967b8f2172cca93baee5d1a9346c63
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOO0a:t/sCv7rTiw2RYwZCUsjKpczON
TLSH
T1A0253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 8326f0b312beefde3ee248a610cc2054f32d43482c191eb252f0d6195e2bd136
MD5 747a7c16b9c102a425d8dcae4648541c
SHA1 59aba3d8bb26aa9a2076f385a21e22208d492ce6
SHA512 6d825d277d4221f98b7134af00de3e876e4a425c8d07993b98d83a2c790b2a18446cd58e322cc90ee01b46663df240e8febff45eb8495a7c186d78fe6e828dbc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOyF:t/sCv7rTiw2RYwZCUsjKpczyF
TLSH
T1DD253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 9d185d2c1e42372ed1bcbdf57e13c14a8d3ff9236f787b3291e11a3ca866c5a5
MD5 3bf37db9976fa1e0835f593e6d35c076
SHA1 22e485bac24b1d8643f059fc2b4fe890dd37fb34
SHA512 6d6a77a6d6c5f5cb2dffd6f45b4574c8dfca7bf60ebe9dfcdb239a50c2d4c04f2eab000d97fc5abb6c3cfd147a1463ac1e9a03d78dcd8512f4a411b682c2cc65
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVO3C:t/sCv7rTiw2RYwZCUsjKpcz3C
TLSH
T141253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 6ab3836296366ed8d20a21e330a67d9509867f5078b52e2c1a9e8f50290fc9d6
MD5 33bbf334d2fd232bdcc8d79872c99a8b
SHA1 11ae172c32e3f568f38502a96e07efd13a60d84e
SHA512 71f5f82348c2d950748920edaf332212b1b0f68290727633cb40d0bb1e1407f0405b6447751638079f8e99ecc8c7b0ac0412f11b263c595494eb45e1f5abefa8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVO4w:t/sCv7rTiw2RYwZCUsjKpcz4w
TLSH
T111253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 c6ff04a66e3f01b250186600b6875b9ccc0ea094632cef4b8210ea2aac6fe720
MD5 9e2ba9fe59d77babc2b715c3b290eb72
SHA1 d36c8e259c3f4c5b6143dd7bbef72fd2828ee4bf
SHA512 7b330c109531817abf97e9adfdf7b5742d6c48cce87a4f07666bf65ea2135c22bd449680026f2e913cf934ab3c1358de3d910fb53cb3defa4178f44a848c65dc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOXT:t/sCv7rTiw2RYwZCUsjKpczXT
TLSH
T159253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 4c62f6a6b96f3663c9b8f951e826c39674bcece18dc08f85c8431c3b2c786a74
MD5 2c09e9a94a78c85e0e8bae539fe5ee5e
SHA1 f550f8b98d413853e0055742400b73dca1cca01f
SHA512 0f94b79888034d175b3cfb627c5cc713bb63b01b3b3d3e76f7d15dc75660b666fc327a4dddab0192e25d78c4437fc9404d4f735d3f05bd43ce7e1cdb86c941f7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOhu:t/sCv7rTiw2RYwZCUsjKpczhu
TLSH
T1AC253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 723717c6e4c108fe29a669cd56a47f427279f063aa9582a88a549caad9d337d0
MD5 16ca22503073e6e001fb84779dd8dab1
SHA1 161c9211088dcfe266597c1ce3398f3d67736d38
SHA512 2b50fd100bc1a2b53dfea6272e764a02a396e2752c635d41d3aaaae8712e2c19917f458c51097a7840436c9131175f39a122258986833a25afa38c1a9e0f32fa
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOJb:t/sCv7rTiw2RYwZCUsjKpczJb
TLSH
T130253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 fba3a3f9751702430d9884ba30eca1f553428a2d78a1f9d66f1b796435e19d12
MD5 d5e6c8631ceff9a3d13771c0da0912a2
SHA1 c7b3609ce9b0d95c21a22ddf70b258db6a346bb8
SHA512 aa5cfda453900f8b1e34ad8a5bd5aa2ec10d19c2f6ffa381413f1605044ca5bc3e53928e1f4bb11f8890798fe451feb78c7a0252226c03938091e85146eeb941
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOxf:t/sCv7rTiw2RYwZCUsjKpczxf
TLSH
T196253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 f39b9b65216a9f092916b9945790c8a92d1a147dbc99b7a51ecbca02afc77614
MD5 92b8f04aa65a6ebe5918354c5e8bf0e6
SHA1 52670deef4f59faa35d3cb17a64ebc4f386877d7
SHA512 480ebdc1b94fef62889509dee31b0534e90322a2a6b94b1fd913b6e7895962a68d9185fbe64ae9870bfe9f97589b7b90b1d51e944c2857b64d332ee15224a633
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaK:t/sCv7rTiw2RYwZCUsjKpczaK
TLSH
T16C253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 06f1ae4c604e024b9c934907a6358c144ad0e967b66c624637db368c0be0e1f9
MD5 c80a2190ab2d4bf00ddfe949e16a1b5e
SHA1 693ee850e183528dfc77534a2a4fe25c5bc963c2
SHA512 2a609b04a28b07abc0ad0ebc81135024dbf8175be8c5867c813b7da0488749c89b20629c145a2fcacf0afe9006faedea22107d9b9a371ece2f63356334e103a5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOPk:t/sCv7rTiw2RYwZCUsjKpczPk
TLSH
T18C253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 e2195d152f6595e65c83323fbd9bd5a1ea6c33ecd491e3b6b3ad58ab438fe574
MD5 350b41aa2527db2877d446368fc3c543
SHA1 1fca075d1372c2acb4c076e7f219257172efa7ca
SHA512 33341a48c021947775864f966dcc939e74084ed17804366be90b18650a5138087dcd173f2a49a77e0656a6345a8382fe493f91019964c76a4f0940c544761a17
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOI0:t/sCv7rTiw2RYwZCUsjKpczI0
TLSH
T109253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 467ceceec3ab5e635095af2dd084966756e1a06c1e66e852f65e9ca3de9209c1
MD5 07beb0cb6cf6a08c2025741250424de1
SHA1 d3eaceb102ea76310c469c034483b557ee59901b
SHA512 254023f566a9dc2e725e7a2ebec8fb57fc1b80196f4f9f063ee4776c85d04eb6e5b9f615cf37098aa909b2ed9001ffdc8a40834c92405f8b347f3bf2c93127b3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOj70:t/sCv7rTiw2RYwZCUsjKpczjg
TLSH
T149253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 48f9ee9808169ada11a4138247e13c98968db3eeb1a0233afa12fd3eeb2c6751
MD5 060e22cc0f1e16c00fba10a73499c338
SHA1 464566a186d573689c8c27832723caaa0175309f
SHA512 1f468f8db52f6846e2f3d6fe7667b8f750d78771d7bd459e5782fc6eebd2736ecb1dc4487a774a64174cabca66c1590e4f77f2b2ee73157090cb286d09722128
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOer:t/sCv7rTiw2RYwZCUsjKpczer
TLSH
T1C1253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 58f7ebfa02b59b029c4f4e42803a99c0a031dc43b431f0b73bb6f400ee61cbb7
MD5 4b1b573a34eb1f2573ec844debfa8c1f
SHA1 ac348eeff72c2aaa30f4a30719cc3138d62f6841
SHA512 c6da9c2b3ac83c51b6c684b0e51009a388cf71792ad1c8036c3a605490fdb495b66f4780c293f8f24e7b67eb1d9417a65bebd6884d04824eabf245100b12f1dc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOEn:t/sCv7rTiw2RYwZCUsjKpczEn
TLSH
T19A253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 c9144c47373ccaa66ad608a38f5793f84ac487eaccd6eea70d1df8b3cb1c107b
MD5 5ee6e7cfd5f09e0119accc0a5f0b6ff8
SHA1 81ca4a2432d4b3eabbd344f6775526c2205386f5
SHA512 49068b0e912aa7e3d203fa4d0ec5e4aed78e1506bc8ef3709957f5628a2eeb3a821fe2d29fa0c2d8d94bc77f39428f9c90bfe47cdd485bc00aa8185a192b418a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOSx:t/sCv7rTiw2RYwZCUsjKpczSx
TLSH
T190253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 416dd214ab38182c4e45f8c31602a38b32421c1f673d1c16349f7fc9706e491f
MD5 fb1e13707370aad8ca047977c9a90ab7
SHA1 55506901ecf23f6fde37a58c6a701e980c397ee6
SHA512 989e792a69d3ff78347b3399d99325f29da00c838aadea65ec37202fb95e2ef7daa401e141d4caa60dae32bb47b6e23f69340554bf099bbec111665491aaca78
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOkA:t/sCv7rTiw2RYwZCUsjKpczkA
TLSH
T1B0253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 4bbe082e9c811874bfe1453b8385e4c165f6fa252bcc25b039cb691ea147eeb2
MD5 f376e671781df8d84c36beb12fa73b2e
SHA1 b2b631bcba39c837f750045ea7511869d3baec4f
SHA512 2d6c765dc372c16915178f3641d62d0296207dfa452c3d58ac4e2b04173c7858edd3347056b41d4079a0c818a2f4c9174da52f4f3cf153f172145057e461f588
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVON9Q:t/sCv7rTiw2RYwZCUsjKpczN9Q
TLSH
T11D253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 5671550bd8c02d9b84a3b81bfefcbe3560355caf85d44108fe340bba8e55a0e3
MD5 be11630243d1529a566cdbbd1989ab92
SHA1 383c52514a2f801cc5360b11362f4d5a492412ec
SHA512 49425ffdc6621dda1418fb029755e5af727b395549b47596282deda172b409c679f3838a69eddee6e5c42c99425fba718eadd68deab45825def96c44dff81b01
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOo4:t/sCv7rTiw2RYwZCUsjKpczo4
TLSH
T1AE253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 e416bc187a1746dc0beed321ec8523622dd02500f4f2e9f170bbfc6ab02e7da6
MD5 dc3d33c05503a16744b3fd46a09c355d
SHA1 2b7a8716d77fc1156ca99b1c6e45f9f949dd530f
SHA512 aebca7ef9dd31b64201869d9f8d8bbc757a1ad74876dd685556a2efef2efd052c5150316da5103872cf0bec39c1c2c581fc89c0f758818f98ce8954d0c3357d6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVO7u:t/sCv7rTiw2RYwZCUsjKpcz7u
TLSH
T121253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 9580fbc10ffa6a33524ee51ad96a95cbd1471fbe332c09a343a5e97d3234c631
MD5 5927aa137b660edeb885743780a02e25
SHA1 d18d1f37a9ea573144539f23ffbaf0ec9b373770
SHA512 78c6e4d05567f6c5c9f2767240a32e0b6f2c9bfd951f69ce9536e83ad25cd229d30eb3c332388ef84d45b289ad71cbffa46ec67f3d7ce3a10473f08b00429939
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVO2j:t/sCv7rTiw2RYwZCUsjKpcz2j
TLSH
T120253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 81a31d64bb544042bc776c5a16d13296a0439fd4dfa8f8ecad15591f728c7f7b
MD5 864f88bb31774a94a07eee83e60151cf
SHA1 8a7d4f84a3bdbbcbfaf42df4a225b5848f330e52
SHA512 7cc91f02a0169232f4a2985d53c3dbddee02f2a36a50b817f982b2242e87a16b2c4cf4af0bbf856e8db928b63257e44bb6d13e829cb4785c382884b700565015
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOjg:t/sCv7rTiw2RYwZCUsjKpczjg
TLSH
T1B2253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 fa1ed1c548aba12a39a1bbebd1be3f9c549c3c6cb5104bfd32d90650d7d76e1d
MD5 69914c32124495511a91fd5ea57ece9a
SHA1 d678115b51360b49193c40eb7e84b49b1052a02a
SHA512 1641971f7c5ccd61da63709739705f276b5756042f0af7f9d9a951b1c5b4cc98d7b7391b5eef0dd2e9668f1f7ee8f2f61c440f5d3641e1be7a2d00be5656b7dc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOeI:t/sCv7rTiw2RYwZCUsjKpczeI
TLSH
T139253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 28be075c8488a1d827ba473d44cdb2d7ed61aec1a95fc7bc427e94a91b357959
MD5 00347ef8f2eebcc0ce126acaf62678fa
SHA1 05c863943cdd9f2378ebcca4e70abe0ce1daa1e8
SHA512 af97a9db5b6df68c3d38ee3ef7c2d39b8aa590a3b1601917e48c78add5debc204692c540dbab4f3d7a8c702364d53a1437b974a3537c01de42c600eb6ed2e37e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOso:t/sCv7rTiw2RYwZCUsjKpczso
TLSH
T198253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 bce754bb73998d32077af09f711258f09f380339661d2428a56d0a07de75bd46
MD5 b46fcab2ad580d910b29497c319267a3
SHA1 559ad47413a05ede65c2fe30eee771b66428b21b
SHA512 fe4d8721dbfa6ef7324352e729bfb09637d66594db746dced0a153e6a2ed0308c5712d5e263eaac4143929efeb3350db96c83b83893dc7f0602789bfb240bb97
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOv+:t/sCv7rTiw2RYwZCUsjKpczv+
TLSH
T1C1253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 f700043a10ea0790425b74a5e049107293cea904310cae732fee2c09619863e8
MD5 601560ed4f01425399b242af3ebfde1b
SHA1 8a3e8625634fb53dd970a0b2d911faf0fd85e0e3
SHA512 4e22bb1cd47c414633a36a46563acb5167745f8960cbccc064b32847b75a42d73b67a762fc1c532d18f3d5c92c3715431b25001d2b8c5878d0720d7eb5529537
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOFQ:t/sCv7rTiw2RYwZCUsjKpczFQ
TLSH
T19C253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 7e499154213e3f903f7ca5d703b46ba1eaf260b756287f70c4aede63aee43c64
MD5 9f77da6c5acca0afd9fec1359e8bf821
SHA1 d79c3ade6a32dbd4ba07f62195a9f59badbbfed3
SHA512 70ebc707942516ce60e60df687937f1d12dfd4abe1f6285fafb40ab87ab5d554407c1861fe173c9ebaf9a29ce176ccd5b04cd470c138be74654e661d67959dd8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOKX:t/sCv7rTiw2RYwZCUsjKpczKX
TLSH
T1A4253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 57cca5f58cd42c2a09051fab9366768c23eaebed098c8e79e6300eac99834d6a
MD5 22cdb99455d26a19ae92175f4ab2f3a4
SHA1 88c5d1c6718d54f1d83926f0e765e2cf0799cb2f
SHA512 43548ec4897659b4556ec7d009aeaecd34a437e050609ed9d4202221d5b77ec74f41cb7c7c1ebb7110434da4edb43c8af84eb792b4735feb0db710e606bfebf9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOsL:t/sCv7rTiw2RYwZCUsjKpczsL
TLSH
T198253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 565714eefe37cdbc6b9cc3e6b94dc2074fc6a9f96492ab2f74937b8a9fd3ef67
MD5 cb6e84c1a67df78ba5a91ffe2dcbae7e
SHA1 2114116348f9749da0e32332a78d8108eea0586f
SHA512 0077f7eb154df15b32d042f3e67026f9a06f5a74bcd8f4d747ca140cf2fa0e474dcbbb7c598004f25500c9b99db5e4e40449df93057d3464d0c2bca3ad8c9c67
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOoFC:t/sCv7rTiw2RYwZCUsjKpczoM
TLSH
T13B253A1766EC0895E466A13489F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 3f6a19df3fb502c0225dae7d7a461affb67934cfdf99795f1e2ae3de22722e6d
MD5 89ec78faeb7bdfdbcf2f38b89e8c90b0
SHA1 ef2b6d3753da36a5e5a7e20ddb6e4386965d9104
SHA512 b707cacb2a2555fcdb05cd27e4a34d4947449cd5debdb0022fe95267a4a7952818e5f8a7e647adee755dc8a75192a09c9679d3c1a25fe35a20bf5242f60d09b4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOJh:t/sCv7rTiw2RYwZCUsjKpczJh
TLSH
T157253A1766EC0895E466A13489F54606EBB2F8561B31C3CF12788B2D1F63BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2896-222-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4812-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4812-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads