bf4a5f332f9831f8985f5a0ddd5d7cc99ce07882917be73c3f7eb2f67a815121

Analysis

max time kernel
94s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 838KB
Sample260803-t85cvsv1ct
SHA256 bf4a5f332f9831f8985f5a0ddd5d7cc99ce07882917be73c3f7eb2f67a815121
MD5 da8d6bd27f42b3a5cb03454d82694548
SHA1 8e990abca03486d797590352fff8d45c82089681
SHA512 bac87021725dd35fe2490941f3d464c08dbf63f8979bdc69ee1741fa5aba28f37e7404fa52fe8f14e3e7566fb779b71b24546aca0f562562933de0792191f67f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3z:KIifqFu1//IifqFuyDA54GX79lSwjD
TLSH
T1F8054B06E29204ACC55F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6760-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c664-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c661-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-45.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-432.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-597.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-713.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-738.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-818.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-970.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1315.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6760-2051-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2104-2088-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
2104	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6760	2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
2104	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_da8d6bd27f42b3a5cb03454d82694548_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6760

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 838KB
SHA256 bf4a5f332f9831f8985f5a0ddd5d7cc99ce07882917be73c3f7eb2f67a815121
MD5 da8d6bd27f42b3a5cb03454d82694548
SHA1 8e990abca03486d797590352fff8d45c82089681
SHA512 bac87021725dd35fe2490941f3d464c08dbf63f8979bdc69ee1741fa5aba28f37e7404fa52fe8f14e3e7566fb779b71b24546aca0f562562933de0792191f67f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3z:KIifqFu1//IifqFuyDA54GX79lSwjD
TLSH
T1F8054B06E29204ACC55F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 c3ceb94d750af79e5752b29ec88999bcc08648de43adcbace6a92615c2ce7a2d
MD5 c69215dba8fb1be4667e7b1fdd7d3e05
SHA1 53ba5bb4aada0275cd532b5ba5219eca77c3a4f3
SHA512 5c70063a54fe362d2b415f7923da9d00295fe42255015dee6c83c54c1225c6b4e5fe0a57f1ed2dc1d3b13dc37e03c8233038b07238b0006d02a57f7089d300c1
SSDEEP 24576:KIifqFu1//IifqFuyDA54GX79lSwj/0Le5ji0hmxNrM:WqFgqFUHjPji0Aj
TLSH
T176653A16F2A44278C02FC075C7D29666FA73785117F096DB13D4E63C2F22A919AFA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 853KB
SHA256 3b180b611830348aa18b8902ccd1a3597c85415771eee2f9ecc01b2d6945b1e5
MD5 39604ba35ca5d68d05259c7e201b68ed
SHA1 96a714cd1ce2a3f07016dc2f33986ed0d8f4cf09
SHA512 667e082e6a7a82e485824bfe81460c750c6dfdf3baa0e84d63d11b6b94a1515fdcd0281f9da51c5793d9386a3c9a5acf7f440bdac1b57de773da431dea53eafd
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3xa:KIifqFu1//IifqFuyDA54GX79lSwjha
TLSH
T137054B06E29204ACC55F8130C7A65372BA73BC2156E0A76F13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 862KB
SHA256 ed72aeae5190f0252a3dcbe2bf6987e98d58e07ec0ba501f9fef8fe23701932d
MD5 5d3fd380543c864b1a2ab783e4c5a61c
SHA1 bcfc050b871b11e319c92f7fd2185d0940de0d43
SHA512 8930afdd1b38ec50600aaff53e281acbaab5f4d485be87f4e6e16299ad2cc4dde59f3efaa96515118269c70e733255a3673792283770f301fd43b82e400150a0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3I6:KIifqFu1//IifqFuyDA54GX79lSwjY6
TLSH
T162154B06E29204ACC51F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 862KB
SHA256 8044147290eff51ddb3803d4ca4e112afc3537231139695d8642216b91df638c
MD5 7b585fd972f935d356e7e2bf05357f25
SHA1 af954fc56d8932bd12de960f766829591b4f7390
SHA512 99aeca9c2f33a9f8ee96dc344e373291f415022da59908547ef1363dad515c993ddd5086e3756b696237a75b22c464ba61ff514e60835b49903a7fca264f60b5
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3MN:KIifqFu1//IifqFuyDA54GX79lSwj8N
TLSH
T1BA154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 862KB
SHA256 73ee409ad6dd12f17d4c1064aabcac06322cb941ce1a33787cb470c2ff7080ab
MD5 2059407f4ef7893a6783cfc6c84c0b63
SHA1 b08309bfff91877bdb1d064799a223527407475e
SHA512 341c1672a77ce275366b2eec4d73c8c340ca1919cd9ade5972ac4a8455f00908ab3f04e8416d19c39e92456c251bac785129b8243a49f95deb6a99090988f1d7
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3Cf:KIifqFu1//IifqFuyDA54GX79lSwjyf
TLSH
T1D6154B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 862KB
SHA256 a309548876e382fc4a39f3244db0c60a1e60f0eba9dcfde298b900e23c3b5e68
MD5 14daa714287c6a0a214765256771a5e7
SHA1 4dd4ec092349a8aeb87c5e812e3239ed1d6faf5f
SHA512 b412900015ed18ef4101f348d8144b04af9536d715e99c21d4e08e8fccc79d6bc0992731950b0eff79fd82e632f4879249667f3dd909b61207eda6348b21173d
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3co:KIifqFu1//IifqFuyDA54GX79lSwjMo
TLSH
T137154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 862KB
SHA256 208b7e84317fa17a9b01e42df7e044ec08fe151ea2419cdc39827b6800568f7a
MD5 8cfa444d1177820dd9aea650a94c39f7
SHA1 25032371ca1de34584dcd51e9f944bdec5737834
SHA512 22ab5cba3a7ffbc0aaceee2264e641e8f618395cf4e5cc022b6eea8d9926e885c568077829070780ddc685fae9468732037a7c2fb949f73e73464169578effc0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf38u:KIifqFu1//IifqFuyDA54GX79lSwjsu
TLSH
T1E4154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 862KB
SHA256 17176dcbe4b5a9ccf92ac1e9e58081dba752eec0ab9bda2e33a428d7392b78c8
MD5 5ade68622dc4d532bbec7ec6f1cf55b4
SHA1 73d1a50f2792c43cb70c1a7facdd7908048af1d1
SHA512 9cb4a477431a5f3883049716e3fb4d42857a1a82a16e969295e185897174458063ddb14dbf25db3302cbe89413cc21fcb73f10f699919815ba62cf88dd5ebd9f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3A9:KIifqFu1//IifqFuyDA54GX79lSwjw9
TLSH
T1C8154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 862KB
SHA256 443676dc255d4210da7c9e397182c9ab2e7b08af2f6745c1b96d00b215b41c1a
MD5 0e0d230ce4ccc88233b371da49380a65
SHA1 4271fc517a8c4f208bdf80d911827567754ff660
SHA512 8b619a665cc513dfc5fb6f01953ee4b0e8954ac58ddb0f393afaf6734566a21089b8493cce5eb76e2b8a84421869d1f95f65a5215fa738f05cb85973d5bb8255
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3Ic:KIifqFu1//IifqFuyDA54GX79lSwj4c
TLSH
T16D154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 862KB
SHA256 71eceb29a5cc93b58493e46b49bfb8b83af67599965664413d8e0225e49e0e77
MD5 87c0da29235d1becc88b9dfc9ca92c0e
SHA1 0d22203f0e62cd2e1f2f8893addff24864920683
SHA512 ea71b8cf463171ab477ce1ae26024fdc12f6e0f84a3078f105b79582c30c073baa1d127d7bc782014899949815cad3f8347d9865a26a03312daf5288eaf0827a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3hp:KIifqFu1//IifqFuyDA54GX79lSwjRp
TLSH
T1DA154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 862KB
SHA256 232eb4de95e0bc9939b01a4009382ff240cc739458935c271cbd641f74c681da
MD5 0188d04931dbf890910bd5835458ec0a
SHA1 a167ed478606a2ccc5cba21defde4b5e821497de
SHA512 383e4ea33b520abbc194d0dbf9a6c461337ff1f525b92cf4c9844f18bc4afd209d85960c2e4683c4b4c85fb0597cee74e68526c79ab5bcb13172d78de87b1ff2
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf320a:KIifqFu1//IifqFuyDA54GX79lSwjmN
TLSH
T1B9154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 862KB
SHA256 79ce57c6b6abd901418446dfe0c48471bbdc74ff01ada3df248b41adfa3652f4
MD5 cd7c59adceb7173d7a2336092b8885c6
SHA1 029c57a4f07b8bbf4ebb5ad933ddf1ce3c4e26e1
SHA512 908782d9d9e24cb163177d05a52c06e163242e99b0def3a11fcaf8997cba993c591bb76c19ff23a98a8744efc965eceb5923fb3fe5c698f2a5aefa9673e51e75
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf36F:KIifqFu1//IifqFuyDA54GX79lSwjqF
TLSH
T1DF154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 862KB
SHA256 67c2f892d0cd118b827ee9ea2f1efa77bc44964f8c9b002c546542339516b184
MD5 08feb78eba2ab4d06cadec0fe93c564c
SHA1 ba94128c5dafa4a4d55aea1431f6282ac6011f82
SHA512 d9191a4c0893c8187c3c27469aa3534b79eff6c1f70bce8b94851224b450c785c8435148059ac4aea426c9b0298c784bd42ae798a306fa516d70bd0a500e48ae
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3PC:KIifqFu1//IifqFuyDA54GX79lSwj/C
TLSH
T1BE155B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 862KB
SHA256 c198daa24780b4fc3c5b38c6184525745fb85c97231606816c410f5fca705737
MD5 8f673da1edc7d4ae09de23f386ba276a
SHA1 b5af1311db380469bbd50331c59c2dde6c204087
SHA512 debe3db744ebb65962474eb8c22b37d5a998bec5d82789c308832f5f735f0c418e9d36009eaf89dc72bad4c179ca1e99e07b9babc653e7ea7571b861aebbe0f7
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3ww:KIifqFu1//IifqFuyDA54GX79lSwjAw
TLSH
T151154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 862KB
SHA256 0443db5c301de18b343fa12a8eff73e5c636f4dcda5b1f10d528305e09a45c32
MD5 c817c6d01ffa5ed238d693299f01099e
SHA1 fd03f3936f72a95e927e446b2f99ab4d9493531f
SHA512 f619942d4b23b1bcbcb4b6b81fc0113a78ea3b99de882f088c28fd98a59e2c96a072f911e6e542016ec01a9b5fddad7e65074b352d91b53880458936b4d99571
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3PT:KIifqFu1//IifqFuyDA54GX79lSwjfT
TLSH
T10F155B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 862KB
SHA256 5dc4e14ed9fc4aaddd3ecdd5e0fd304ff04172e146948f983c33685eaaa8ab04
MD5 f78c639efed97366570b87458cbcd475
SHA1 4b6d7bfac9bbd16d6fec63a306f40043361232b9
SHA512 7f17d91eb21fe6ebbeff77c435daca1f745841fe5dcbf5941272888905559576131b1be50466efa14bd059f681c17cb9fe8271b5bad820a9a178f24185c7bf23
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3Ju:KIifqFu1//IifqFuyDA54GX79lSwjZu
TLSH
T1D1154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 862KB
SHA256 c86884e800bf32de59a28b596f645dc1fda6196a3c90ff6825a0fb8e778004c8
MD5 a4fb92e773768853f745e599e9a884e6
SHA1 14236f6b99e50535222c2b2dc1f95f18eb06a87a
SHA512 e789cc0c5e29ea2bafcc4c8b86e62e4b997bc84e43590214d7788ece8b7eb02878fb48e33b88824b0c37c5415dc714c4431703893cfdb1ab0be7458db9970e64
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3Bb:KIifqFu1//IifqFuyDA54GX79lSwjRb
TLSH
T15A154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 862KB
SHA256 2050d4288229d57a8e5dd4dd29436dddcc0a6d10f8a8c64a1e7de72d39f349f6
MD5 ddaf70484200a3a3ddb42c0fb2bcc309
SHA1 a361b64dc0cae9d0a154695ca6fab302205c4969
SHA512 cbc463c7e7f3cd6e65f1a3dde9dc26bf904aeb678d6bfef426f6db3a3a3fc12818ed8f16c379f373aa2b4708aa511318eec3f5877843c5c5486411ab145894bd
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3Jf:KIifqFu1//IifqFuyDA54GX79lSwjZf
TLSH
T1A0154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 862KB
SHA256 ade1b33ccb768ea68d572e99208890832a182710e4ea46e517f74a31a4842cbd
MD5 de10189aa241df1b24f56a18dd730226
SHA1 5628023a43102a2520fb720eb786f682dd06c2d6
SHA512 abe82955d4f250db2e2ecc21b9e45833af3994813fcdac10e7c33733132d9c1b7895abd3533ac4a44a6fb658c743fbf68f442dfd0078ea257f5d5c63e9d64147
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3yK:KIifqFu1//IifqFuyDA54GX79lSwjiK
TLSH
T1AC155B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 862KB
SHA256 c3bf9a79a8caf97163c6cba7e06d87d540827be2da2f5786c1a5c9bfebbb7340
MD5 59b101b81a4904eac356a97c138895c4
SHA1 0656f082d83e8052f76c728d7b75a34effb795c2
SHA512 66815d34f994ead2dc7974c131d4642a11d8ef0c257df12f7923c645dc1f5b31c7c197fc426f991f295dd767144ebc7588adc84a26d9246a97c58191a194a5d5
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3Xk:KIifqFu1//IifqFuyDA54GX79lSwjHk
TLSH
T159154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 862KB
SHA256 724ec8f0c38f722659f3e13501cd8c7f0cec5c0faa0c816e1615d3cf2c452b7e
MD5 58e4ffa11e2b54fef18cbb7bebc39f76
SHA1 0c6bb56b4e0253e32493e1651e656ca9b38c923d
SHA512 4324f9e68be10503b12b966a37b267fd303d7a8a175a1e7c72c2b8bd6a3282b7252455b1ef73cd880c109ada52b75538126326142417139b3ed0ac2a3f9ec31c
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3g0:KIifqFu1//IifqFuyDA54GX79lSwjw0
TLSH
T1A3154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 862KB
SHA256 2c973fa42399cd90bec6b081b3d8dc6c622dc13bb0a98329aab583ddd2c6f4f7
MD5 c7f38c7d435fdb54b042eb8e27ce2c7b
SHA1 30a250aeb178eaa09ac33951a3c4df9bde005ce4
SHA512 394e7eada9449ab95252cc83601ed0acae0864a325f59099a3e6a67ff785e43ad69af0d2da0c7bd63c253ac9eab0a63cc2d1f5530d0379d52e0fe1906c8c59f6
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3770:KIifqFu1//IifqFuyDA54GX79lSwjLg
TLSH
T1CC154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 862KB
SHA256 843ebeeb4895060ea7fb50e5409c964cc5f29c9b60c990b572adc63135464883
MD5 4e16d9578a807733537b983f4a4f8684
SHA1 7bebc00715c0ab7fa41da2b0adc5057eeb2bedc2
SHA512 efb4bfefe5ee4fc0dbcd6098faf4c892f1792165e19fc3f99049e178b29bd6cc34a2fdd07b16f79a93b7d5c0018c996251ff31b8c292eaf385ddf016ca14f76f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf32r:KIifqFu1//IifqFuyDA54GX79lSwjGr
TLSH
T138154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 862KB
SHA256 1b1501512904fc9a9fb118036e8291e81507912d7ae666e476d97ad850588040
MD5 87b4496cc3d9238b4f78b0e21dd53a32
SHA1 61c799f55d741918e429716b7d092a50370c4664
SHA512 09ffdbcace552096fd230694640d4078de7f634d94dd4760dc8df70f9060683ca8992eb37ab3db6c8951543bfe2ba340d82c10775463c577b75a32f2d81c0635
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3cn:KIifqFu1//IifqFuyDA54GX79lSwjsn
TLSH
T12F154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 862KB
SHA256 290103c72fdaddebad83c631add4c6967327a1852b4faf10ce969427041dcf4b
MD5 52a8b6ae39eccb55d11d8e3ed71f7ee5
SHA1 008baa47e0e1ef0378d0b2f9dbd6097dd045e150
SHA512 b37d661ad59d31d7fb8a8ac7f57f6fa98eb53b30ab47dba2b21f9854fc3a7230b422f4c14a5bc97cabc901ff74ad507dc13128ee8cb163a857b6b4b5049f5cdd
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3ax:KIifqFu1//IifqFuyDA54GX79lSwjKx
TLSH
T14D154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 862KB
SHA256 0c17e9617c3821a046b46ecb1e9ae56b21a9f89f1198b95833873bd33c2315ef
MD5 604a28df606c71203efca50390cc5942
SHA1 60c15e3d62176ed7c81027f9a7bb1ee8d4df7862
SHA512 feb7b96a439d0ba66e386d7d077f6a9830b86e2f999ba2a9a32c1bd320f94f679e948207280f757627e57f0eb0259dd31711731fbca0263bf3555ff73431db61
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3cA:KIifqFu1//IifqFuyDA54GX79lSwjMA
TLSH
T126154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 862KB
SHA256 e7dd4f12b19635c2ed7febff493757aff0349a4ba1cb5308b5240f03f259f922
MD5 17a62d5c798bd935df14e8e6dc776ae0
SHA1 dc1db1d75f13fc505139bafd3c0aae35ff9a2195
SHA512 ed4b2d7098072a04492ee55f774897e05e46e63fab5c98f67e396f63669a877b495de859e7b78e55883c9a2de7bc38c6d6b84a85ec4daaa5c67c74455acb3285
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3F9Q:KIifqFu1//IifqFuyDA54GX79lSwjV9Q
TLSH
T15F154B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 862KB
SHA256 8867ec7df7683caf70677fc5915ca4c4d185ef053f355b5701378675b31740c0
MD5 f2315897b937a1c7c26db788abea97f2
SHA1 105ec516207da4b22978533375f956e9547c98ce
SHA512 51076d990443c0fb7769278eb4edd59c7698213921c13089f6f3e489d1c32426dbfd30da23a756f7f8f9537d8de8cbe71735ebd5060fbb52a634c812c84cadeb
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3w4:KIifqFu1//IifqFuyDA54GX79lSwjg4
TLSH
T1F0154B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 862KB
SHA256 bffda47ead76bb6a604c9c349fa4c1af15a6e58eff002d4eaa2e2015a415b154
MD5 51d0ecd069e3e694289cc8f459446bfa
SHA1 269a2261eb2312af261da9897265b550b189d33c
SHA512 dd354ce76747fba4fbed427187624c5bd5899bc2d3a28c574f648d2c53cf4575d06c3d0325afc6c2a9f879d6f3fa646ce1cc0343da6a85ba2804393daff2f5d1
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3zu:KIifqFu1//IifqFuyDA54GX79lSwjDu
TLSH
T145154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 862KB
SHA256 fb5ebfcdf2e6813b10dca6372ffbb681bb5600ee6d8d4d23afc7fb67bbba62b0
MD5 9fbda6267a19d16135626a35a1394747
SHA1 13e38a400f40a02a489b2a38c75c14faeab99716
SHA512 4fc41529a425f1a0f9836704f26c2d500da142a186092fa0860d2e590c83553895a6da4f88733462019f820aa8d03e49b781cedc4135d3a0df201ffa9aecc25a
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3uj:KIifqFu1//IifqFuyDA54GX79lSwjej
TLSH
T15B154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 862KB
SHA256 5ac12eeedb9f44b4840b4f853eea9801d54d2f74a52482c3d1592ffa4ba3ffc7
MD5 a81d9792ceee076576da242d00186c23
SHA1 bb9a09b296e92b382ce7c620ed7a9ba024b40a0a
SHA512 f60a87f5255d859ad0730bcc0242be6706f58286fc3e8ce97291285efc53e98b81eec2b1ec4f24a07ddf621d81df0df3044983c7fbe0d6030d2f274bda27d412
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3bg:KIifqFu1//IifqFuyDA54GX79lSwjrg
TLSH
T13E154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 862KB
SHA256 015db249a0fb338abcaec489f4134588a6a20f0b4418dbbdd5d06925ba4272a4
MD5 40af827cefbeb02ed9f76c944f7b568b
SHA1 3c0de0844394665c10c967062ca8e225ccabd944
SHA512 844c5d854be4b2c2578c5c4544075cde253081a7980459111360c1e91d18cd752dcc6d4b94c8af8ed179320867b3ca501fc6f621097f100c0033e712e2786f1b
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3GI:KIifqFu1//IifqFuyDA54GX79lSwj2I
TLSH
T1D4154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 862KB
SHA256 d43825d08cf5db20a05bf77486100af3fe0a59fc19f8dd9d5b1c96ea15de7ad2
MD5 c6e30c6013d470657cfc89f4e614d3ec
SHA1 149b6e933a735fa7ab4e8cb8f0f89bccaa4bf7e0
SHA512 39bc0af2c754f5f51bd4c4291e391e5b8c34da8af741c9c9ebe838f6330bcd77606b1937d50be8395b9e1c9f4ca43b4b7f639f591e7094ef1a024c73bdedbf38
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf30o:KIifqFu1//IifqFuyDA54GX79lSwjko
TLSH
T178154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 862KB
SHA256 c697ddfd0bd7cd46cd83a96beaa66998c0fc88e6ebccf27674886e8599a59141
MD5 dcd16d7d9a0fef4b6197d92b1eff3bfe
SHA1 b26f701bcfadcd4bb47dae4ea7e0b535e288854f
SHA512 4472ea84457080b3f51c1f2884149d5039f32956b8a93c9b58cb45e837312eb82325c17998fca934a2813642f227a9175913917c447aa6a3ffaed9b673e9d16d
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3X+:KIifqFu1//IifqFuyDA54GX79lSwjH+
TLSH
T15D154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 862KB
SHA256 52e83bcad91a9143b4a2930127d4d13857d742fdc34bfeb38a85465d23573d29
MD5 eb1ad27deb54d4cabb00cef3d7160d80
SHA1 97aeff4993f54f53a702340ec5841124f27ca95f
SHA512 c512af087d1c97de24e64f3c59e74b69ceb4788ae36b55be32d711c5af29294cafdc1b0e3768c0c23665c7a826c3f3dc6208239c1c375fe50aae189bc2ce487f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3tQ:KIifqFu1//IifqFuyDA54GX79lSwjdQ
TLSH
T15A154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 862KB
SHA256 2e071cdbcc2edbdae2ddf881799b739898503b56078e7820c0e9cb445a27f555
MD5 8044ad6d404860f7d49d9ac2545ebf54
SHA1 b17fdd7c1738a1749b9783838e09b979aef5de3c
SHA512 5fc76b4b6bea0de946c250634b86bc6c0dbfb352c79a1d8298cfebfc29ed126b04cabc800c79828f45874509eb6ae3ebb786a735e182183597f654895b01465f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3iX:KIifqFu1//IifqFuyDA54GX79lSwjSX
TLSH
T1C8155B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 862KB
SHA256 3af2153674895473a9be4ec5b7eb1d192c0ac5ad413535a8137d774f3a4142ea
MD5 4f3340e2348a7d95c36a136f6ae3e1af
SHA1 89ecf9e3c009f537362d39973f299890b87af122
SHA512 847d493df30aeb2cc950baf33cba33189c4d94ae9e40810031c8b127262b45f433a06f7666c039703a800e9b971155e4616889464bcb37348b4c481b9129ce70
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3EL:KIifqFu1//IifqFuyDA54GX79lSwjUL
TLSH
T1B7154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 862KB
SHA256 f466b948fe803503f60d3d5cb0ad25e065e81c868287f958bd5bd37852bcadc2
MD5 1cde16a5fd0a26d362920c823caa2281
SHA1 0b96680d849b8afe89b9dcb2d8848ba0c53b9f24
SHA512 da1001fb07a8f0897d12d20afc044dd94a7c5d8ca0c911c1981f1d02e3cb151a392481f18842ec1895f9b9706914eb147d4d8d7a1641d879f9a3614c2531a2d1
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3gFC:KIifqFu1//IifqFuyDA54GX79lSwjwM
TLSH
T181154B06E29204ACC51F8170C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 862KB
SHA256 a13ba3f69c48cb3325012ca7e5f59916e6f19ba13bd89e0f2381aa9db4a8b601
MD5 374387d968e47c54f4f1125640e5613c
SHA1 180aa3a6ebf9e16e6d0c835dcd35d312edb5924e
SHA512 4b01611969097ccdcb25265a44996211cc593ef0982f2b85b1a8613aec3fcca9df2c6ca902863ddde1a8996f445962f230032b14de4922ef244f78bfd332ad30
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSwIXsf3Bh:KIifqFu1//IifqFuyDA54GX79lSwjxh
TLSH
T1FA154B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-2088-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6760-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6760-2051-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads