f9feff50f6d7c3d61cd5919f14cd80fe242e0ee9ff170299f007eafa60b3d54f

Analysis

max time kernel
93s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 838KB
Sample260802-tk9yfastev
SHA256 f9feff50f6d7c3d61cd5919f14cd80fe242e0ee9ff170299f007eafa60b3d54f
MD5 f79339a2142d990b7341bedbf5fa5152
SHA1 042d3fef86e69bbc62a9f78f1cca7b597a11a143
SHA512 15092d0908fa0908f9d8310e9592c120184ca9fb61cd649ecd8ada1632d954e1af272fe6e915a79b2bcc770ebf492e66048067c7fbb1d37f09ee04e568834023
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3z:KIifqFu1//IifqFuyDA54GX79lSqSD
TLSH
T17F054B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5196-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c583-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-469.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-585.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-695.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-763.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-837.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-862.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-927.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-946.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1075.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1315.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5196-2051-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1224-2088-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
1224	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5196	2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
1224	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5196

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 838KB
SHA256 f9feff50f6d7c3d61cd5919f14cd80fe242e0ee9ff170299f007eafa60b3d54f
MD5 f79339a2142d990b7341bedbf5fa5152
SHA1 042d3fef86e69bbc62a9f78f1cca7b597a11a143
SHA512 15092d0908fa0908f9d8310e9592c120184ca9fb61cd649ecd8ada1632d954e1af272fe6e915a79b2bcc770ebf492e66048067c7fbb1d37f09ee04e568834023
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3z:KIifqFu1//IifqFuyDA54GX79lSqSD
TLSH
T17F054B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 d9e8401dd83e08e1d1ecf6f577183ede62ededba4bdfa54533edbe2041df4db9
MD5 3f2012bd7b658972de288b7d460ca209
SHA1 8deb20dd72eaf4fdb9c131bc7af085ef53a64d18
SHA512 9eefd67dbe11592cf79b029fd2b010135b5bb7cdc360504468a143069886b907bfb70ce52d0bcc60da9400a120ca05792206351c870c3b667705c4418bec3463
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSqS/0Le5ji0hmxNrM:WqFgqFUH0Pji0Aj
TLSH
T15F653A16F2A44278C02FC075C7D29666FA73785117F096DB13D4E63C2F22A919AFA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 853KB
SHA256 5089d419bc08575e6a8c93f48e4a87ce789f7758ccf99586ee8a8ce0ae953b0a
MD5 3ef9d04ed0c65149d8ce8ba5203e5578
SHA1 974ad6ccd8f51b5eb0d79fe26c56d07438533869
SHA512 d754a93ed0c31aac6cc82dd974d5daab90d43e9a76815b4e2319fbace9953000115a759f0d9b9ccd6900106051006e97392ac0bd5eb369e803bbc8e570cfb5c0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3xa:KIifqFu1//IifqFuyDA54GX79lSqSha
TLSH
T1B5054B06E29204ACC55F8130C7A65372BA73BC2156E0A76F13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 862KB
SHA256 832c400c5c18892bb7da990752136dab28d0fa8af6fc467524267d452432e314
MD5 8a1246dc251bf9d8768ceebe9a093e80
SHA1 c850e684fc29656571ed03697aa5339e4c7aac71
SHA512 fa68421e64275985c9b6a2e0478fb563da8dbde83cbf5035050868520b8ca95159167de38ff0e68825321f3c574277a860142ed305d6e1ed56eae6f954ff7fef
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3I6:KIifqFu1//IifqFuyDA54GX79lSqSY6
TLSH
T1E7154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 862KB
SHA256 4efc21b7b09d75a45df704bad54dc94a6cb602cf4a0ffb08db5afa3cb7041f94
MD5 527989f3725486504848b6e5a681229e
SHA1 9f902e989c1b4534d987acafbd497bef2e1b077b
SHA512 736663951ecea1aee864593d3cd718097ab88362d990e031abd9c2159d0d58b22a0a97bdb6c9ff7b19bf63dd9f5b7f2f3755bced0ee5a9c4e27edda1b5c58ab1
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3MN:KIifqFu1//IifqFuyDA54GX79lSqS8N
TLSH
T19B154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 862KB
SHA256 f7ac0a8dd017ebdf180a83ccdf0437f9f6b542dcbd405930a97b8528f7192ea9
MD5 b524437ccc9d51caab458dba15e2ede4
SHA1 8cc51ef686314d83b63ef0e772a73c3f73d18c3d
SHA512 437bcc66d4ed3b5e01211885bd8690f33063f3b5ea81f21fca4a24721107c801b8101168e6dad4fb66f7037b088b24082bbe781a0c9e13d17ba17a00886e7b57
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3Cf:KIifqFu1//IifqFuyDA54GX79lSqSyf
TLSH
T1D8154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 862KB
SHA256 947a09fd5636f5464c61a28c3a7bf6fae01c0c0d67af32ae1154d27331515c8f
MD5 99a9b22fd16b0b0e2fefe25e87412117
SHA1 a98805f2060626a86f9bf44292e197eed3d467d4
SHA512 6cb2477997211f71cd94991410d5a54194359f3fd57f6fb56575fc8da3029a573391d0cbb95c30f30829307c52d7c73897c6dc58abfebda20f88ad7917de8de5
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3co:KIifqFu1//IifqFuyDA54GX79lSqSMo
TLSH
T127154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 862KB
SHA256 1cb11378fe528c6735b45ce232be9fc4ad1590f95c779f0ff78733f666d11a43
MD5 7793026802e853c96c88f128820fb092
SHA1 1e02f62260a4679b604d9cde63f54cf0381aebbf
SHA512 db136b5eb66e3b8b738791c556311b2613e226f8c47e1c2a0e1d95856823561e3d73cd95c29249989ccd6b3818425752085379c516cb67eecf69c934fa738e5a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf38u:KIifqFu1//IifqFuyDA54GX79lSqSsu
TLSH
T1E5154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 862KB
SHA256 5fe1a825678f1bfb33359c9fade3101af209be2893e54ee3a032c290d2f25b95
MD5 999f4d64a89019fc76e830d89cdc72a6
SHA1 1f16df29a2f082058d7519236508dc502d478d36
SHA512 f3a3e798cae28c441848c36c81a598ce9d2eb598db38dac2a01aaed5ce2425aca135c29d0ed5053431543b3823b80695ffe5b30d467de55b64fa67c1a526a644
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3A9:KIifqFu1//IifqFuyDA54GX79lSqSw9
TLSH
T1A1154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 862KB
SHA256 94cefaf5eec39d472e316965cb5893e80054af9e59eac7c9d06c1f61a3386ebb
MD5 fce3c47e6d040f2c1759a0d4aa9e99d3
SHA1 49876c32eb543cb58021c5822a91335c9b2d1302
SHA512 8d329b99fb11b8fa9177c3a941649f4726d21482a17ab5f510832aaeb963cb6ece74747bf84537c7d92a9d21a620c8a25a3e6f879c73ec7882fb9ba539f75997
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3Ic:KIifqFu1//IifqFuyDA54GX79lSqS4c
TLSH
T167154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 862KB
SHA256 84b20cab4dcdd53c1c1ca92277ed76ebc5a1a2fed6011028adf83953cf2bb620
MD5 48e472e17f7b06dc582551b860a40555
SHA1 e99ce2a876750ec4443c74f2b89abb9259ae8ae8
SHA512 b7f1659936936c6016f1ae06cb843e363a02c2d955f382811bb29ce59b4b8e7316a8e25fdbfaae19624e05426e36ef8069f0833428c8de9ef5f2cedb5661c341
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3hp:KIifqFu1//IifqFuyDA54GX79lSqSRp
TLSH
T1E1154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 862KB
SHA256 0546a03e4ac62ebf4a672a7a8e64f343fa3fd8b241979640a4e848b05223bbb3
MD5 88ec3c512d81365d994ce233ef1483a9
SHA1 f7b7dafbdca42513ca7589d8f7f676c92e26cf26
SHA512 b7ed1cab6bc97222628de16361f8314650904e0a1e8200e78eb677068e02c97698d5dbfdbc87d59c135bf7bca45e03dbd39164e140f5d552c3d7575cca810905
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf320a:KIifqFu1//IifqFuyDA54GX79lSqSmN
TLSH
T129154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 862KB
SHA256 6a604c910be3d41a0e1c94d90b0fa38b1f74a86cdded0942a19e1e4111a513be
MD5 ab12d82db2f69417c50655f1213b87cd
SHA1 5b50c993df1dfab90e1cf025897041d34b13f3aa
SHA512 ed9b8f29a3de760de5c9ee6d3b35809cb15fb1e7babec4f5646f6a0095dc266911e97e8a51efe05b071e88675bdac7a0cd222b8c787cbb820ef23deabb3393d0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf36F:KIifqFu1//IifqFuyDA54GX79lSqSqF
TLSH
T16C154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 862KB
SHA256 42a70a7948535a530e96ab1ba1e8cbd041b1988be3c0753260852485396c3872
MD5 88e5defe59389e76ece51bcbd9ebf148
SHA1 c83dd3cd05fbf196ab08ee58ac657c82b4aa73c0
SHA512 183cf80359630228ea116355ae88878e8f6e314b6ec7e157fbddbee793a76d56309c3c74b8e6f3b32e817fc13367fb8c48a5ff367115d31ee8abc078a44304a2
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3PC:KIifqFu1//IifqFuyDA54GX79lSqS/C
TLSH
T1CB154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 862KB
SHA256 590336dbb9c69e29b65d95c9fa1e914ae4914662ec3ba3825356ffbc62e64113
MD5 4414df4905c1c629b93676b78eb64372
SHA1 033e060462df5665ed3ff433a58bdc88d94e2e43
SHA512 4b20df1862cacd7f6f172c0e8fbcdf0f4326a4da1f599920305b26e7ac3ce2bdb72a0512f2e164d5a88cdfa5aa825f4847f73e76b6c65bac4837280a120da2ce
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3ww:KIifqFu1//IifqFuyDA54GX79lSqSAw
TLSH
T1C5154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 862KB
SHA256 20f3e6fea10891899fffd934de5e8fe82e4fef43678151ca1fc0dd98f7ae7e13
MD5 c8022cfe4f60f680f1ac79506118a349
SHA1 14d47ec4c4c545d4da9f42f34f77a32769da6f35
SHA512 672e129d12492608031dff93399f01889ca037cb033df73b652ce6d3da24dc0abd45da26cc6b0ba9455f8b7151fae542888367338ba1ef0f0423060ef0a4d18e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3PT:KIifqFu1//IifqFuyDA54GX79lSqSfT
TLSH
T1FB154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 862KB
SHA256 0dbfa040ee895dd947c609caca8cf6e95c9d5dd5aa9dd5dbc6069307b542df76
MD5 5dc1af3066dd43f830aa2a3fdf4f75a4
SHA1 20f3e36409ce24d9cb0bab3e684e39a49975e4cf
SHA512 afbf7f353389e3a4d5e3298952fac37ae811a348cfe6baa8d5c57f58590bec459f1d3ba80bed335281e64aa1f0016e28443766441b66b9c31905ae6a55e3f82f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3Ju:KIifqFu1//IifqFuyDA54GX79lSqSZu
TLSH
T13B154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 862KB
SHA256 e39edcd22fd474432c16560301b3ba0c0c0c6705837ecb18fb282e4d92008de9
MD5 fdcffedc756b198905c97b6dd505423e
SHA1 6d7df8609001eef15f098ff0b5e3a40310fb1aa2
SHA512 a07066f6d7f7b6aa368d1ada7d6f1699e98425adea06f07297dfc6230d47b0da9adf3e9984f1de8117421343f906ff3efa018d30d2c5be22e1dcf57d2ef648d5
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3Bb:KIifqFu1//IifqFuyDA54GX79lSqSRb
TLSH
T19D154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 862KB
SHA256 b9df3893c3f34494a926bfde3e7b62658a377e55e0c876ff6de05c7513042536
MD5 9237ca7491c5a6b257f8daa04eee1459
SHA1 db37280caa3e4f98fe831aa69101ee1073bc80d1
SHA512 0728d8e1b02053235a48e08df44af30888fa0971e11a4b341ec35e350352310df196f6c4baa1633c2c75f5b3845db608b445b9441ca5c75b12881475871e8e0e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3Jf:KIifqFu1//IifqFuyDA54GX79lSqSZf
TLSH
T1EA154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 862KB
SHA256 752a7be63695773b0010706a7bda03fa9cc9cde394ee4665e963d0b9a2dc2006
MD5 f4c3bdec7acf156d5450c8545ad72386
SHA1 c3311d42cb49cde579446f4bdd9323b277ea5d40
SHA512 a463523e6c824e9a8150c680605eec65323f91263729a056a79039c66704548abd71bc3fd61dea479e0371196d9a29986660873bfef9b70bd23bbb0e1f7198ba
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3yK:KIifqFu1//IifqFuyDA54GX79lSqSiK
TLSH
T16F154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 862KB
SHA256 d403c931e7e55940086e1d4cb563e48967c47194e57aee86fd8dad554c61bbae
MD5 6116714b77154873c0e2111c86f8242c
SHA1 bac7f125b2be6bbf197c87a0941f9098ddc41e14
SHA512 d40b589e57909035d6d5185845565a8726b73774d7772470fbc4c5634b9848c3612487a53960a912d041d6e335cf0da6ef51b105e442fa6d4a2e7a19688d4983
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3Xk:KIifqFu1//IifqFuyDA54GX79lSqSHk
TLSH
T11C154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 862KB
SHA256 8e931a2862350f4cc8cb99f172018f23e9e9563ecb1a063e31a1f159fefde801
MD5 133b7e3af98fbf3662e9910ce2919201
SHA1 36375a7edeff6561e6856d308085266a08f9456b
SHA512 6259736513c6b0fda16eeba2c8c15352c65c3a8129d28beb632530f84432937b99b0fcb29ab429e62222f9e329a42e6f7b7b5fd8e1f63abfaa3a9c072da63a0e
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3g0:KIifqFu1//IifqFuyDA54GX79lSqSw0
TLSH
T1F9154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 862KB
SHA256 619d2241c5ba3bbd7c29fb90e0137ab2e49ea6ae56712474bc1749d97f6a12ba
MD5 a9195c59a69d101cf599626ab15cbb41
SHA1 9caa47cd2a83f723bdd3eb821a0c6dfdc7e7f50e
SHA512 e77804c785ee79aa4ba00b388b0483a817655f518ed0b222859c1c2adedcdd21371b8ef7d007393da2f3b1c5d92161708200c5ebd382121c3ff683065f96fcdb
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3770:KIifqFu1//IifqFuyDA54GX79lSqSLg
TLSH
T1C4154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 862KB
SHA256 f1a5b34e9b696b0335961568d7a9a221ad3c38d5fe5c663be9670e188fa3cb96
MD5 92e8366f93ea99eedddc7e04db465fe1
SHA1 882fef83e80c9e0e97e6a7c44c1b1f8350b5a590
SHA512 e267f7d9c1abcc944d13d4c499c4c40cc38a1ef22b74d4cf2eed8197b7dbfeb2214b3292ad751e17ea970d3f0b18f3ba82cd285620e1c20f8e2caf82bcc80a64
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf32r:KIifqFu1//IifqFuyDA54GX79lSqSGr
TLSH
T150154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 862KB
SHA256 a87361850f588114fda8ad7153e988028537585c8ee4e4aae76e7b9a9f2a9ae6
MD5 c91c03c531e22124572a4e052e7802b3
SHA1 626729aa242206efb41032418c2f453f89ba2c3d
SHA512 6c80730cb6a811f6f97fa85922028dcd4fa75640794bab24d5780bfe8ea834005c4d015c4f64b881c15b38190e196bbcfa43405c40c6280bd208aec149ed6ad9
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3cn:KIifqFu1//IifqFuyDA54GX79lSqSsn
TLSH
T142154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 862KB
SHA256 8c88c7b98c1a408f7f048b107c9da8bf09cdfe630a71ed3066d0b2deebb4a057
MD5 3436d41fecb9ae3b6dbc44e0916ae950
SHA1 693e7973f7644665c5e74f5fc67c6ca94f485efe
SHA512 b95d83f4528885f200297fd0869e4d37d4660c213655f80a944c2ebec8634b7d853f5a45610285153e74e0cd405f549c3d1c3081950e85875cbc94ed109c7cfd
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3ax:KIifqFu1//IifqFuyDA54GX79lSqSKx
TLSH
T10A154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 862KB
SHA256 7f09f7553d0dd5ace9170484e51528e7b79e767c29388e2be2cee328a4af7d76
MD5 b7344377274359a06a9470a8d271c34b
SHA1 2c505e9f689acc199880d62a4d5663664c61318d
SHA512 afa39d108c8280b79068dd52830f53e4bdf87ca32546e5172a9d13d84ed0b7be9aaa350e32d8ead2c94b6a41b5d1709b6becdfe514f03bbad4b04850cb5a2121
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3cA:KIifqFu1//IifqFuyDA54GX79lSqSMA
TLSH
T188154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 862KB
SHA256 6aa58f99b6e2ae07b7358d553e90787703fa8a2426c499011cd0d2d8628437f7
MD5 1abd7084e1d8aa04c4bd574826ff083e
SHA1 cc30232ffea4ee074aeb4bb31d688fcb0f47a5c0
SHA512 a71aee88699d10be3673084976a5e838dd23ca55cd7907d93ba46688491eb6409dac5e1abb12b0ad6b218681d1b2a7b5611d135d2a32a3df078050a042983c36
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3F9Q:KIifqFu1//IifqFuyDA54GX79lSqSV9Q
TLSH
T160154B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 862KB
SHA256 fd4f17ff14ec7520a067c83650e356f9fb2cf9160de9b5497207dd5b77766a73
MD5 ca4b43a19cefdbe4f045c61ad518bc36
SHA1 0940b6ae2add9736e6545a892f291a17d62d5454
SHA512 bd8da7168d62ec99d5c29ff1334469cdd158899a1ab1c54b7f30db03ae483cd79b50641a2de48d5931ebdda3d02702f2ce227c3c0902af25a0fa577852429fa3
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3w4:KIifqFu1//IifqFuyDA54GX79lSqSg4
TLSH
T103154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 862KB
SHA256 4ab4ef53fd29f940476606de52e85ec0dd1130bcc640196b98d7d0d2e7ec34b2
MD5 61209e07eb086ddeea02aec5c7dc0f6c
SHA1 cd16225ffc2c91a9908b9d7cd7a4ec4bfffe1fa3
SHA512 91ab0b4b7952ed116d2c590a5a4a129f0eb37c18a8f95a67e2bec8249bc050aa22963c02c3377ca695176acb45b0c47b2047c25d1eef420012ec8de21c173e6a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3zu:KIifqFu1//IifqFuyDA54GX79lSqSDu
TLSH
T13A154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 862KB
SHA256 e603e960a5a1edee45417f3a3fb1d0d588e065ebd89ab83f94216f51a5d38dfb
MD5 742a9e9dcaa0d00d5625b21425d2dea5
SHA1 0977bc580972cff58c607fbed3d2bccc48edd460
SHA512 403108e6c6ca8cfa1d3c7fb8724040ff1b2c6cbce2506c9112cf8c5bf8ee7c224ba19d56bdf59878d5dfc08a859319016340a2b836d981fa7f912f1da0a8cc29
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3uj:KIifqFu1//IifqFuyDA54GX79lSqSej
TLSH
T115154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 862KB
SHA256 195ba8decf18b56cb0baf9d8c62f95a653ade50b2858020c70cf828b7469a9fd
MD5 87e6e4136fb352e3c2c6d216f2dda03b
SHA1 861e63c9a6829214726729c0881a893ed22010cc
SHA512 85a5637c74e5ec7ef8d32c03f12e81855eca3f029c69824f1608cc4dfb84e420c46ab4c90d805bee9d31d1142c43d7f85b05c2f6701fcb21e85adae044d6ff62
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3bg:KIifqFu1//IifqFuyDA54GX79lSqSrg
TLSH
T199154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 862KB
SHA256 8f5079a1f176a5bf308bac2e7db68f0ccaa962071487696ddc636921e8a7d5bf
MD5 5a6d1781365d775e5a549e354dc4e9d7
SHA1 769aee48a75fba47da6815a97934a96fabafa647
SHA512 2c669f2fe99773f1cc4250322a5c34c7f31519b1e6a354c4af4f9d9cd68fa9b0d9df288716de8a0ebaa09a4965349d707e3a97e07775cc5a3d0fcef28d86893a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3GI:KIifqFu1//IifqFuyDA54GX79lSqS2I
TLSH
T114154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 862KB
SHA256 7cb385a07386b292e02d99dd348ea977e09b2e60a9ee67bcfc316fd7e32db85e
MD5 36300883e66c2e548791537b73e4e37c
SHA1 f79e8321a2d4c423699c728dc9947b6461e00fbd
SHA512 27ca70899447049a90e046d95a1cd64aedce1f52d51c40ba6b0b5bab06c821159355952c1b4622253e7211ab593133d14c1af23419bf890613584815cb7f86cb
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf30o:KIifqFu1//IifqFuyDA54GX79lSqSko
TLSH
T103154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 862KB
SHA256 9cc9a5b2299c7d05d853cfba41907fe91209a17b920100f0fa2682a7c105d8e8
MD5 deee1a24321d757111486be844a01300
SHA1 a131bc60b42c4629e9089abedd8eacbf2c77ffc8
SHA512 de7e9c21f48f49eef9591e570c3a8cdb8c73c97bd966b60aa9c0b0e5dccf98033cb57a7b2b982aa33eda422440ca398602051e486e6220a6b2028bd97d555b55
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3X+:KIifqFu1//IifqFuyDA54GX79lSqSH+
TLSH
T178154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 862KB
SHA256 41e4d9bbc1fe395b743fd19619100b30e127ddda060fcc85ad13359e95db39ae
MD5 6edc1ac5189743ae22739058deeed9ca
SHA1 fc415692c5dd9aa43231d867442d8df461cbda7f
SHA512 897a09e10fbd85ced22d85b83dc4adcd83a5843754aa2f7f6688dcd276a8c7fc0d61dd41f90eb40889dd1a30e9233edf0fed87c5d3a8398b8e21ffa2d4e6e025
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3tQ:KIifqFu1//IifqFuyDA54GX79lSqSdQ
TLSH
T1B1154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 862KB
SHA256 68b7783f44dbbb51921c0435962d6a01b1bcd8aa4c07896fe0ab9ed8d2d27761
MD5 3235390c53f4befa92da75459ff9d86e
SHA1 452da03abc227b3367544834b39932bf9fb9fc18
SHA512 f7ba5bce041bd1824a2d4fa101599d84275bab85f34a63fdde0a47e4dc746b1d7d11b3e10e3f95e3e9b77bf964095d5d02b5b9a9005ec4056b69818e55802fc4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3iX:KIifqFu1//IifqFuyDA54GX79lSqSSX
TLSH
T1E9154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 862KB
SHA256 52fbe245c49917358a793be60a1a6f2ad7fee8aaa98eb4fb10080b44cd2987c7
MD5 0cbb0152331d4b350540e9ed1bd073b8
SHA1 c15be253e7c9eb0213a2811962c38121a408e835
SHA512 b8fad8baa6af03f48f5f11d569dbdc9a5ea654df366d36e0cafe0bb5c30c4ebba374e87ae39353169a9d652edc22aed4658412888ee8a4e7f4642d54cfe23c44
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3EL:KIifqFu1//IifqFuyDA54GX79lSqSUL
TLSH
T1F2154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 862KB
SHA256 713d1b18b8d2e8dc24096bde387e1ddc8c58e9fd6aa2b7c4351ed0dc6a28f77f
MD5 b442fd388f3f502d9f20bcbb7ba58924
SHA1 e75911daf899e145bf6333c246c1eb312ba2b2be
SHA512 8e606e22870639373600f8e6c11e199e80d7d824df42cc6f101fd86cfd07646b46e2d4705b087e2340497a2a57dfc8c0d1359d742af884489e88fa5d34f1f748
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3gFC:KIifqFu1//IifqFuyDA54GX79lSqSwM
TLSH
T123154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 862KB
SHA256 076389530231eb22c0fcb8049b23b286636c09fd657efa9a137f9d2df3c56cb3
MD5 f94510d138059e1aa367da51940074ad
SHA1 20af0303e794508739b4348ee8ca7c10af5ff964
SHA512 f7f67ebfc9f743a42533ac663c2c7d38acada2825b78d565d347fb21fba157268762921117b051959994fd8aa6a8463f9778eb4206f5dbfecaf117fb10795e37
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3Bh:KIifqFu1//IifqFuyDA54GX79lSqSxh
TLSH
T118154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-2088-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5196-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5196-2051-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads