b8729da96e21475de8c8868632c777bbde21a7fb55794a7718f02c1c5e8b91d0

Analysis

max time kernel
90s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 570KB
Sample260824-stadhawsdw
SHA256 b8729da96e21475de8c8868632c777bbde21a7fb55794a7718f02c1c5e8b91d0
MD5 265a74f91d8fa6ab7a1589f0a9671bb8
SHA1 bfd55af008fb822d010000f9c0285c9ddcf868b2
SHA512 bc0430ff87ccd690238c8da953625205cb8079043ea624ead7622bb05dae134d3cec195b200ff6ad287a2c2b7b288d34742c29cad4d7758eb979cf7463b8eb6e
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbo:btQ0XVNM+xBPfhD5Tvinrmbo
TLSH
T115C42906A25D7FE8C11FC134897646B2A633BC215F2097DF17A4FE253E31A927929723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 57 IoCs

resource	yara_rule
behavioral2/memory/4832-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c566-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4832-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2332-252-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-301.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-582.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-705.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1091.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018925-1475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018927-1524.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001892d-1543.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018921-1562.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000018a18-1744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a45-1859.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000189b6-1914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a52-1999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001893c-2012.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018944-2013.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
2332	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4832	2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
2332	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_265a74f91d8fa6ab7a1589f0a9671bb8_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4832

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 570KB
SHA256 b8729da96e21475de8c8868632c777bbde21a7fb55794a7718f02c1c5e8b91d0
MD5 265a74f91d8fa6ab7a1589f0a9671bb8
SHA1 bfd55af008fb822d010000f9c0285c9ddcf868b2
SHA512 bc0430ff87ccd690238c8da953625205cb8079043ea624ead7622bb05dae134d3cec195b200ff6ad287a2c2b7b288d34742c29cad4d7758eb979cf7463b8eb6e
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbo:btQ0XVNM+xBPfhD5Tvinrmbo
TLSH
T115C42906A25D7FE8C11FC134897646B2A633BC215F2097DF17A4FE253E31A927929723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
Size 705KB
SHA256 b2d2974c44439b7d739e238d0fa05ab1f8416f0993c72da3cf889b89afdac59a
MD5 bb97fc36c368c1b8427ef672f1f41f74
SHA1 69ce6c72a1b6b6d0b09c8e1990b3d6c250ced742
SHA512 dbde507f10e54c5b24e04735082f096f635564611c2b1b9208854c561716dfec19f65f969656f8079043b620be989bf8c5de33a20560abda593a9758c67dc977
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbEmEZrZq:btQ0XVNM+xBPfhD5Tvinrmb1qU
TLSH
T1B0E44A0272987FE8D15F813099B556B19A73BC315F2053DF1364FE253E36A82BA29327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 858KB
SHA256 926ecc072501267be7fc886ddc54d95a46904722aa63acd21efba68f48509a71
MD5 500cdc04d4be7e1a64c4e2e166a47c08
SHA1 20f4c60167dffd9099051367d2884aaff817eb66
SHA512 90f1a9dbeafa7105879086c4ad96fc54a8d377fdfa09166a441f41d4033c9929e211c454f6731175fb35c961fbf6fc3f15f732852bf5f3324f5a0eab7cac924c
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb9Z4Q5VYf6exwI1oB86:btQ0XVNM+xBPfhD5Tvinrmbp9exZCB86
TLSH
T1D9156C0676586FE9E16FC07549765276A637BC220F1097DB2360FE293E326C1BA39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 599KB
SHA256 6ffbef0896073470b8451e7a4e8d06b12a50e6392b0c492edcbea8538175293d
MD5 a8f06e9388f7b1fdbd1d81ee6676f74c
SHA1 5384f071df532fd03b93e1ca40aa920cdabbdd64
SHA512 912ae0e15a5fd943755be959cbeb1f8889c0a3db96c72d064d3bddbdad55a596c09b4bee1b4e5f869ee869ca445e291f5f320a9b12647ca805db65c10aaa3848
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbaP:btQ0XVNM+xBPfhD5TvinrmbaP
TLSH
T1C3D43906625D7FE8C12F813489B546B2A633BC215F2097DF17A4FE253E31B927929723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 616KB
SHA256 f2b26b9689586be3f71ee6edd38cea278b51bfb6e9333515eefc42ff9f656c1a
MD5 61bd99d36008bb0d16afe72e41c8d48c
SHA1 cf8135d66652eb165f194f389df5d440d762320b
SHA512 4ccd98510d204d5a219cf3cffec6b7b65e516dba9e7fcb90ac0fb7b07c616b2315a40d6df95ff9c568b1da04448ba280881fb69b62c953e8ac446e373b6d429c
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbV0:btQ0XVNM+xBPfhD5TvinrmbV0
TLSH
T1F6D43906625D7FE8C12F817489B546B2A633BC215F2097DF13A4FE253E31B927929723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 661KB
SHA256 075b7cb01b473b26eb95658474ce4395c1e901fb867749f5adf1950ac60727d7
MD5 1de5d2fe54b2b96d72f5b70956c6a0ed
SHA1 ac77532b59e73156f465c237bfd67be36b9e8b36
SHA512 49595356fe9e8bc6e91f441f132b7f1abf95273030a36e95975ca6ebfed6e1fa99f519d6bb8861dd0fc90d18a8d6df0c4cfbbdb7303910bf29abf628337d09ea
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbW:btQ0XVNM+xBPfhD5TvinrmbW
TLSH
T10AE43906B29D7FE8C12F8134897556B2A633BC215F2097DF17A4FE253E31A827929713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 783KB
SHA256 5530ece89c7ed56d8fae283396d37b1102eef74cd4dc1b7ac831e5e3d73f4683
MD5 71272247af774d4841e04b95fb0c388a
SHA1 273f0247bd633de201643a8f8a84e91349448cfe
SHA512 4ec4842338a0ffcd60eeec4e892d86959ac4e0a952ad68ea6dd3f867f47a3695a89895fc0f94850927d9d68010daf72312a205043a74a8d6833eaa28088f1be7
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbgaY+FUB2:btQ0XVNM+xBPfhD5TvinrmbgD+qB2
TLSH
T198054916725DAFE9D15F803088B596B6A537BC210F2097DB2394FF293E31AC27A35613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogTransport2.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
Size 915KB
SHA256 bd120a9c1240d004dc0b7744913f46c11212d074eb7106af175a354142277958
MD5 d72999c84ed88f97af457c8be46c2d29
SHA1 0d274a495be43326e2ef5f77e350d478e46df141
SHA512 ea1b61518eca78451ef5875f083dfa1e389c268e3692d7745853b3f8557451bc1db7ee161757fbf0cf486ad76b91a00df75f1b451c100afa12f13b3c7025f52b
SSDEEP 24576:btQ0XVNM+xBPfhD5TvinrmbwKhyDZTRW8fdeg:bTk+d56rvK0DZT88f1
TLSH
T130156A06A349AFF9C55F813089B642B5A53BBC214F2097DB13A4FE293E316D2B935713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 654KB
SHA256 456eb22bfe45be7b6e2b57882369043ce98a8f4a9204b68f07abd2c4dead5f58
MD5 bc332e54e49949fc0848e62613c97f3b
SHA1 a5cdc40b24a9ebc883b6c4e5162144dc26fa5e75
SHA512 edf79cdcb27ed5a4aa140d092552de03c598778e3ffe831cf0ce7662d66db42240acca20e1390a03fca887794ead901433932e9eaf519dd90b11874b04afc052
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbHYmIjE72:btQ0XVNM+xBPfhD5Tvinrmbl72
TLSH
T1E8E44A06A25D7FE8C15F8034857546B2A633BC215F2097DF17A4FE253E31B92BA29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 622KB
SHA256 5a85a33f4b5f2a738900db737d174944fffa52a4c759ed9bc81ab7f76c10850d
MD5 53bf51582a060c080f0575adc661dcfa
SHA1 32736170b648222e44819f300ad595f8180b1fea
SHA512 65f16f53889e69510d19e51d1154c94b95691ee6a9a22c5ba21c70f9a96ba172ccadec2793bbe95b9159fb19c6f49f37e6de71517d3d085f61119cb7945fccf4
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbVFfj:btQ0XVNM+xBPfhD5Tvinrmbjfj
TLSH
T1EED43906625D7FE8C11F813489B646B2A633BC215F2097DF17A4FE253E31B827929727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 677KB
SHA256 c125ab296f9c55dbb8db764c1c3d4796846a32e708e5c740ea3887ed547a1c06
MD5 f6ddf63e353ce17763c817921ccdafbe
SHA1 d04ddb74b30223472a7e088c808e7f742ab43428
SHA512 37fe4fdd9c7a3ab5be7e088d4f4ee37cbc7018e928012ad960168b09df86a92d8ead914f82c1b8935529fc9d19bb5ea9af584db9986758ff255e5039479f5f08
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbfzQl8Hok:btQ0XVNM+xBPfhD5TvinrmbUhk
TLSH
T12EE42906625D7FE8D16F813489B14672A633BC211F2097DF17A4FE253E32A927D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.1MB
SHA256 2b57cc0906d214b39bb8640708562135bc8b9a91edbb49faeb697afe905ac215
MD5 7188e53da4b9165d580005658dd7b027
SHA1 ae589d6a8d878f5977dc67da7180401a7e46cd6b
SHA512 0e0eb8888af9fda5b8d6a906c53a64cc7d29f2f6532fe55b1b0a9e459f84d279511adc812c26319735e9bb53732ab6ca36d1d87f6170511af8800113eeeac960
SSDEEP 24576:btQ0XVNM+xBPfhD5Tvinrmbw0Le5ji0hmxNrM:bTk+d56rfPji0Aj
TLSH
T159352A16F2685FA5D06BC074C5E256A6E9337C411F3087CB0395EE683E33AD6A936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 584KB
SHA256 e607ebc8d34c37d0a2aa830a556639ec91be8a41421c241f2ea3c917e052491d
MD5 d53d7a974109345e4f18ce0a981c526d
SHA1 bb5901e44cc544b6b83df5f9c00c76835d350442
SHA512 84704a4cbea4e0f7d4a3bd28f8c2ce8b5f7c959f7a5d8c07e05950186aa736d70846d5cf445f38883eb855bbb7c2f039af5e70dbb205a1a74f76220e4254b7a1
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbKa:btQ0XVNM+xBPfhD5TvinrmbKa
TLSH
T112D42A06A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B92B929723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 593KB
SHA256 f2b1fdb021e48cdbfb6df3a0ed47cbcc65c827743de2c8c479feccaab0fffb5e
MD5 0a1866264f1537ecb7de6f53d9f75d0e
SHA1 e345c3688466cc065b8b2261e575631f2534d6b4
SHA512 84b2097decf672e6f0454253b6fcc9b0eff902a0c82bc23df3ce356c094ab0d899e548ac0fb02d095759efb6e354a5f354a60a631b463610c4cafdb8ba89956b
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb76:btQ0XVNM+xBPfhD5Tvinrmb76
TLSH
T1A7D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 593KB
SHA256 8147034a1f759660ae633a771fefd2b32eca5950b313cbafd55a506d3a9c9ed2
MD5 281afc6e2114e33d0d59691908c5dbec
SHA1 789d3463af65c0737673297e15a7491351233f03
SHA512 bb60c54cde4d62f0d4708f132e85b950873948a1e2c48387d70a436bd7635b2a97d4df23f587c519f8e2ba281b28e24bb66c4cbcd244069b59b04e392aa38968
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmblN:btQ0XVNM+xBPfhD5TvinrmblN
TLSH
T124D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 593KB
SHA256 9e6873468455008d4f71949d2fda4e1d036c0a487de64d975bee518154f73f3b
MD5 90cc7d832a615897c67fa74785a74d1a
SHA1 3c0dfca472cb07c61930fda233c4292af1bc2516
SHA512 5c82afebc560e795eb911d0cc9c56bba5aa01676df2087eca5c8fcc098307645e6356a4754cc62c8460cf0277e0959c035611b602ba79a1bcde16cba1126bb93
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbjf:btQ0XVNM+xBPfhD5Tvinrmbjf
TLSH
T157D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 731KB
SHA256 50a46c1df173457251ca9323d12ee7799c5841e2bc891a3d2d6aa7cda69905e6
MD5 78a71d66f5918326a4793f8790e979a8
SHA1 64979119e846614db24f897a468fb900fa750bfa
SHA512 9f8ba5bfef32fdd9797f891078d51a5b9791f2814935bd0d73a1e20e5f9b8587d0c37b4061f3fdbaab7eccebc77acd1e40c3e9d64867bc90192f40d10c07aa59
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbPyPz5L87:btQ0XVNM+xBPfhD5Tvinrmbizy7
TLSH
T17EF43A0662597FE8D12F813489B14672A733BC215F2097DF17A4FE253E326927E29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 593KB
SHA256 8059c767ff6abb027b5a929fc7656173c05c9aa938fe2bd4df00706b2882db76
MD5 5b4311b3af01d7d0568f6fa8b3f05a32
SHA1 b3e99086a552b40963ea5f55878fb7c96056901f
SHA512 e87ac7c9880633f6d99b654b7e5017f57c3d2da91f0ed6f3f0b4c3edac5834cd21887414e4aa28bf54677217d4d666b5fe94d61b979e0923a56dd8ba73bd3c52
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb1o:btQ0XVNM+xBPfhD5Tvinrmb1o
TLSH
T1C3D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 593KB
SHA256 a5c65ee3fed3acbb254806d0c078ff3d10d6d90eb41ad5bf5c53896808796f0f
MD5 7bd7b2c8181fe230d9717fa4b5e9bba4
SHA1 1f4c5e313ed22a5fe25684ed5fd90cbc67914a6a
SHA512 f94f27481351f3146dd37e63d8fbfb69ce54cdbacb2aeea6d0b04d8684dbb7d4097512e14463f20b457d95813e5356c399397bbf8d11db02171aa702395ef29c
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb1u:btQ0XVNM+xBPfhD5Tvinrmb1u
TLSH
T13BD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 731KB
SHA256 c63f7ff114d7746dfc131ec1369701be5d4af4f338d71219ead512ea1d45bb98
MD5 2926edd1f099ee614ba4c50cf348459b
SHA1 8b757cdc124788fbbbd22a40b64c89f856fdf886
SHA512 66433679acf357c56e4c8fb034e992349d495ef275465480d47d98428ce1f0ccc6bfd464b2478da465c99c5bddfb27dfc14ddcacfcc7402c712c4725ec48e63b
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbyyPz5L88:btQ0XVNM+xBPfhD5Tvinrmbvzy8
TLSH
T1B1F43A0662597FE8D12F813489B14672A733BC215F2097DF17A4FE253E326927E29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 855KB
SHA256 4d8d3d21b5ae6420d840d63b13a45e9d7ef5d306789b612c5ab99b416e289dbd
MD5 8437666f43217f1f8c3d035df4593892
SHA1 d50960f72b9773379db643245873aa24d6fbd1f7
SHA512 0960f714b6fb5e6d977a0d473ada8e038b48f8a4d5100258bdc747f2239a8a69d71cc42438be4b3267bbd21bbfb79d22f1e647aac75b51b6545b006492446839
SSDEEP 24576:btQ0XVNM+xBPfhD5TvinrmbdTWaLl3z0zDI:bTk+d56r8T1LljB
TLSH
T155156C06A2586FE8D52F813489714672E673BC221F2097DF13A4FE253E337927929727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 593KB
SHA256 cc5a17c6ff60e186308d1c4f69471bcd4bb337fd3414d958af73d4c133f6345f
MD5 751fd137af964d5f96510d1d606b8839
SHA1 4f89fc484c2d4d902658d79380321a46ac8b7ecc
SHA512 d97137bd9277e219146be324489f5fc05965dd2b3d6e61451071af94486479b8d939d18cd062129028daf6cf3524ecd7bd3db8c177dd93458a06c3a7e81af491
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbr9:btQ0XVNM+xBPfhD5Tvinrmbr9
TLSH
T1B6D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 593KB
SHA256 4245d6534446057ed03ccf246dced5f4096460571bad12e99df12ae51f0e875e
MD5 776f7c1ed674f4811d62f3cf3c365cf9
SHA1 6000dbd48b58b561b60902d65ef6bd872b7dbbc0
SHA512 1553693b54df2997b3bb9f1320030bc9ea30272ca3257aa37511c6b96c69c22fd3330c841e933acbae9ef4169905d18cfdcee82ad2810379a11bc595db1297c8
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb3c:btQ0XVNM+xBPfhD5Tvinrmb3c
TLSH
T16BD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 593KB
SHA256 c124f2a43576add39cedee91e6f89eee70fd617b2798d10ba2714900853ef001
MD5 505d2a5b00195d118c3bedd16e3daf49
SHA1 845bb000f26eb61b6640445fa6c30d777659b190
SHA512 c078d140268e657676a67885e043416c5a1fa953eff363d85027f76c8fd0c41732ac348f33a97d6c3cc2eb52b006a0dfa3caf81b821edd36b0359340abdc210d
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbAp:btQ0XVNM+xBPfhD5TvinrmbAp
TLSH
T1F3D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 593KB
SHA256 4c759902caa072e48f912d6a46e1a33b7cbec3961bc5b0c4714e461ddf7f72d4
MD5 b8a023fd6b3c3df65f805197b2763872
SHA1 7ecc79ff822314e1064747432d26744982ac6ba5
SHA512 e98df030bc9d216b68621326ad1dc112999b3f48b8d28a766dbc58110ef1629321bb3b4b4f9fd289a0178f94678950ca7bdd66ed4800153bccb2c0b25a8f11ba
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbH0a:btQ0XVNM+xBPfhD5TvinrmbHN
TLSH
T1A0D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 593KB
SHA256 e7da21724df2de7d4e83cde367c9a95292ea96bacea8819bc700acfb91403098
MD5 361e9a83c184f83abc3107a4b313e150
SHA1 41cf01ec107f83cddc5649d2df82b8a0f3d65566
SHA512 ec55cc1613545b83917c3e0e31f4881d5cd8ac5b3c2cbd93d0c3e0f326a989d8a978901fd24b2eef21b0e30fc0ca45d6aa868e475dc27341c8435e2c332fcb74
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmblF:btQ0XVNM+xBPfhD5TvinrmblF
TLSH
T1DDD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 593KB
SHA256 2cf8c647bda392061f513da553861998d42c16cc839d0c79574e2e89954238d5
MD5 5e445ebc6cc988e2a53d11fd9f410ac3
SHA1 4b7ff61f509eb35fb251ec86abc09d5c81225ade
SHA512 e39d625b2907bec15f71b2635a7b028187f2c98119d9adbad91a47f20ea12e4af2480478d27b2de2279ae77e3944abc53dac5f0528ac44a60c4604bfcf4f0376
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbGC:btQ0XVNM+xBPfhD5TvinrmbGC
TLSH
T141D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 593KB
SHA256 17dee923928bc3a49d9d26f17b1d0bfaf9c0dc99c2a8df0b469e41399f39f2a3
MD5 12227412f1d4d09c1358e66673abf0ab
SHA1 1fd40b7e290696be59e86d86827445db54b211eb
SHA512 75303075066d76e4be4711ee5f4869117cfef4e1c152b26dcbe0755b17f43e3a422aca3307fa6e2c7b8f65529b34b348e0fb46e1b7fadb1ac2862e41ef5f120d
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbJw:btQ0XVNM+xBPfhD5TvinrmbJw
TLSH
T111D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 593KB
SHA256 26d64526bfd0cbe5cd676582acb8e7e62a3db9d4523362d1a9323979fb88ce87
MD5 8d26f9883bcccceeabf85100242f9784
SHA1 af9bda4e190b9f3cad05c763201ed4c78d45426f
SHA512 5bc228ea1e8b063af32f61055ec88e232e0c392a1fc1e36d92e70b39237ec67bf1cfa7726b48192654b6c43f0e92296e54d28274825791c10d06821ffcf1b133
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbQT:btQ0XVNM+xBPfhD5TvinrmbQT
TLSH
T159D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 593KB
SHA256 69fca613fe965c54e29dd0c282e1c90bd50d0db731f35936d0eb9b270698f39f
MD5 d2ad5206e0f7ca04f24a2a9a912d9b2f
SHA1 4f1ccefbbbcc954bbe7cec3060de786e1c47c34d
SHA512 da5e843ce90e0c194ac7f9cf685dbeaf3b374c102b429c40905507bedc201c3e136eef7c822bc2faef4c4416347252f80f42b57bfa1489ae160d1fa7fe9daa8a
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb8u:btQ0XVNM+xBPfhD5Tvinrmb8u
TLSH
T1ACD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 593KB
SHA256 0dfe51f17342e240bcaff3cb1fcb39ef8b55565518ac62d6614543f084a1150b
MD5 d05dcb2e800ca9c65801947b153df339
SHA1 4a668cacdf593886e82b65d69db6dca2f3f17d9a
SHA512 7db63efa1181b9266d2c832387386e14a69dd2288afb60abb889e9c7283947d92811a3b9ee62dd4c6cc0292e081a6c9ca30819cc68dcfa6888429d648d263fcb
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbab:btQ0XVNM+xBPfhD5Tvinrmbab
TLSH
T130D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 593KB
SHA256 ac744d994302430741efd48907212d5009ecae94db5b55ace23a1be9c1567b0e
MD5 f8e34832f9cae07fef706107061eab47
SHA1 6cf445e2b5a153449b4c835e246e7b68daaa606b
SHA512 e7d6431515ef6f47f8ca8f2a066af83db94c06c278b8b227b4009cb295763086424ab649cbb0f26d96ee0b65d6359186cc109027248ff53c0c8828136acb1bb0
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbcf:btQ0XVNM+xBPfhD5Tvinrmbcf
TLSH
T196D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 593KB
SHA256 3e1868def30ce724fd667ed89e626c61fb8b02d91a4096f75857071e109e3b95
MD5 ea9580d5636c0d8c91903c5f0a8ebcb3
SHA1 c519e876a42fdc896f3107e9f94ec453c9653be5
SHA512 ad25fc7a80664d0e5287fada2833ad7418421dbd9effc9710a60eaf9c1aa709c45158f40f68e22eeb349a87bb89d17094c8fb2c54eec32df793e74877e1e06f6
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb5K:btQ0XVNM+xBPfhD5Tvinrmb5K
TLSH
T16CD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 593KB
SHA256 3d8e8463f4d8b84319e03be2daf5ee2d0fe9c06d630403e256f9d813e261909e
MD5 4bb4c162218f4639636f0aa47ec21f1f
SHA1 1fcc4f0cf67f3b1ddf8dd11ac6fae98949816d89
SHA512 5a544df14801f77bac2218d828469bccd6a16c31618ad32611f11deef4cb314bf723c059129b20ac9f9b6a84c205171ae737df0131bb782822d73ef4d9cd8441
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbik:btQ0XVNM+xBPfhD5Tvinrmbik
TLSH
T18CD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 593KB
SHA256 bc79bef5858ea307649d493c2c33223d358fc1c1528d4fe25e4e44aca273d633
MD5 40fbbf4e2c29ecb682a36ee4e5c16b05
SHA1 60e0b01dcb21005f63467fc9282010870252e9e9
SHA512 2265eecd4a4cee9da4d740d494681277c3a2bd3032a3bfef5bbf59c7f3b3723f6466bea4aaf11feb342cab8e8bea2d922e1140a136f7f4cebe7d617283dd7a9d
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb30:btQ0XVNM+xBPfhD5Tvinrmb30
TLSH
T109D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 593KB
SHA256 6b43326071348a3c78c41d85a6b0e7f48d278ee0e187689a1a814c5b0fb8f0df
MD5 e14abd4b53707fde82c991b534f3c582
SHA1 8c44cd4f076cb063ba4bd66a529a615fa93a550e
SHA512 5e7d3c38815c1bdb0560b37fcde35b6042d6ed835939ad421ede37a6c9c73bb3a0ab2e4c12cd84b4ce806eb7db38ccb809e52366cb7fb798d32a0f5d67f4375e
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbm70:btQ0XVNM+xBPfhD5Tvinrmbmg
TLSH
T149D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 593KB
SHA256 3e016857ea0c492258ddb4798f2a5b4d10bfb861eb5d864a9975f229d40e385a
MD5 98af75c822c4f7a21091784d8695223f
SHA1 69299d494a7cb3b3bb6ea94fd9d6db4ead24601d
SHA512 4f6d59509ffe0eea3cb01a8b4f0ad9813829fd756be2ab459e7c43778c77a9bf3be3d57cbe90e48836bf789778aa74af9b6d61c04aa787bc489af2e336d4f252
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbvr:btQ0XVNM+xBPfhD5Tvinrmbvr
TLSH
T1C1D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 593KB
SHA256 5429af1fbc451f705cd1ff71946e8ee7308fa22e64f5a91b10a6e1cdf143709e
MD5 09479684e2170d99a018e34552aa8242
SHA1 6dca79f0d561ce861e6f944680040da86c24202b
SHA512 77b2fb8fc970f0ff29275fff7dd66a8882a3c8866f7d8cc6920da991b5f55b663f1f79f9a62eb610a9509674dc3a1a6b253d6a55ff773bb741e38530697f6257
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb5n:btQ0XVNM+xBPfhD5Tvinrmb5n
TLSH
T19AD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 593KB
SHA256 ed09f681d179719168a3269016a056ddbe2875fa157a4c22f2a03f9302f6127f
MD5 4c86d67f4d75f755b38c7f5bee8c7116
SHA1 9b97db76db82184988edcbb2896578046e0b981d
SHA512 a7d4b2c49a45b83001e6ce2f66542b9a7b57613cdad5815c61ace801eac7d8b7871b5a8d23e4835fae4dbb87241529b5884c752a9d31aabc8bbadeb1b9d2db96
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbVx:btQ0XVNM+xBPfhD5TvinrmbVx
TLSH
T190D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 593KB
SHA256 545a8108e17d39b2b67745c33a55d2fafaeedd5e0ba5047ea0c64950a0939319
MD5 9493bc501136b5bd62de705546eea265
SHA1 7844ff26587f2b6d5e14498c2e596a63e1f39310
SHA512 f9dda391408ed1c31916e0365e0c14ec93e14d2028a42a82ab2eb320c7405069a6352e93db12a80830caa4644d9a2965542a465bc54e1d14c7a95b79b01e2139
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbLA:btQ0XVNM+xBPfhD5TvinrmbLA
TLSH
T1B0D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 593KB
SHA256 526160b2d646ba452dbd8cf0459c82a88a78bd2bd5eefcbd32d1eca5bada679c
MD5 bbdffd83d384c6751b10f8d150acd19c
SHA1 0eb62146e39bbd0188e3f8ac5a686c60f6924565
SHA512 ae58a061d02072be99bc22ff350483e518ed3bb7567cab158a7ea17e4cda88d7bcec27efefc2a55707358713b63312653ad53d76c114775ea6b1dcedf4489fe5
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbc9Q:btQ0XVNM+xBPfhD5Tvinrmbc9Q
TLSH
T11DD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 593KB
SHA256 f6b4414a113b40839c8d0442b03ca3421ea9ce50f3a11b586044918c174bc798
MD5 3043bac8f5d39864f0ab9edf601df1e0
SHA1 7be7f64d2472118d09ddba7aa907b3028a562b77
SHA512 cfa68b5b81ec3cb12af5fa2a5102df7052ec191e17a2ceab11c19535e61d195bfea87d5ff6799dd1dcf395847cfbd707aa190d2b8156857a66624b25f4ebae62
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbF4:btQ0XVNM+xBPfhD5TvinrmbF4
TLSH
T1AED42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 593KB
SHA256 82bfbc89e399ba153cdab753eb0580208f11a3011399d198f44c3b0ccada8a56
MD5 0347a129b6d86ce61d493b93613af120
SHA1 f4be55124ebf421aa70a124c7cdaf9dacc928ae6
SHA512 16bd042fee854c81ce99029fcc2de4e89b8ae45f361df5c2aae11efe6f460b9ee3a318eec1400287a32e8d85734066555f6d81a7abb6952529da7e2ff12b6a48
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbQu:btQ0XVNM+xBPfhD5TvinrmbQu
TLSH
T121D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 593KB
SHA256 18c4dfeee7f45dec7447d91ca1c40ceeb21cf1169c6e7bfaf3dec8079072f007
MD5 62150729947e5b9d863a5f83b52cb1b3
SHA1 781c5caf89795b1a6fe695bf0919c2e088ca6880
SHA512 317b89b600a28550197c9502b6d0933da98ba718fd86204a9c0780fa2bd1d1fb07458b236ea18a01fd21a332810785b92fb807f81313819ecee44f6dafe708f2
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbRj:btQ0XVNM+xBPfhD5TvinrmbRj
TLSH
T120D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 593KB
SHA256 c0801bd90d545ca4fb190a8ec69eaca84882ddddd53cb5beff06501c4f6d77cd
MD5 1f21ffbad64aaa14718b9006debf955c
SHA1 86dc98c2b16e9473f4cc9d7923cc3a64fd851658
SHA512 e11432809c7b6b09ed2fc68c0b12d14c374ae551348f40e71c8bf2a507124ba5cf6e8442c0cc4f54dc72e26d187e73995ace56e822bbf10b855a283b71da213c
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmb4g:btQ0XVNM+xBPfhD5Tvinrmb4g
TLSH
T1B2D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 593KB
SHA256 245588ade1f99ce3d8d21b030e39eec332f7d6afc3cc37178155cfd20ef6b7f7
MD5 85add6a0b69499b02ff266842dfc2a39
SHA1 717c8616140dc07413052714284f4e7511f94b02
SHA512 cc74f1e7015034e317f681eaa61947134e8c090a183deff69e6c739c4772b91635890c93398b7c5f4bb7a5edd0f09ae8ac9d8ea11e3e8c88ff02850eeda2d15a
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbXI:btQ0XVNM+xBPfhD5TvinrmbXI
TLSH
T139D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 593KB
SHA256 2e60cbc6278cb026744943f0b410601a6ee9823c7d17a9cc42e090d7b50d2177
MD5 1c8a0c0f779ae5b54613ae15b92b7ede
SHA1 c0d91583ffd9edf37c3e57b1677f09f87442f022
SHA512 4bbb4bbfaf3df2cebf129e319f7b989f6773c04508fc30fdd7de44f51a4758c0743b21e0d0771445ae78a8f0178d46dc400cee4df4879e2aae8f51de9cca419c
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbdo:btQ0XVNM+xBPfhD5Tvinrmbdo
TLSH
T198D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 593KB
SHA256 842b5b4d2bc33d3aed7537a95deb51926c87a5f751fad84f7cfd23e2a8c17abf
MD5 c86294ab3bfd0b705baccc045938da92
SHA1 9b2109db5c9606932ff8ae7c900597d00a9e0c43
SHA512 1b89ebdae2bd2afd141473adc4febf697a49ce42e538c3afe5a8c52c3b4563ef0bf5ff53462f5850fe619fd9d72b27afe0eff08e0796168babcce8ff56fa6de3
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbO+:btQ0XVNM+xBPfhD5TvinrmbO+
TLSH
T1C1D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 593KB
SHA256 c63bf9114066a29dbb38079db4a8645e70edd91ef5df32b1d3c628017fb73a63
MD5 6e8706bd0db12fed7243168050d7d6dc
SHA1 871f9aebaa9136015910c4d134ff16e51bed7432
SHA512 dd53550785e666ff3bf8a81460a578c486f34e27685091ff1dd59daf9c1be9f1b22fa6d4efa4e239b075c68bc555502e44330f45fb1f13b3932e22879eacb210
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbOQ:btQ0XVNM+xBPfhD5TvinrmbOQ
TLSH
T19CD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 593KB
SHA256 37140cff2d68cf236f4fca3bf7a58bb692d33cdbfbbca507604d6c8f143e7fa6
MD5 39bc897f168ed919744430016de46ec7
SHA1 3fdfe18d9fd226ae8af72f12a96586a34aa4d0ce
SHA512 29e13b517e068b7be4bae100086bf184f68542d04c38de1d8d62d1b49590a54f73aca8ef0b075f1baee6a908f58a5fcaddc037b8f11a7af7cc7b8b9fa816fc5d
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbvX:btQ0XVNM+xBPfhD5TvinrmbvX
TLSH
T1A4D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 790KB
SHA256 14c470b21cbf1d1150996476417eb0f9c814d59ea9b97ffc3f616807a74e58dc
MD5 d6336f3cf9fbd8091f305dbe7680e235
SHA1 463abc4bfa82992efcbf9204d6fb0a2bd8d14ce9
SHA512 c639943b561dfab3c8175bfc6415ef763cf12ea70df1bce6f20d2a30019221aaae18666ba798bccac1dcda9e7fcb3ef4e002ca98a03c2a18155777c99e95c364
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbTQ0dWCXSyCq7IwZ:btQ0XVNM+xBPfhD5TvinrmbUjCXF7IwZ
TLSH
T1FD054A06625C6FE9C16F813489B24672A633BC211F2097DF1394FE253E32AD17A39767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 593KB
SHA256 4e4c7352d50a698ee0c68216c32ae55375af5e2c325c6294f2c6873d260881b0
MD5 6a8d86c10318cf9e9398ca9f27e0caf3
SHA1 f1cd84dcb8d3270de6b103dbcd0661b2757f82a9
SHA512 dd7a5ee2e8310f4adfec852a7f1a987531e353d1f8eef8bf9f15b0084361167cf68bc3d8c3d7cfbb6089425192def560ab84424c04ff5d199c6ef64c767c822a
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmblL:btQ0XVNM+xBPfhD5TvinrmblL
TLSH
T198D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 593KB
SHA256 7807aa0072bbd8a1f422ea29498a2d7b811de993d47e974c040c80b646af8f3c
MD5 d09adf1f631a2e7f3b1d73f69cabb804
SHA1 9aeb2b3429398379b59ccc99b7ac48591725cf84
SHA512 deb93761074ce6924eff5472ba9e879c00dfc6a54e16b29f6332f4a74f187f82f1750f80a350353cd821d232c3421ea53d4cd6e5d04e0a11785683a88b356177
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbDFC:btQ0XVNM+xBPfhD5TvinrmbDM
TLSH
T13BD42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 593KB
SHA256 9058ab42560ca0ef15d7767e2b16d71a103ea549bac0cf882b58bb08d7bf68a6
MD5 d80839a62be7618fab9f76f8c1e8320e
SHA1 25502ef76adf7761e0431d909fcbe7c242ed3f22
SHA512 555eaa050d4dde30a40329bbb1b77b7f76d605a2283c01802187f79956baa77cfa7ae5ee8133df7d638a653de50233f3c2a8f47d894fee19210b213e7c5ccf8e
SSDEEP 12288:jnEyQ0XVSwM+9DLBjbfhD3JeU7vinrmbEh:btQ0XVNM+xBPfhD5TvinrmbEh
TLSH
T157D42906A25D7FE8C11F813485B546B2A633BC215F2097DF17A4FE253E31B927A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2332-252-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4832-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4832-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads