fc2f74101d4d4e2ff58994b03a95267c54e1e45892e176c5b0d8195cd97f418b

Analysis

max time kernel
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 862KB
Sample260818-ay45kaef39
SHA256 fc2f74101d4d4e2ff58994b03a95267c54e1e45892e176c5b0d8195cd97f418b
MD5 2ae23c274dbdee9cf1310fec2a8713ad
SHA1 298074b60a45a96fa4016a79a20b3efd5b91fd63
SHA512 37fd41878a17dc1c923bea19b78f79be8a912d5161d9114a8dfcfbe0a09f72ca823b5f58da570bb125b58cec89f64b520653a55b0c21443b8bee2271325e3b54
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZF:A3k03kB56ro
TLSH
T1C8156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3324-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4be-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3324-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6124-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-480.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-596.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-706.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1102.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1293.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1349.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4be-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-59.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-225.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-480.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-596.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-706.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-787.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-914.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1001.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1044.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1102.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1139.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1293.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1349.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6124	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3324	2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
6124	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_2ae23c274dbdee9cf1310fec2a8713ad_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3324

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 862KB
SHA256 fc2f74101d4d4e2ff58994b03a95267c54e1e45892e176c5b0d8195cd97f418b
MD5 2ae23c274dbdee9cf1310fec2a8713ad
SHA1 298074b60a45a96fa4016a79a20b3efd5b91fd63
SHA512 37fd41878a17dc1c923bea19b78f79be8a912d5161d9114a8dfcfbe0a09f72ca823b5f58da570bb125b58cec89f64b520653a55b0c21443b8bee2271325e3b54
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZF:A3k03kB56ro
TLSH
T1C8156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f0b5572b5070cb06a2318e44558c1eeeb2cb914581c2e03fc31b398b13c38e5c
MD5 0e105793037adb21626c5eb7f2846455
SHA1 ce759e9ed423890aa3e70abeb6c82a6ee33eee1f
SHA512 75b6f142e548ea45e0163512f1be6ecd8f11b1d196811a9259d4c3ce2f204844330f573e1e765609327c42033d0be5bd4935829304d75ccb0239e6c685895509
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZB0Le5ji0hmxNrM:A3k03kB56rwPji0Aj
TLSH
T1F5655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 910KB
SHA256 1e70ea4c154bb6f48e5bd6604e04186e1247e2ce10bc666b56d05c7f45c0a0d1
MD5 211eed454e6ca6500f820ab81053b63b
SHA1 56786cea1c77b94e2d51b5952835989a84951a0e
SHA512 aedf0ecf24a912391c271b8334f41be776f9805c09f03b138e2398897631a085c766ec71ce233e1386867dc057702c8ee78d725d0644fe4aed1d3872edb669cd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZQb:A3k03kB56rZb
TLSH
T1DF157B03E6840FA9D00FC1749A958662EA777C465F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 886KB
SHA256 e2b9a8fbe04afadcce3e30d93f7fed72e05646bbbdd24e65a9c6ce514d2c1df1
MD5 60eb39a6a6cefccd5bd5cc2ead0f3726
SHA1 ca535ac3f072c40b8f3843bbea0c62169239d94a
SHA512 bd8f6b05e410ccb439e256357caa583017435414012485480067fd518e5c87595a13219fa65df76966667d9b04f89155628edfac9f377922b54fbbadf4ee8fda
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zi6:A3k03kB56r+
TLSH
T1B3156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 886KB
SHA256 8bec744e37a77d29a214a7d8bfe1dc75262f9d4cbe5ec92c990d8f0c28885188
MD5 898c9e5833e8d1da7501ccea65ebf93c
SHA1 53f172c892c99f6b1bf370788e2225a7b2802ea5
SHA512 f360a6a47cf6a791ac7b59db955185fe4f58bc0f9a43c06f1a8160f0f13c17bedc15fcd8f02a879bab7474c60b96a6745f8ca8102e14633bc1915ff8b2ba84d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Z6N:A3k03kB56r/
TLSH
T130157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 886KB
SHA256 5f85302ef62d778188659d9c4fc1d211c764448f718dda8c3804c7b038de9f60
MD5 7a798630cbf6b4f115c0664cedc63efa
SHA1 75d6aba4fed5155922121f9bb0a577118b2738f9
SHA512 aaca584dede143b8100e6687ee65fe0ad4500751a7ddc7900973529f2dc4295daa09b0048854cae4f921ca0117ea683e3b0405a12e3425e0eb3a66e3858951da
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zgf:A3k03kB56rb
TLSH
T176156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 886KB
SHA256 551fb254ad2b2491dda3d5a65bbc6cee5cca2d18cdae2712c062700ab165caca
MD5 448234329fcfafed67eb05c4b71a6928
SHA1 c202985382dd597ffe629aab53605f80231cf0bc
SHA512 0707ac939f32b0b2fb130535c2c36231daa9a4860fdbb2e6f5bd58af6d1cbd4ac29e863c508c1c9375b50469516a87dd33373dc1c649815a3eafab17039aa9ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Z6o:A3k03kB56rq
TLSH
T1BE157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 886KB
SHA256 23a722f9243363d6cfeb485a4e1b6a6c1a2976e508436d8a5e08d707a98696f5
MD5 25495b7167f4612c9b82c90439e33112
SHA1 7547d21755a6ddfb899941044bab4e7197c0d1c6
SHA512 ce79079c4e1a79beac0015b2061fa0db3723ad9bc85b9c6b8b5d2be647505c5ba29307679ff1e8d0b437ff5c94eea9c90e0b0448c53aeaa79b24b65a01fb3f7b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZOu:A3k03kB56rk
TLSH
T141157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 886KB
SHA256 3a050cfc37616e9823a9dfadb548bc32edd0d85ac1baefcd0e2e6afbabe2a8d6
MD5 997e81da2ad7d1097e320257231d27eb
SHA1 6e97c6a474ca51e290c40412f27bb4139387d855
SHA512 be33273079e7988748507df6545180224761dd7183e9001d66a711852ba5e15f36f855948868a656157152b3fbdc3866382629bfac25b3a87bc8c5e22ab5207c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZC9:A3k03kB56rp
TLSH
T155157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 886KB
SHA256 0b8d8003fe1634b700e266227151afe4d60f755a1c2069e29a1dc244514fa0c5
MD5 8ca55a6505bd081a2fe8def5f876ed9b
SHA1 0cc8519ed2ee47400ce4c54d6bb8c72de1d9e5fa
SHA512 fc5d64e56678207f650d87047871f61e7029b6aeefe899a72ec6a0df445f9b27f8cb514186b0bb45272dbb7c7870a5e562b23116e4e940331c4235bb002f4897
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZCc:A3k03kB56rs
TLSH
T124156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 886KB
SHA256 cf17328eb14daebcfb0aa3340f6e37184b99afd95fe7b5196707e3407ff6503d
MD5 05acffaf85dbf4a5bf01c91ccbbee09b
SHA1 58a86fca85bb4937571b1d8d2bd5c3acd4302e02
SHA512 c9560e3059b3954335e923de82bc4013dc00f484b8928280d02937679df521d413e3873788b1d7ab71c22fb87349108f936e8a533ea64aaa1dd18d85f9c6b88e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZLp:A3k03kB56ra
TLSH
T10E157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 886KB
SHA256 afae7792e429f28621e73064a4d9601aa8a34f99e9caa75f7a71420073507594
MD5 8bca42219d318cf9f18485cae674c2bc
SHA1 a9f8baa6a43d9a3562df159e11814fc146459379
SHA512 4780829ea4b70ba996118627114c429d74cf14935ffc17c4169c5daa50d856e20fb389bd9c3e4c3fcbb6bd074db5f63e7f19a058222e261325f2f0b496ed4502
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZcN:A3k03kB56rt
TLSH
T148157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 886KB
SHA256 912aff3e0cc2e2d0126d6d2dd27870a24b45bf080ec24e72a133f8044c02c2f3
MD5 4bc67b634521e303c85e0749bb3bf6a6
SHA1 1286fefc95810b385be946082c7fbfb9e8aa901a
SHA512 b235f0794c4cfccc9a3371ae79433888e8076ff10db810c717670eae6f39822cc7a2f50db11945dddad98486f514af2e3d7ec90012ea431f1d86ac4d8b8136ff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZEF:A3k03kB56rX
TLSH
T16D157B17E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 886KB
SHA256 e632ca4d1bee367dc0fb632f082a855d465c689f7d862f61910c678478aa662b
MD5 75ebf51369095997533bc4f52a6f9b12
SHA1 aac0b37f77243ad597bb427c2b5863277c7501e2
SHA512 7f6a95fc7b2bb86045745fe26133f2845cd8399315c70474e7047dd6f04bd5a14e14716609d60d15e34db4e8a4440c44550a0b68b7967ca824795305b8cea6a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZhC:A3k03kB56rL
TLSH
T137157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 886KB
SHA256 ff15ba4d5ed0b5e56a2ad9facbb552bae20842bc2d01feb1a223104e4c313e34
MD5 e2f2654094aa7263a872fb473f876d5b
SHA1 007fb20de0cfa52047e643035b65c5dfa28ea20c
SHA512 b9364d954a7fa73e5d7e555df49b2c1b11f56042fb1d79add7e98d4d903bb6aa0c683de9a6d48483a42af73f91c828d5a2c16102e4a807872c8eb63dca4d534d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Ziw:A3k03kB56rO
TLSH
T10B156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 886KB
SHA256 163bfa7fefa7264862da2224708855d90debf873098c49478aa53cf43a3a4ef1
MD5 de0b0391b8fd3fc362da1eb1b38e6627
SHA1 e8b357f25a6f253aa3f88e16e2bdf32237f47a5d
SHA512 74e7e61172e20dd20533bb60ea4714214a42f70f170f5d2383266ffe91b1b041423c1e70932a0484bbda6eaf41326a08978f54b7d052c7248e71fdff1c00e80f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZpT:A3k03kB56ru
TLSH
T1CE156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 886KB
SHA256 c1656588c165941b9d23934dd8239a5628bf46cfcfd0c28071951599650267c7
MD5 2c1d9a0fb455fff0e98ea7d8359b102d
SHA1 2b5f3c69213d0ecaacb37fca779cf44d7fc858e5
SHA512 83ac256d4d70fa21a0d155e8f881da0c913443ce7e97d85eb969af6c21aa039f18aa67c1e21b81e698d9673541898c9252894e38bb4e3b8443262a02b8cc385a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZHu:A3k03kB56rZ
TLSH
T185157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 886KB
SHA256 9fbb06f401c94a63b360816584dba3d3f84c909d6532f008d75ffe002f00ae36
MD5 5d6b73ac3f17a9e6138b62e074c275e6
SHA1 cd93e2af1b5087e2c4013ee9f17b35ca49cd1a2a
SHA512 10e04907d8c5d7c92ae81ac2dfe2d65676a78b9619b9640de71ff98c3568c79cd5362f866a11ae13518e17e766693e24037bce5be751a6e01cf5635c0c01a34e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zbb:A3k03kB56rI
TLSH
T166157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 886KB
SHA256 ff8b038e8c8cbb25d6f5d33d8902377b21dc68167f52c7c72b5c70876609e7ca
MD5 cf784ed0831ac7aa704f099ff256cd36
SHA1 83d5453c71f2b96a192575875814606d9fb8b2d1
SHA512 e1b10337e3cc00c46d4bf077989bccfb629e72603bfb98529459dbb61d2165b2308d0196ad5794c81b5f3eb8247a94c4da2bcfdc2be7d29b967a3167a0290381
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zvf:A3k03kB56rI
TLSH
T1DA157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 886KB
SHA256 8f6fe264ea1e51230cfd074a65d28263565d50be99c58facee1020ab8327dd5b
MD5 f7eb43c7fc506e48c51ea8da3d4ae7d3
SHA1 98f1160be80a70da7759f7d775e9e800a55fbef4
SHA512 37857b41f694cbd8c8e71bfb5e36eb074882bd1d4f42265c750f81aaa8fc9d37074c37f426f9abd02a2e994dd952a4f919badb80177db666c8f82197fd1130de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Z4K:A3k03kB56rI
TLSH
T14E157B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 886KB
SHA256 c9f6476721d259481e654007e25ce954d2bb9d709d38838a1d6df1f12e450d37
MD5 b273d2f07c4cb7e5d8eed90605ad80ff
SHA1 ed766a0dedf9f94e493336687fce4fc31d1b1c80
SHA512 0fd90b39dacbad001fd9442f0a08f8157f92f0163f583a88e5e18ceb18ba5329f20ba57956b1937048eff444bce37fa609da0667594780b8605ac5c95aef85bc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zlk:A3k03kB56rh
TLSH
T1F7156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 886KB
SHA256 3fe40d4cd6f742b8f26ceccd7a9cc13135b161a8a64de78c5604cb4ac248884b
MD5 d1a0cbcac5161594dfa5e6a5a342404e
SHA1 6772c1d2d4c6344777264c92ea094cc1fe385159
SHA512 e75cecf84aacab8f328e715c104e336df42b14a4ef7ddeaf137d1a5fc573b3c0ed20cb5e90dc659fa2cc4b65fa8de38886b30e7d96d9be555a71c4390a4ed306
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Z60:A3k03kB56rE
TLSH
T158156A17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 886KB
SHA256 7832e40d66942e4d0abb22706d1e09d9ac831b8fa527015b5287750fd2d67d82
MD5 8eadec3aff783cad51af8b2ce8f178d7
SHA1 0870b66867af9e473e5d168169b9cfd4dc331699
SHA512 d7ea53a023c04cb785de6f959fe1811c78e5d8b0fa6920e8efcaf738477b9314b42faf987f1cc2e6ca13fbc89b9838df9740c6cdb155a495b35cdec9fe2c1407
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zpg:A3k03kB56r5
TLSH
T185156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 886KB
SHA256 4b0aec34076426bb45daf620021ad59b4c6905bbb00243169def2925ad0b1168
MD5 9fd3fc9a95d4194d45e2a2c42ab3c036
SHA1 38ea872c0c4daa3475985706e8a6fb589e7bf910
SHA512 c68e3a82f0f3a72b731a43decc1aa6819fceb04c89398dbdb60cc143faa3f3ba95df5c02e3ede1283d273020d073010d5686578950f4e7f1c9a4ae1669509cc4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZQr:A3k03kB56rj
TLSH
T14C157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 886KB
SHA256 7fceb724c113c335ce728c18bd262a7aab96c4e0e07a4bac62ab30c5f5d8c32e
MD5 96d779684d1ae3c649cf2d23e14a0d6d
SHA1 9540588d49b4520b213576f28cf5858c8fdc9771
SHA512 64f16a7d49e72c300de0e4d6a6654eae85397709b0b08f256ac8523b0a154829a94e7ba452b1313e2a846c2875dc930655b9bd3d0bf5a27af1cbb0369d4b2cc5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZOn:A3k03kB56rF
TLSH
T12A157B13E6850FA4D00FC1749A968662EA777C065F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 886KB
SHA256 81922a0a9bff49645b90d80169a2c797933a701c1f3c572950fd9d741487f1a9
MD5 b52e9e2e65ad31a822a1595f2edd2c1e
SHA1 7f3e1e4a5c515091f98195b72388860dc2ff6e37
SHA512 0d1e3fe7ab9031c9fa2ddeeb9f991971f343292540491fe93b6918d015cc299a9c29ad92a427ef162e483a459802471217f7d164745e6d1714a577a26a8003de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZEx:A3k03kB56r7
TLSH
T130157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 886KB
SHA256 fe2c4aa5ed479f4fe2168d38d263264d760926a93773141d7b4e94590921f1aa
MD5 92fc926cfec7f151013698710ae341b3
SHA1 b63b73bf227235e78a8387f6b9036e3df1db0b7a
SHA512 bd230c24be2709ecd411af8973596f973e9deb7c4d15e6925e817dbdee1b56bc1b0bfa9619232dd396dd1f4ddce607d94f54ac629ee28178adf6f96ea3330039
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZOA:A3k03kB56rU
TLSH
T158156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 886KB
SHA256 35606c9b47cbecba0b3ba00c4c29e5a5f631288e94afd6932337d0660bedd572
MD5 fe47f632236f375af3e933864f0ed433
SHA1 ccb9cb8d841f91e60f0e8692fa9f502f09cdfef3
SHA512 6820b8be497b12f66cec6907336ddc0d9b2a42b3cee3177c5ba0a2219acc8a834f6316ec36f7c40ddb3ccc3a2d37a1435272643f84bd2e73bc3751523e838050
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZH9Q:A3k03kB56rl
TLSH
T1D9157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 886KB
SHA256 32d815613335c6b2a1593800fa15613e67b9128a69c249fb458ff0b9da1603f4
MD5 b4f3331a1f8e520e970d24a5e90bf118
SHA1 4b0fc7184375fd49fd6342a74c3a3fb0d80196b0
SHA512 b835bfb3040aca0776a61fd941178539abaab0fca42b86e0e01368e0be42b33bfed6d27d32eef0c532edd0e4ff24fdeed3839e86f319f7fd6ed93b173d96d5df
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZO4:A3k03kB56ra
TLSH
T11D156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 886KB
SHA256 e743d15e8acd8354deaf10e6b4e72553b22bd0d2b1034d844a4cb9ee295e8ecf
MD5 46ba5be45b0626073dc161003c8704c0
SHA1 3cf76317001b1b1072814bdf704e59d1f267f2ea
SHA512 61ef6d1787ff4533ecae597aa8c23d6c55102d9e9224ee2407e08e6648064ce8692666b14eb35dd63d95fd4bffd25ee13ed02e322c4542c5eae24df027d5e6ca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Ztu:A3k03kB56rb
TLSH
T1BB156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 886KB
SHA256 0b845d67a060c1927f17977d2ca59f3698cba745b7b262f3f6b7e3ad420f431d
MD5 06ff6e2a6b57bfaace5e06f14b559f52
SHA1 0c5391076b0b2ced428258654ea3d4e646daf76c
SHA512 3ea4654b1bdfd7e95577fe83aee2e238975e3e04d784e2f17a339467dcca57ef27e33b03741cb5078c426916348922f4cc7be28ff28574844582e50131a8a017
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zgj:A3k03kB56rF
TLSH
T197157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 886KB
SHA256 2bce825d182733ff5e44c2800d242a9668da0b3621ec31fe1d6bd9bd8d9a089b
MD5 1bab89514690e2e7a978c11fdb883b2b
SHA1 17176bf9ad81e784c05ba16caba0b45cedcd8aff
SHA512 a565e697eee9aec790c68db82ddd9a5dec18a9177f2264ea6f2456d4ef6789a6b22d4a35a0e26f0930c0cfbeb584cf8299fe798e2c4ab6a4f3b66f0bbf03a8ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZRg:A3k03kB56r5
TLSH
T128156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 886KB
SHA256 2ac70383825b1ec84fc57da1e45bc52b9ef60d7d05f849d02739615487375d79
MD5 0b457e56910d2607460f9a5d75c52bd4
SHA1 23cf480ed5656487607d9668d7df97cf6e1e9aa4
SHA512 2324117d0b2dc625bc8697a24e15f390480c2fd092811700441ad751bc98fb11be7191ccee09b8e86322e05e0d88a2fccfa6439f6db81e58f4e483a777a36a9a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZII:A3k03kB56r4
TLSH
T13E157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 886KB
SHA256 15335633b52e6cc6b2fcb16795edf6e14601f1ae65025b617c6264c91fa6ec32
MD5 6c83be7b6d6563a74833808c6b3665b7
SHA1 d2ab8a7dc29f192a1b135dae3e1b907045b0e338
SHA512 ce09cb74c6318f77db4472b448f9e9562bfdbee4dd42905923f377a10503754fad8e8f6867374e4db0d04d0fd88299274fd2ce0d47d8828bd2a47c01833f6d51
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zqo:A3k03kB56rq
TLSH
T1B6156B17E6850FA8D00FC1749A958662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 886KB
SHA256 e76179cfef6204873e19c18ef70a655e84b46738a132db2366d1f31b57a05170
MD5 9419d22baed9dac722e11fcb21625223
SHA1 8ebd2c7b7e26af0fd10cfe0fbfa024823960efed
SHA512 d1125eb5fa2a26dd75ce62cc64ae21c0a5e6d02cc609bd1cf092827924d2dd1521ca35649ddd71f850f0c10efe4cfede3dbec48068b32d4141ffb2341451487c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZB+:A3k03kB56rv
TLSH
T159156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 886KB
SHA256 382c713fb56d91190b632e63336781fdef5481ea85734a868844d98e05470427
MD5 a15467eca00df6e88772370b9f7be76d
SHA1 879a038a4f92fb372c6e4f7fbab0c7ac94ab4ee0
SHA512 142cedd848d3ba73d53993344568f62a5375f3b78eede6744ff73c1ca371739fc1537931cfb5932deed3cda29184309ed8ef3a0ea4f8717960044ae2b6531a46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZPQ:A3k03kB56rL
TLSH
T180156B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 886KB
SHA256 bc62b6428829fa75ebf9990f81665d0b78bcd4a39d5f038578f1abc9ed26d6c2
MD5 9e24602e92d458861d1de26954f2b737
SHA1 c2fe2c81f8d453a6c25bde8a21ce850a0a48b472
SHA512 6163fbb8de1b579c8072ad424843687e03e763e6da5109e7ee651df18adb3e5273b79e8c1a3908393097f4f1b2a1eed46f4c972e27bc897a6b77e2742c8a665f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZUX:A3k03kB56r/
TLSH
T155157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 886KB
SHA256 d871eb3146d57023d0b9803abed1e2ab1cb0ad72da5d2db4a64dd4d3f49b69ac
MD5 6faff5c71d19bb1cf455affa005d48cc
SHA1 717b33053bfe82a4820ac03b503ecd76e2316647
SHA512 78209d2e9d733ccc08b983942c79d29f678128a7fa50421cb2503d70301d59e6c57cc980505d65738c7a343e6ea943866a1331dda726e1f8c91304a4f5913315
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZyL:A3k03kB56rR
TLSH
T1D9157B13E6850FA4D00FC1749A968662EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 886KB
SHA256 a27384f59789f26fe53885e865bc6d7c91c9036c22f4cf9b030e69b1fb253ba8
MD5 3a4eb73d73db49af5bfd797d308ef36c
SHA1 b35bb651ccb2d2cc9d18c1d1a6698e3de418812f
SHA512 afbb3a27c5a6e544b950e7dfc678ad30749d85838892041cd4c9e5a2a7a33527aa1de58c62af46d7c49fbebf251c2624e9cae7e3e693e58d6b80122ece88998c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3ZWM:A3k03kB56rI
TLSH
T182157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 886KB
SHA256 952d2c43d27e830543bf7478fddf3c7fe2534290163c42a74c052275a02af34c
MD5 a1ccc2040d8448ea8592a697dbbeb598
SHA1 f63b557b4429fbeeaf346aa4f6ad8b0fd404c117
SHA512 eafcfbcc5ab4e70548c8e88e83fb08380819365cb190f9912ea73dfdd2c0a518f6e518cb4d04acbc2d33f9e2dfdf86e820a06e4a93d4aaaa2651b3e91e2bb79b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdocyy3Zfh:A3k03kB56r6
TLSH
T1A9157B17E6850FA4D00FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3324-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3324-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6124-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads