059613f7a3efe52ce2b1043db20ed054dc0a25549ce12df0e549703762e6352b

Analysis

max time kernel
104s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 816KB
Sample260727-nd46qa1bkh
SHA256 059613f7a3efe52ce2b1043db20ed054dc0a25549ce12df0e549703762e6352b
MD5 899155933485ba2ace0e386c87fbd916
SHA1 b60fd694444fe446daf3f89e4c6b9eba7bca7f9a
SHA512 8c20a9bf26657a8f5c23534dc4b9b4a0af565525a4719b6f656fe351ce1ce511733b0f0b7ca4d19bfbd6fac66d1d3dd0b22f3be0d831961904f60365902912e3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0a:t/sCv7rTiw2RYwZCUsqEN
TLSH
T1D405191767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/3200-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001100000001c560-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3200-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4320-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c87-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-425.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-486.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-505.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-596.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-706.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1053.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b921-2136.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001100000001c560-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c87-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-225.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-425.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-486.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-505.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-596.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-706.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-787.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-921.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1053.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1090.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1152.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1401.dat	aspack_v212_v242
behavioral2/files/0x000200000001b921-2136.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4320	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3200	2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
4320	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_899155933485ba2ace0e386c87fbd916_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3200

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 816KB
SHA256 059613f7a3efe52ce2b1043db20ed054dc0a25549ce12df0e549703762e6352b
MD5 899155933485ba2ace0e386c87fbd916
SHA1 b60fd694444fe446daf3f89e4c6b9eba7bca7f9a
SHA512 8c20a9bf26657a8f5c23534dc4b9b4a0af565525a4719b6f656fe351ce1ce511733b0f0b7ca4d19bfbd6fac66d1d3dd0b22f3be0d831961904f60365902912e3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0a:t/sCv7rTiw2RYwZCUsqEN
TLSH
T1D405191767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 ec76879a15782756875146b1f487d4a7f1088048835de049d3ca7325ea79def8
MD5 ecb7923c0ea757e91724b5f3f785004b
SHA1 18d4f3e5901da34b5c12a0cf7d053db850963674
SHA512 7513435a80af0f00dcff6152105ae2653c363f4ec2a695c66a7b372a30a1784eb4e7c2bd0d03f216289d2660d81ac743c801135b57dd27815eaa35f2d70010ff
SSDEEP 24576:t/sCv7rTiw2RYwZCUsqEZ0Le5ji0hmxNrM:x7iw2KPji0Aj
TLSH
T113553917B6A84661D073E174C5E6864AEA72B4461B3087CF12A9C73C2F23BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 831KB
SHA256 69db71c3caa2704e608a1e3b756da86a9f16b663fbe3ddc85b464f07dee63a35
MD5 a192f631a27e5ee0b0d12ff8068c9fcf
SHA1 7aa20fc82141c211c05ddbdb2be257d29850b389
SHA512 73586b7d70c6890daa1e4f0686bdcad1609bcb7322b09aa6d47893c4ea5be72f12ef93eda0b9310d1f6bec57d24e7851fc64107e8eac0fb1f86fa5bd59063477
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0ka:t/sCv7rTiw2RYwZCUsqELa
TLSH
T10805291767EC4894E5A6A13489B54606EB72F8551B30C3CF12788B2D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 864KB
SHA256 8d1b0246b331ee84315c93fdda2937c88b575742cf15db3f2e4a35ca6fccaf3c
MD5 07acbdf6e6c1c96f251b350b3b91fcb1
SHA1 4a4ef8220faf87722a6d76767a6f1291a6f1721d
SHA512 e7c4d543515af1ba22374b398b2ca762470f10ab4f4c1ded75246ef395bb6e78e03d25f355aad7df2a6fc7333547e19b2d7f2971c7883e8b821b5fdf6506daab
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0vb:t/sCv7rTiw2RYwZCUsqEIb
TLSH
T1F0152A1767EC4895E4A7613489B58606EB72F8551B31C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 840KB
SHA256 d41bc3ec96884e0fbb25d8abea2105c839e1b94700ae4eafeea694ea8373e71e
MD5 e088a355ff8e66e87d57539caa02cf3e
SHA1 afea15df703745afc17b69992179979c5885d0f6
SHA512 88b5ad0bb34cfc2825877368f4ad64e37061b2cc53d20e64650a710e84826573686334ad3412b6ee1a69b5ffc5d7a6f103ca6fdd0f6fd4b5be0b2c9ad04b8814
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0d6:t/sCv7rTiw2RYwZCUsqEK6
TLSH
T12605291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 840KB
SHA256 1ef80ef4cd4e4fd56084d2420060e46b8a5bd321be9fbb42993022b38c8a65ca
MD5 51ab07b8e0817e52d9c9d668759909a1
SHA1 7066494950754f48ec26029b6a3a63c3f448a862
SHA512 919ebf98127c6ebcce8a28d99ab79908b4bbdbc372a8efbe31bf69a060c529de9ee57548f4dc4443f8bfd34a8ba564bbe2d35ec281159e869bc9b9d704c7d199
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0zN:t/sCv7rTiw2RYwZCUsqEiN
TLSH
T1F105291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 840KB
SHA256 5dcd598b1505f59fab2c7b627f3c37ac924e5e7062566cd38ebd85ba05b97c9c
MD5 bc7bfbb4aa9c2d6584cdc663c41b11a4
SHA1 7e82a8a0e2bd3bcbf3aae8c6822bb49821f9cfbd
SHA512 bf0887411e7b387ecc5a8c08f577cf3c47a7f75219db0553ae6f2daf1d8a9707fa8698c0d2852deba4e5522e1d1bcadc134542725d2429cad9ddfad4ca9fd695
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0Bf:t/sCv7rTiw2RYwZCUsqEYf
TLSH
T1EF05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 840KB
SHA256 533124a1acce9cbdaebb0897be012a14378f6f9d629362ebf1e56a6c0332ae6d
MD5 6c751fdc1d22676e8bbb1c75f3f2ad5f
SHA1 24948a683ead40ad03f6fa343b83e1a60c5defbb
SHA512 cd70d549cbea9630b715cffb0b9aafcab8ab38e1d02bdeffe223b5899fc687f68ea37f7f6f725f6a3a31a137c4c1a6668eebcd09f2c84900701ee2588fd0d7a2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0jo:t/sCv7rTiw2RYwZCUsqEyo
TLSH
T17305291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 840KB
SHA256 d775e93922623b3a00750154f5439e0481e2dd74845a3f9616614101b4961f8b
MD5 41aa3435852944d979eaea019745d7c9
SHA1 12bfc1ae7708ba167bd83d33cac913a780724b41
SHA512 0afa2eab11f7505c40606b7814324a53cc4c04756eba0e76e1c294f7ad47d9273ae6af5ca106af6399cb9320214c1753bb380c4f85a58aa3f3e5692e45948a81
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0Xu:t/sCv7rTiw2RYwZCUsqEmu
TLSH
T18005291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 840KB
SHA256 9765b1b24103284daa5d2395541148d407d899a144b8d394c381fd99cc134a28
MD5 e8b54f5b1103cefea3e224c8c23366e4
SHA1 0cb24765a6a815e1d1be05dc1db851b0385312f0
SHA512 9bd3d2beb7127ae1c1ffd78d841a896d236af81f678a7acb7c55a85ef181b267b5ed9a82a9fe2075ce64308a3becaeaf2390b35635ee18aa7a2a5a027408f818
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0l9:t/sCv7rTiw2RYwZCUsqEa9
TLSH
T16205291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 840KB
SHA256 d33d81e307fa1cc95b4441a5c2efd976c7ab99dd8fc55e480af29ab0ca811c7d
MD5 8a2395cb7b81d105734dce8ca5765c74
SHA1 58e8e59165a5bf4c4527a752a732d4b87d76e2f1
SHA512 c63971b654928ed015536e0654dc8cd78d7ec428050cd3da162b4e01696f6e39468e76d5fd502315bc65a35d10303f8fff81ad4eaaf975d0ac20769e0013c999
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0Bc:t/sCv7rTiw2RYwZCUsqEac
TLSH
T1BC052A1767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 840KB
SHA256 951fe074f9ec76cdebd752e273326ecbf35f5d42f0eb0d1cb18e1c29e17e1021
MD5 628587d4ec6b80811e9849e648fa6ad6
SHA1 322aece3f7b68b934f3f76c1f45be7009235bfb7
SHA512 8c632b8dba5c54e24081f5f76c62eda585c2676cbf32a2773ac03ae5df081d1379a39a3959bfd836d517c412bd16502a665b953a942d32a9c38610b3edd3fb23
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0qp:t/sCv7rTiw2RYwZCUsqETp
TLSH
T13F05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 840KB
SHA256 922adb7a9a4d2a80c3bcb4ee7c6caa06fe73cb575d166c21edfdb0f98251127e
MD5 577f263c20117a30f1321cc6a0b4b018
SHA1 7394562455084dac478217f9ca3a1428f44176f7
SHA512 ca558fedc52c4fd2132308d2c8a80498e56430ce4401128b6e8e5bcb368ff082b31e1a352593511718e30748011efebb931298a99a31dd87414854d7e5033e54
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0N0a:t/sCv7rTiw2RYwZCUsqE0N
TLSH
T18B05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 840KB
SHA256 285798f147ddc0a2f71e1ddcfc659cbbe58da8fabcdb9635f5d66302be85cd80
MD5 271b0bae94a855d6dfc359e68589e476
SHA1 daf2e6fb03eb224319d564932a8f87fade27d7b9
SHA512 c99eb1675468bc65cad1e6229aac127dd00171e07db498511796fa58eb92dca81e7a7555b4567ca4ac1eda525f3055fbd72454110639da495b630f6fea5ab624
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0/F:t/sCv7rTiw2RYwZCUsqEcF
TLSH
T165052A1767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 840KB
SHA256 f96ef58e07e7aeca0a6eb899047542f2fd34b76b7c13a7b9806cd90b8ee82c02
MD5 13f1dc8e7cc9514afdc80db78835cb2f
SHA1 0ae93d6aa2399fd34b24c63d9e0395dc0297dcf4
SHA512 395acee96ceeec39ec07f5e005f28c0a3ca410f0ee49dabc0e526c8d611ab67fc6be4f160b70d18a9eba296f605b45acd32f19ccd51a290188c4d3875f37861e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0gC:t/sCv7rTiw2RYwZCUsqEJC
TLSH
T17405291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 840KB
SHA256 e14bdd969532909e596c8fe160b36ad6ea9e47c5c4a9c7be67ac61e8c060d3cc
MD5 1fcfa28327e3e2383ed9e9e487cfc3a6
SHA1 16aa999eeda85eb71eb48099161115fd63bce6fe
SHA512 9ecb7e9794215039340304dc776bf9ebaaff3e6f03021076aad92e76472787cdfe6e998748fceb92e04af6aeb434f8d2c6c58a084fc5fe608b2fa23fcae49156
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0zw:t/sCv7rTiw2RYwZCUsqEqw
TLSH
T1BD05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 840KB
SHA256 635f7abfefd512aecaaa8a344ae618ec5c4ef2a14d7676c5be7e74664eef12a9
MD5 7ff168660053c87ddb74c6456c9b6575
SHA1 2c1e1dcf01f1d6c469990cdfe0ea5c9667fb202d
SHA512 3ebf9fdf7cecbd82ba43b2a3902fc714a7d157ff38cdf3c9095c60523d8ec79c6e10f5c75f943c5a5519dbe7c2f6dc69b4048a4c233b5ad0575f5c2128bfd9b2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE06T:t/sCv7rTiw2RYwZCUsqExT
TLSH
T11005291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 840KB
SHA256 fc025b6715c53d86cc3cdebfece9ef6cef5357e9aa28b89ea5771af99b5b7d29
MD5 0a974eba7126c0e6961021b7e322a7e1
SHA1 f539f8586bc5b5b77ac916185f9c847984f1f2a4
SHA512 ace31b70c991692e68df65042bae0f2c3544474cdcff5d1600a652b665d2a9c1ccc5f9b8dcb1f10cf6c29ab56cf5a6df05a0735493e4a30cd3e906951119835f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0au:t/sCv7rTiw2RYwZCUsqEfu
TLSH
T1E705291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 840KB
SHA256 a6fa2ae3e336c0f4e8ef8ad3e3b97ac6fe377a059a1884ef98e20008bf3c6130
MD5 5522d1b6b3487ad605837e6299e0d896
SHA1 3b73ee3b6bcc08f5337432d7c366a4cdce9ec32d
SHA512 7dda165379b3377ac0974fcd5b0ff921f72b45b993e9a5f8290c40d58ba3561ff191aa3c6ff87f0c8f6c97d702c950acdb573ed9bccc29bd24292309dfc3dd65
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0kb:t/sCv7rTiw2RYwZCUsqEDb
TLSH
T1C605291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 840KB
SHA256 c3b1af78724ec8dcbf08f341dada75768b743606b7976b7bc0a50aa2decc11e3
MD5 d5cd1a9b365d1723a6cce3200a757d56
SHA1 aa3dce74ba7fb4006fe7b39c5b92ea157db01e6e
SHA512 e380109ef3d4dbce227eb15ca0d6007ba5a6144e45cd7a6e1c275e20afd768c2056ab482340006e2758102dbb02b10cb160bda1f1b421621d0644baea73cbe8e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0qf:t/sCv7rTiw2RYwZCUsqEXf
TLSH
T14B05291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 840KB
SHA256 a6c055130cab1fb77109c9542564baf151dc02bdf35d4ae16014bc6bcc306892
MD5 3224da656257f2c6558619b22ebe9932
SHA1 cf3cac0611ea9fe4c6b1e898c05d15ac1b5faeab
SHA512 e7f2a0b0970fae9a99210e7186587bd62359c7b50c1d7966c140d66959ab4da06d8e4443391fc0d69eb4479f32945f0aeafcbec09f74b58faf57abd90db72db1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE03K:t/sCv7rTiw2RYwZCUsqEgK
TLSH
T1E905291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 840KB
SHA256 314ef9d6ff3bddaa583c30a0899d8392a283e7a3571edaca2c72d0014512050c
MD5 1542af88fc038031fde53cb3a3b24904
SHA1 774743038f27cb7e77d55c8a96f9a4f42b62888a
SHA512 fb4d27f0bebef7f33d480ddb3005021fd2cac7d32006fd3970e3d1760663f0d21bce3094414cd9fbdb72e4ee8552d3dd7e97c1ea93435fc299ee350980231897
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0Ak:t/sCv7rTiw2RYwZCUsqEdk
TLSH
T15B05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 840KB
SHA256 70e3212a24cc6c7aa6a230f83a16f8b0763ebd11826ba290522805299016da6b
MD5 31ae4bcc412524b7ad385bfbab928ffa
SHA1 b9d78c804b31354c79b2f34e19a4495f037ceeeb
SHA512 a117a1554f9ee30a442fe432eb7aeae1675c53d1ab0f163aef31fbee826912ff184a3cba72cc2ab0c4fb657a7245beb85909c89952c453b054af567d0b0887c7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0x0:t/sCv7rTiw2RYwZCUsqEC0
TLSH
T12805291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 840KB
SHA256 b08bfcfa71b00c3bcaf2621afaf377b35ae81b16503b232c4b9d0bc98706950e
MD5 5c894c33192624c1bafb34653f53547b
SHA1 132bc5541277ad5f46638e885fa9f41ac3088256
SHA512 50ab05b4d0fabfd2468e0de7a4af13c12bc95671ca8528312284ffe4b5bde0ca1b09014338f4eea8e2cad325a19c754e9c1b624a3dc58645634751d28d476d98
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0k70:t/sCv7rTiw2RYwZCUsqERg
TLSH
T11C05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 840KB
SHA256 5d9651c2ce89144cd8dac2b767ec4bac14baff556d67465e5c41a27745e19a8e
MD5 a974d00912432848009b7b9f1d410243
SHA1 7b5131345fd626d1ed2d67377e2b50581611750c
SHA512 c69ca79755fe58a2cf560c46c3e4cdb47d45f6c94b27e3bf1ae9108a5cbf3e2665d9a6501eef810e2507dc924191208b3fbc6188370937769f090ea5f038e9fd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0Br:t/sCv7rTiw2RYwZCUsqE4r
TLSH
T1B705291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 840KB
SHA256 35da917866473520398fc9fbd331421b3c0eb2a42e259d95690916a456565ad4
MD5 b581395c4d8ba3e825d82462c07bf69e
SHA1 70e8f5e6614fc3293530150e01b041bd1cb57e8d
SHA512 be52cc02d7a773e1767b39c1b5ae0514b70f4fe3d8d6e19971c0de7ba046ea622697cee0e7fcf40447842006909fe9aaf6f586a0b9efe0219b9c5198645a76a3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0Dn:t/sCv7rTiw2RYwZCUsqEWn
TLSH
T19605291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 840KB
SHA256 a3ae87143c744f8b85a79550027b4bc7a37cb3c642e7b6e4ab4ddded1b5b603f
MD5 9051b86272313a867c3740aaf09945b8
SHA1 a13dfaa0c8b3bd69f1d0f847f13b9659a4332fd4
SHA512 477665c175fbe00b9f3aa4095a71e397d3a78b34d63f408d1c4f4c977588aed74749c1d0e05a2738f1c02de4914e44814d5fa91d821bc7054c448e528439c5eb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0fx:t/sCv7rTiw2RYwZCUsqE8x
TLSH
T198052A1767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 840KB
SHA256 6114f1d886f0aca389f5e9e14282d010c601069d09415a56a538fab58b50d3b0
MD5 e927bcb4589e3765ef8641a48c2315a3
SHA1 16128cec83b292ae53e3ce943d80e0bb445be89f
SHA512 bde576b350628715d6507bddc53a435b360ac57211d78392dd7114b761ea16d81ba64fac1e6d3cf8a5472bc1c858fa9d7ebe7e6f821e27ddb5adf4e2a3a6b4bc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0FA:t/sCv7rTiw2RYwZCUsqE2A
TLSH
T1BF05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 840KB
SHA256 2aef1ae45bf98fd71851deb3369a630ef72de524ef0d67d83822e5fb9e042289
MD5 d6660ee95badc13152b00a4b54936f18
SHA1 ba060275d0f846610744ba1c02eb2c7d5df1990c
SHA512 a19f36805c11749a0e10da5aee7729fd58ca0fb294b746ba1c5548b1e54e45226bf056a252ada51a3f4acb9d5d0c36c1802425893fc241b314004c65dd8c42e2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0+9Q:t/sCv7rTiw2RYwZCUsqEv9Q
TLSH
T1FB05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 840KB
SHA256 9fc3777134a503f9af79fb7b2cac0ba82ed8c175f4af9e7ac92b7864e8431afa
MD5 ccd5e97aa032690c7221fa2d81935e1e
SHA1 d12ffb9eae43277a3d23e5d04488a754097bf739
SHA512 a073fe74231aac43f607c954f94a25f9c8f4e1ffe6b5a3ba5f66bb37cc87c61612c5f376db5dde32c4ca2071b7cf8db838da45ac1dd80639668d1ac0fad78204
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0r4:t/sCv7rTiw2RYwZCUsqEG4
TLSH
T1FD05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 840KB
SHA256 c1bf4b84ccf5448df7d80a86bb4a40884dce01107320f953c49d8748f8d0cb85
MD5 65e48afd3f0f2e240cbb3da9da3b4800
SHA1 509e3768a56a386c110da69575da86863c325acc
SHA512 9158cf8358c9ddd13e1604c58769f97542422871c25ce1da41cbda8232706a8b414b9ffa373c4e5bee7d7bb3c3de9d576f308dacb4f4096ab8da2caec5635c12
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0iu:t/sCv7rTiw2RYwZCUsqEVu
TLSH
T16D05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 840KB
SHA256 5f0dd7231d36921fd0f42f5e5cbbf7701f01dca6bfce3795dfef9336a13992d7
MD5 d5b71f191c2b496cc78ac70793cae96d
SHA1 0e7985a28550e1243103eb7e3642e102145c8fdd
SHA512 e183923df5d6c08620c6cb8a38dd35c22f9499ad31b1db9456372cb17e19366286880d7fd42f9591c37a9ecc084c1ed970dd9a18aa26fbb48eb1201ced72246c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0zj:t/sCv7rTiw2RYwZCUsqEIj
TLSH
T17B05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 840KB
SHA256 d6567dc95a93ce7c0daaa0685d1048a598ac49f617c427c40a903af96b897b1d
MD5 82f6c861c4e78ee061cf4ec197b6bdf0
SHA1 4bd4b631979c44ee6b2feafb8306c02d17fc139f
SHA512 8154b81a579d38142e04d84a762f9fd0986947d10d0987b1507380ad801885459d1b294a7f2d02517bfb0a852cea62e0b76b75d2d0709e2b032e40f23298c65a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0+g:t/sCv7rTiw2RYwZCUsqE5g
TLSH
T1BA05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 840KB
SHA256 cd38c93e7f631bb4de3977464ad279270289372eed1e534c891dcb05efbbb943
MD5 7a3e856cb4404181735cfee94f9a62c4
SHA1 e195bcda72ee1f65216edcd6eae897e730c010b7
SHA512 b4c66836142a4eca1e2375f3419080ab729089b619d782514b72a7c7a048e0e354d4e0d336d36c324c4222fe4d96510c3ab8e10170f2ad2353c1a3a3691e2638
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0xI:t/sCv7rTiw2RYwZCUsqEgI
TLSH
T16205291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 840KB
SHA256 e1922e739155d4f2364dcc2790805b61043d4fda52ad15d1ac794ae824bb4651
MD5 a333d484727f1cfa63dce435263c0ffa
SHA1 20672f4675b43621d2a6c92bef2ae9e87073073d
SHA512 29f0674d1a5e3a455506cc90058c58e7ee3923aa0e1f03e279460e5c056c1b6dc18fd8277c85aff3e08bcea7fbd4d5986f93ea8bcc10cddae5304426d0d09876
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0zo:t/sCv7rTiw2RYwZCUsqEio
TLSH
T1D105291766EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD3DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 840KB
SHA256 8b6805c8ef6bd54e263bb3e2982ef34e9dbb161dd946c6808cd66e2133969e31
MD5 d013bc90eef165b8c938fe9a766eea9e
SHA1 0819c4377702f1a9f5c69d72f3a229286f909945
SHA512 9cb463c332567aa8001c44dbeedbf61631e9fcaa5c8abf1960c1d5c8820502c1d159274bb4a3b9fc97f7ef30e96a50277a33521a08c42ee185e9b08b5cfb90e6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE04+:t/sCv7rTiw2RYwZCUsqEZ+
TLSH
T1D005291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 840KB
SHA256 ee1342628d7281e5ca7132c863e98156373785fca6ac8741fa9985183edc00f9
MD5 67737e027df3b9db9b133d7ab72d89fb
SHA1 db242cacc9c25930767c3721e58fdaf780c450d2
SHA512 cc080d0728a7b59b45fb60340424de6e07ff15101218a5e42192640787a631796cd5decc2ccb43053e9da81ea8cc1a68504e8ed501cfa9a10c82c341b19e2b45
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0QQ:t/sCv7rTiw2RYwZCUsqEHQ
TLSH
T1A505291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 840KB
SHA256 46e47a5f15a4f5513df239057a6992b6afd6bc14134e9a5d09a7b2b9a8130ba0
MD5 f6c8db3140674abe4a41d8512c9bc834
SHA1 ff6169eb0c73fe43e2eda56095083941d8fbba57
SHA512 7cd1e1901b20e7b989af221be456a0f8d1a557a40274a2e7569350ae78a287c420bd4a9729d93f5ab45e15f42024e90618f6b2da42743b93ae323de1059d0309
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE05X:t/sCv7rTiw2RYwZCUsqEcX
TLSH
T1F905291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 840KB
SHA256 aaaaf41939aa2658d229d912312f44475cb1cce072b9b97500ccfc34c99a2829
MD5 51d05d5787723c7c6ffcdcd8739f5ad7
SHA1 af84db393565f04c2e3752e8ad803f4560d17762
SHA512 3c5250b279324d2d97569bdad81f7242fd03582c15d264acff1133f01831d3658f5946e52254aebb3228438ad3f133e43a30c38a31a00a9450129c28d4222d4d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0TL:t/sCv7rTiw2RYwZCUsqEaL
TLSH
T1C105291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 840KB
SHA256 1f84891ba900353c062b689cc5c0c01936c510cc695974f085898772f4f0d7ea
MD5 d753a27d2b92a8eb496265c0cb651d6f
SHA1 98f9e1525218db25d1055476c5d5ebfbdb851b10
SHA512 5920e3f42974085c0f1cd7c5262998daca3bb518d7b931c9c15bdec0eebff582b5ac08abe8c78892b8e00ef8fae0447e5f32207d0d97f8f659fd2cf2a2bcc719
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE05FC:t/sCv7rTiw2RYwZCUsqE+M
TLSH
T1C005291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 840KB
SHA256 6e7cdc8c5e014189ceb06eb955ef09912ae4f45d4d0e0abf063482c158f8246c
MD5 6e4bb89c59cdd1913b6122c5d3431781
SHA1 31aab1f61d2cb30039f155051ea8239b194a3658
SHA512 129bdce576a52cbfccf6df0d53f44ee235f664b68bbd79e4cadb1356512188ee6040581b70dcdf6c93fbca757f6da039e6dc613dfaf69b412009c999465210da
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0Ch:t/sCv7rTiw2RYwZCUsqEnh
TLSH
T12E05291767EC4894E4A6A13489B54606EB72F8551B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe

Path C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
Size 901KB
SHA256 d9455903e88d6f35eb7517b3b035c4f6c619cadb88b982a9825a2c1e3db2e390
MD5 c82e2c487393caff8c7b4de28ce86297
SHA1 1fa343fad8960588124752a51cf770fcdfe0d37e
SHA512 6e3ae8b553b714fddd4f72c6c01007561bca33a38497220f493619917b293a94cfd247213a535585c3c80733880aa512167d8e6a38e1ef17a19406ae5bc39ff5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljqE0WwsB5:t/sCv7rTiw2RYwZCUsqERx5
TLSH
T14815191767EC4894E4B6613449B54606EA72F8561B3183CF35AC8B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3200-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3200-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4320-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads