6f1ee2e692400f593909b54775c43290623e4cae51f12ce8cc23d3f9e2aeaeab

Analysis

max time kernel
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 858KB
Sample260802-ejskfacg53
SHA256 6f1ee2e692400f593909b54775c43290623e4cae51f12ce8cc23d3f9e2aeaeab
MD5 bdd1402b74cd76fe509e5047b38be8f0
SHA1 be42ea6630f1832e545efb8cdab7366f5df423c7
SHA512 2703d425a78fd7241d5417375e1d1377052ff1202e974ed16dadaf345eb8d29ecf1eea4437a075f10476b62074666ee2ec16b1fb5ea1cc9426f2fd697db9ea23
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796u:A3kMP56rg
TLSH
T1B2157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/3948-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b6f1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000016b4e-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3948-33-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4788-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198e2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188d7-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1111.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1290.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000064cf-1997.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000400000001b6f1-5.dat	aspack_v212_v242
behavioral2/files/0x0004000000016b4e-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b316-40.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-234.dat	aspack_v212_v242
behavioral2/files/0x00040000000198e2-259.dat	aspack_v212_v242
behavioral2/files/0x00040000000188d7-428.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-510.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1111.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1290.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1328.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1342.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1380.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000064cf-1997.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4788	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3948	2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
4788	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_bdd1402b74cd76fe509e5047b38be8f0_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3948

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 858KB
SHA256 6f1ee2e692400f593909b54775c43290623e4cae51f12ce8cc23d3f9e2aeaeab
MD5 bdd1402b74cd76fe509e5047b38be8f0
SHA1 be42ea6630f1832e545efb8cdab7366f5df423c7
SHA512 2703d425a78fd7241d5417375e1d1377052ff1202e974ed16dadaf345eb8d29ecf1eea4437a075f10476b62074666ee2ec16b1fb5ea1cc9426f2fd697db9ea23
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796u:A3kMP56rg
TLSH
T1B2157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 959KB
SHA256 78896090e29c6dd31fd003d5b610750a28bb66defd308b6b13c3f8eac989748d
MD5 511db3a185bb1ee564570be4f32828fa
SHA1 5a92fe4113687e8bbce96982240df08747cf5a6d
SHA512 141db452e763dd9bf342445fd0abd64aa1a99fb6a2d7cb1566d7754c4395246f159411f5fb1972c7595ff8f2d6a4fd84f5250f7853215a7d7c3ea06c7043d849
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796BT6Nr:A3kMP56rnTAr
TLSH
T128257B03A6940FA5E11F813499A64666EB737C125F6087CF2354BE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ad3524dd9dafbb36e525f4b09d9a2bb05f7e7215612bc8dcca41f7149ab9df5f
MD5 d0402df0c1d3d4b9fafe61aecb0ce4a8
SHA1 5029fa9ad7cede4b6ba7e1582da0dcd96cf921f8
SHA512 6862580200974bff47af38aadfc3e24dc7e52ab7b77cf44eccede13d88b8cda6b229aadbedfb6a3956565185f1dae2db26da2673d8c6c2b0f672cace692fd91f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796e0Le5ji0hmxNrM:A3kMP56r4Pji0Aj
TLSH
T1E7655A16F6A44BA5D02BC078C5D2969AEA733C425F3087CB13559E283F237D19A3A773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 873KB
SHA256 3f7a173316ce952847f0876ed977a96fd91c96dad38862a84676fff1469646c6
MD5 26111bb2a763f581a6a74b8714e2fdc2
SHA1 5a4be01b4029d39001704091f1fb9c320ef9dcd8
SHA512 96577b775ba62dfe2e0a303e73b47a4c6e1500b1c1f3eb28aa9dc0382c3472b45e4d5ea6686f6414c5c811e8564a948861b411e7f90c5293a79d39d096f280ba
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Ya:A3kMP56r
TLSH
T15B157C13A6940FE5D11F817499924666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 882KB
SHA256 85b6185d3777fbc8d849abd5c508faf2c45eb391a012250b53cc94d53a19e09c
MD5 ff104ff06da96e21e06da4bef3c7f145
SHA1 f63a571c81d1108c46198814c16d5bece18777b9
SHA512 6d7aafac98e7a30b0fa8164510729c3442efe38d686df201a408c380b47101c53cfaaecca377b38585a05e724aaac0a0252dc424eb86766e14f07f6a70609bf6
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796x6:A3kMP56rm
TLSH
T1E3157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 882KB
SHA256 ca7f2fa05755377b056a4497ed99da7253dff7443bb659a302aac38958a088c0
MD5 bd2b9005d9821d511b165a78765c744d
SHA1 c2100517ec23a0e3d1f152917cb92a4cffc4aaaa
SHA512 3d27b90eeaefe75b67ace763c02166df40c98e7989d409fa4cc48ed10b4c0c6bc5e582fcf5e3fdf487af290d6c6fa4bc99ac828ce8842d2fcee2bfc3cd5a4989
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Xo:A3kMP56ri
TLSH
T167157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 882KB
SHA256 1a8df02290fdc772c11bfa0ecc2fd970834f84e0f53d6563bc316f71369cdd2d
MD5 5984864649e875059683c1d806bf8221
SHA1 6a0b767b90f0bd6fe6d967a3f765bcec8456b953
SHA512 014aa9f78e276ac00f82440c35e8273b29fe16ade2c415ab395b6efe6ae79dfaa8630e2c192cbcfcfa684d33aa8c0dfd5e4eac96b7479493719e3ba11cd0208e
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796bu:A3kMP56rs
TLSH
T1E0157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 882KB
SHA256 ca2136a1c9e8d0c5c274adf67227c6926d7224159bd1bc224ed71e3bbca940df
MD5 2ab73d1a0085606288302a3729155f9d
SHA1 79bc33c82bf2e3abef7d76cb41db17cabfc8eb60
SHA512 ec3bb58d1e071ad1b1f5fd7aad1e30b83c1d627743a5d04090a77897a2358a820e8415e37d29d526a03ea83af9b2f49f2832cb95b9de435648fc824d0d4f3021
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796J9:A3kMP56rx
TLSH
T178157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 882KB
SHA256 24ed621a5e97a316911e70e96dd57c72afec7a8604551c257dd7cb02f6006da6
MD5 1d17e2880b8e118c4ca92e70951c01b5
SHA1 467ccdd9b707e9d9cf38aeee6550c6bbd7f7afa3
SHA512 17de2c4ff0c59ddc70854d8edcef343b5d71d57e79bb4fa8b65f66121d1dd888e570db9fee0e0da3f61ae47c10c92909809778fb20b46c15e4cc4658c3bdeca0
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796lc:A3kMP56rE
TLSH
T1BE157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 882KB
SHA256 c87900f44c0aa33e03bcddb2dfecd124022263079e8a7c13f511f7f1011014ae
MD5 6bb7799fce996f3fff5fa15be3e0a61a
SHA1 ed9e12bdcb1fab07a4fa23b1c4830328314424cd
SHA512 c20a57391a226151de16bf224ebc0027fd1900b05f6e7d10d51711c2f591b8ff772dc2f3000b1968dbb68b3bf49ed29956d11dcced2ec815f092f9055e7f60bf
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796ep:A3kMP56rS
TLSH
T1A5157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 882KB
SHA256 79779bd924899716b9360f46f331ac9e2b87980fb070155b33ea3331bd376686
MD5 82c1ea9650b0e57985c6b44febaa6c28
SHA1 c3fd0a3bb8a18b0ffe16ff93601deea92ec9e529
SHA512 12eb31d98ece5ae3bfed086e27238493763d144f7d66f19c4278d999154efd8ade1f105ca96cffea2e6a133937a30b4d3d7988669c1515c76c4d7827f31919e5
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796RN:A3kMP56rV
TLSH
T196157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 882KB
SHA256 2d0a527f076e894a8572e233984b63b9027c1213921dbf1751a6cf89893861af
MD5 4c5cb3b7dbc7380ecc64ab68b6128cbc
SHA1 219060f07da60f91002749e77c3d69e547758718
SHA512 637c02137c910978f168dadca07793dd8077d17ff9ab83a846b67b2a3d29a9f0840b4dfce5200dc19d59d762b28e6fe9d041554139ca6b0891e40574a821f0de
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796zF:A3kMP56rf
TLSH
T1C2157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 882KB
SHA256 da16582c595199cbe0f516d2f43c604da5c39bc931cebc2261b96fe6248b56ee
MD5 824c0eee342d3688e04ff8c15ceb4796
SHA1 4cab63fa1d2b61a80624a98a7211b1f384fe9583
SHA512 168084b07124fd0ceab6acc92bc33384a4fade4cfb1d95499f3edf8bf5908779b703136da371af244f7e5983e1b97ce01bac9dbf65c8061f1bc1485cb358d00f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796cC:A3kMP56rT
TLSH
T146157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 882KB
SHA256 8d6dcf898c863d152ec64a123220bdc47ba643765bd3d83c2460cf790606612a
MD5 d826b8defab06fe25121fe77482dd0ac
SHA1 3fa634667b665a13f4c26af1fa79109f54fbc015
SHA512 9a98fc161b639d9029acbbaeff91f8a0eb7298c6fdd63379b693e57a983a7c969abcb9a5aa35e7cb6246338610774be6dc13d5714097e3d5a2ada27a38c013d7
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7963w:A3kMP56rW
TLSH
T128157B03A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 882KB
SHA256 010b9dfed6a64badbad5221ffca2906fd394203b4becbbb16222a1bf02b66cbc
MD5 b7637a8099ff63035d16027cb5c222de
SHA1 12e01fea4a189828f206ff02ce49ae76bcc7cb43
SHA512 a8a6f2531c8d7975a3b5e4e616ee773933cd5c212facb6e21667c97ad49006c9caeb0c1fa311fde0ed063191af5284419c2475b71a95d67e3bd2f324fe4e70f6
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796mT:A3kMP56rW
TLSH
T10D157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 882KB
SHA256 5afa852375451447ddbeed9d3e921e57aba77de27dd5cf4ea2229560fcd25cd0
MD5 b90ac33111ee8d06aeafaa6e1b4ea947
SHA1 982723bd7da303c866fabd8534d4e0737d482a43
SHA512 c1e317cb5eace991812b08a0b38d5f72ca42479757cb394d8c6a9e671178c6bc72a2c30384ea2858865100418777fa6f134d513f6597625a043ddc5e8dd3b4b3
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796eu:A3kMP56rx
TLSH
T1D2157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 882KB
SHA256 8280d06d182194faa7fc97f2f13b2b6a68497c6738101add95575daeace48aba
MD5 90be761469ec2694ba5782183c5ea817
SHA1 dc0c641d28bbd7cb47f7b4bae3898a56e3c9185a
SHA512 f4fd4ced6178d9e34efc78171123b11063b4ebef2f6af40099ee4b8dd2dfa50b6789d04a69ca2bdd5352d91d760035d6939a86d1669036eb626697c26289e046
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Yb:A3kMP56rQ
TLSH
T195157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 882KB
SHA256 9753f1caecebd044e8213e45dcb4cb655dc124c5b25d4f94649bb5437104c826
MD5 d5b1019ff4e5f513344dade4a5cc9a0d
SHA1 54fe16873be99514fcb55aaa0bda00e59723de74
SHA512 26b3510b1ee13b373f14ec2b3b7a822060d8b9d14e57ca0769583d153eed68c35cbdba01950e87baed1bf77198f9b29ce8a8e6f9e65f5ccbcac04cae9fa34864
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Gf:A3kMP56rA
TLSH
T1F6157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 882KB
SHA256 70e1cc0cfd201cebfe1c1e78c06d3a44c215d189317b7980bdca406ea8d5fa0e
MD5 314b38406c32e6568a38a24cc32b9449
SHA1 afa70917e02b114896cc822ed4d88dfb56968e93
SHA512 043806dbb639a6658bdf43d7a5034a028b5afbe42ee2e85cf71e5f27ee335e659a127809f3a3d41e9fa86e03c8268cb300458c806a2a2f3f95c6f8b947f7a5d7
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796DK:A3kMP56rg
TLSH
T154157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 882KB
SHA256 208d69da40d8a806fda64c6b9dda98562a685623e3511319098f5b332001cad5
MD5 70da7eb0bcd62804237c8a8ea3813d8b
SHA1 3268aa0f3a2c9adeb5725c8e119b2ae139bb3dc9
SHA512 40cfdec16a4525dba7d8d2f057922b3f8c73bbd3610860d0e18087db8cd7f4b2cafcedd7a1b18e433a9aead33ab42e2471a415900322b889411c2761b2b64f9d
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796kk:A3kMP56rJ
TLSH
T1E2157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 882KB
SHA256 f7104a8dd197ffd1ee916ed4d302ab1ef911ff62769980003a26b08e9fae189d
MD5 9b65b0f1187af0163f8f66d5e952f5c3
SHA1 2bcc41c8613d3c5b1fed4abc43647565c228ac5e
SHA512 7d665611da13290afd3119e152963f433eb2fb21d6daa3e6e64f90f3da9dad2586e619ea626f64816f541b43ea4922a30f3fb5648c74fa306960eea392dbde72
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796t0:A3kMP56r8
TLSH
T127157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 882KB
SHA256 dfa96548c5d33f87bfc72de3f142a0fd1700a8478a28eff56b95fe5bbe440352
MD5 5314d53625f705bae84ddd4df6d8e45f
SHA1 120eb8d23b328fd126556d32b483fe2b9f1f4bc7
SHA512 86758da5cfbfc132e3233254e0f6577f083680fd33c5ddaea199f2de8b5927f91150b4feef45b09d16075898d3a51944ee8d8d54170e5cdc46dc8ee9e3b25373
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796wg:A3kMP56rB
TLSH
T1A0157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 882KB
SHA256 5e6f1fa092cf8355a5754c8348e6dd0df6ac9e65ca11c7398f49615a69d39b83
MD5 290a1dd4b576b71090916dd392780d82
SHA1 0f1b50db31e1aec8b2ee942578aa64f25f400999
SHA512 dd3bac82583c7e886ecb66fe7e8ee3b10795a433912f3a27d92064e00892d88bf888a6080647bc53e4ce7e0c10e0c602783f81784abacda9af3cbd020bf15f98
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Fr:A3kMP56rr
TLSH
T182157B03A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 882KB
SHA256 b9270924f85230359fe1804bc6f1810d14cdf29739540cadbcc7679a9cca0d98
MD5 b08c90f30227499dd29b73210bdb21b7
SHA1 1d3568c5178638f4e3e4e4897da1b3e46055330a
SHA512 bdd4f6a6401c49e17d05189855eb8f29dfeda18e94bb140a37555fd9c9c20108358d24d516dc06c0a42303e79e82a58f7bf3444398bea274be825c315aeb7be8
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Pn:A3kMP56rd
TLSH
T1C9157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 882KB
SHA256 ed19fbc752cc6fff825e9316d4a4593a37bfe28813fb8b3d20dca1669448b002
MD5 1c8cbc56da7683a9a59bcd42deb8fcce
SHA1 737cb881527e04ec906533c709d48a76c4910ba3
SHA512 786787cf0d88c40b9761760f761d2f728cbd9c1415df7a6de7350c37af9b40e9009bf7c922f89fd477543dea80e6bd66c08893a64d6854b4ec2b8d49b257f090
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7967x:A3kMP56rj
TLSH
T17A157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 882KB
SHA256 87729430574ae2c38fce774fa450ee1aca8c4781a8459e09875536a6fce405e9
MD5 0c9d914943e1f5a36dbc86315558ef64
SHA1 aad4f6be9cede261e400b5238a2655f7b068d628
SHA512 88ab8d8407c4c71b4679eb7c72b1decb98e09cb753fbe4f7e132a04531caf5d1d3a0fdbfcc7c6915cc3a283d70f2e54981945faae82d178e6712effd011fbae4
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796pA:A3kMP56r8
TLSH
T1A7157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 882KB
SHA256 5e15b24ec3cf025ed34a3fb69f03379809b1e7bed348536c08ad6946db9a546f
MD5 13df459dee535bae154d940add2614c4
SHA1 cc08265388784ad07f842cde398a3e078713127a
SHA512 76b2f3233c5ed43bf3d328ceaacc29f6277f4a0c70e56a369b247c5844979329fbfc5286917ce3dae3ad2d1a88fc3595eaa359275a2d0505115e0e544e1ee12e
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796i9Q:A3kMP56r9
TLSH
T120157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 882KB
SHA256 9f9ceb4a791e1ab628d34aa3ec1891ba3f3031d2bacbb7a4a9037aeae6837969
MD5 d9ec7d0ec432660f3e66f9c8c1f0200c
SHA1 b10e4caf698969488e40f29c49ee5c7518eaebcf
SHA512 3b0abe49ffb56eb92545724a31e6a038e5ee21c0b77c669487f188e8c2fd75c3dd0b32a0b2d93a02b212c28404a68a304ddf506df81a5483e02a1bf31c2668f0
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796H4:A3kMP56ri
TLSH
T1F3157B03A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 882KB
SHA256 2c952ba33ab67e2d2317e966f7d6bac338b96090b253bf0f8ddba2af550722b6
MD5 cc1890acb7c231b97152bb46d8bc794f
SHA1 d8a736f92f072f7be9ffa246ede0eaa105795b59
SHA512 0cbf98b4b64bea2e3c24745b1a6f2e0c4a707de10f60fd82df2ab84f7d5d06fcd17aa77e3ab78bd14433ac4ff0974cc9bcadbf322b58912fa02d28eb058638ad
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796mu:A3kMP56rT
TLSH
T198157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 882KB
SHA256 27248f90303e05c5d159739b4549d660283c2f00f495447f0baa23cc24da296c
MD5 f0bf236613466f4a3b477fbb1fe9804c
SHA1 0e004456a06d332f20696920b1a2829419e09f39
SHA512 ad14d9674f7d85cefdca27451987d9dd7f342c18d39724e5647303bd443f6528489a61e3378f49d09d726e1abf46218bab6c1daf5cf9fef8d15088b2915d36d2
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Xj:A3kMP56rd
TLSH
T12C157B03A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 882KB
SHA256 d42f10259750b7cb95055b7681631e702f63e9fe5e91252b9b3c99d9bc3ac48f
MD5 a8257d9b9f57eb16b3c181e2fb9df940
SHA1 d1ab7f90af76c3fd7397bed2d033e2265ea57aa9
SHA512 f595a24afc7bce7f275b982160f7dc8a81c0cdf3c9f4239e8e0d083db971f4cf61e425b618c747735d5a2de36d45a08d185a676ec48a46cb2b49d45dc949126c
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796Cg:A3kMP56rh
TLSH
T190157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 882KB
SHA256 4f69b95d2200960e5518b97e797d55bf3028efea654d7d3c004ed474efb70da9
MD5 f3a7c53ca308640947fa1c6cd59877ce
SHA1 f1f48345aaae0e82b1860670bdb4f0e6c2fccffb
SHA512 383717f7a5a461f1821b48240d60e8c5249274111685e4d084f8ab80f3b7efbe169545b2b6bf193cc902de9e23e046f3044cd3ff9852f644ba335bf234a6943c
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7969I:A3kMP56rw
TLSH
T163157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 882KB
SHA256 1843a6d6cb2555a80259941b3d430e01568522e80c32df694d4f2bbf56248223
MD5 a797ac58c6ad1f83849da32e256ebd52
SHA1 36e5fb7b4319fd4b57382bc19c43480594bab21a
SHA512 2eaf1eac1f5b2d4a4fa7eec72dac67da3b648d64a24f0f1b37e53af6d7d172df2d67dd64c4c7e4ef4954d1aaab57f4cc35a463a6266c260f2f44a49f6edf766f
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796vo:A3kMP56rS
TLSH
T109157B03A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 882KB
SHA256 e9513c1cefc788c63fcd05602f7f4914b8887d6d5e9e69796cba5b3e19e52978
MD5 940d6d5431f7ad06c2bfc36fdc0c4688
SHA1 51216f02553a189632f508fb6b37934b896dcf23
SHA512 9384843c3065fbd0910dce46f838f3dd4b0a0389e5f4f0f2a8bbdc8f6e877109d4aa00a44266b11208ab092e73ed9f66b1c04d9ee49640f47e620de906cb1920
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7960+:A3kMP56rX
TLSH
T166157B13A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 882KB
SHA256 cbdd2cc448add1bf5a5295d10448cabb50143665141648522218b129206d2725
MD5 f04d087753b5b85af5a021eb0e565b79
SHA1 fb65d15b08686acc644cc36e47a2a3e0693605db
SHA512 c5bdb1e768d8552ad5bdd9473b6953818abdd94757f986d7f6c9acf271cd010ccee27d2380367ba921321aa526135d8a13e27c6ebf481c77eedb44f9b3c33447
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7968Q:A3kMP56rD
TLSH
T1BE157B03A6940FE9D11F817499914666EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 882KB
SHA256 27600a91d85f4f453a8212a6c2270083a11c3e94d6c518468fa5ccf1a4f6c307
MD5 e35156245fc1b958fd2bea74f784917d
SHA1 258e7b62f27eda5a9230cb9906efe9bbec243748
SHA512 7752b018f241ac7a08070519ddfc6a35e57ab899296ed67aa84a0ea1cc2ecb7ce575733b25f85ecdd234b449cfc77c7c601726261af5e447a10d5990ea622391
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796lX:A3kMP56rX
TLSH
T101157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 882KB
SHA256 51a1b30bcac570989f736cefababfcaedd7c584e7a8eea3c73ef81b21c955880
MD5 e960123c8c8c322bbdd3f39614b5b64e
SHA1 bf6cd42c4dc077e8f2ccf75d7c6f315a26e7d87d
SHA512 9a2a84fadcea6b2ceed8bc5ffdbc9f6e08c9a3dfe1a06bf4d96e5296df268936b30651a0b32e4a493a9d94fc1bebd50f1670d28c0c05287fdbcbcf4ef6bc92b5
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796HL:A3kMP56r5
TLSH
T1A5157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 882KB
SHA256 eab340744d085184035fe279f05dcae8ac6037d90f08ee4ffd401e893d27407f
MD5 d76644e4e9ffbdb7ce4af5de06de68a1
SHA1 2f32ef414a20bed64bb0a87919bd5b61240c16cc
SHA512 ca6a93b559578158a0a5433a4bdd3d0192b64a9cdf0df8fa3a9f1076d17dcdd51fcec9570a0d8196b7556b2b681c62a6bef2a3481745cae83d2baae4ebd35841
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD7969M:A3kMP56rA
TLSH
T165157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 882KB
SHA256 3a3e59b1fd64b27356ddd56a09ea38eff428c5fe61de7275cc0c78218322bc05
MD5 da2fc5042616f214bf8806006ffa578c
SHA1 926aa09727de48829b303aea8ab42a72ef5324a5
SHA512 a3c8f8eb9514a6156f8b685ca2e41a1691f2bb2fb4e48d6d590670ce056bc1dfebb8742c3fdad90f89b5eccf41e1113c8b7c9770943536efd574eccc9c714a06
SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlD796uh:A3kMP56ry
TLSH
T198157B13A6940FE9D11F817499914662EB737C125F6083DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3948-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3948-33-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4788-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads