60be39b97154f4235bf70be20844495d36a3dae4f7921e89b4b698ff3bafc1ab

Analysis

max time kernel
97s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
Size 933KB
Sample260826-ezf7caywhy
SHA256 60be39b97154f4235bf70be20844495d36a3dae4f7921e89b4b698ff3bafc1ab
MD5 e813f385fb5a44ad63b700dd3fc73c76
SHA1 37990c4dd0c4456958f580d264d2cae77daee03e
SHA512 156003bcb629b9ec396dca5903e2176ce383c45e4d94977abc01d5028b8e369dc1986eef0404a08837c5b4ed1d73b080f4c004aefdf7c133c9a5b029e7b9d3f8
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCw9:J/sCv7rTiw2427h2bUqjt9
TLSH
T1F7154B1367E84861E5B3663049B58615DA76F8651B30C2CF16788B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4964-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c469-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00090000000167e7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-664.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-777.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-817.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-848.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-944.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1159.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1312.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4964-2015-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1224-2034-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
1224	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4964	2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
1224	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e813f385fb5a44ad63b700dd3fc73c76_cobalt-strike_conti_elex_hijackloader_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4964

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 60be39b97154f4235bf70be20844495d36a3dae4f7921e89b4b698ff3bafc1ab
MD5 e813f385fb5a44ad63b700dd3fc73c76
SHA1 37990c4dd0c4456958f580d264d2cae77daee03e
SHA512 156003bcb629b9ec396dca5903e2176ce383c45e4d94977abc01d5028b8e369dc1986eef0404a08837c5b4ed1d73b080f4c004aefdf7c133c9a5b029e7b9d3f8
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCw9:J/sCv7rTiw2427h2bUqjt9
TLSH
T1F7154B1367E84861E5B3663049B58615DA76F8651B30C2CF16788B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 6dfac36649bcfe9a5af50da85170d0c25e7de911cf91ce5d21fee9c8aee60c8f
MD5 b620a7711a6b1235d21f29913cbe6bcb
SHA1 cdd1fa19442ee2e8a1e35585e611fb3b5f71ca22
SHA512 57cd2b0846a7f75be8279298bce58b3eb1e3e81f9a4c81f7b0a7e4f116e1b207a5f1f8cf9a4e5efda18f59d69cd1c1605108524935f4c578b2c629aa32d8138b
SSDEEP 24576:J/sCv7rTiw2427h2bUqjtJ0Le5ji0hmxNrM:N7iw2Jh2YQDPji0Aj
TLSH
T153654B17F6E84621D0B39134C9F69656EA72B4551B30C6CF0268CB3C2E63BF1A939736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 8fe26b0ff740dbfb12551d10d819657a0d2ff6be306f12d0faefef7ca5b9dc95
MD5 50b84baa003f02104035b29d3b23fc51
SHA1 28d8ff3910f1f3563b864c28d9a22e928888b72e
SHA512 e56aae301ca62feb64300127d584a81265452e5bfb2b761b45bd2caa27ef2034f75c7e434a0ec6925118272a03d0d5acaa7f9686744d308a1cf61938763c84ef
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwba:J/sCv7rTiw2427h2bUqjtba
TLSH
T177254B136BE84861E5B3663049B54615DA76F8651B30C2CF16788B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 956KB
SHA256 65a7caf67aa4537fb45655350dbe511c48f111405d3924fdb8ff8449288d0d83
MD5 030ad46cf30c4d90d936dad1ec87fc5d
SHA1 2bd10b38dc1c3252a8780c55305c03134a88db92
SHA512 b43eef763fd376e2491fcb326f2a87b670667c06214f8987642a1af53ca821b13545c72374568ef7263504f80dd4d34374c4feeeb4c8648d9efe5c860a31039d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCw66:J/sCv7rTiw2427h2bUqjt66
TLSH
T176254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 956KB
SHA256 2b5e424bac150394920fa54d5fecb9427348589f99f722b8c03e7654b739eba1
MD5 3ef3c9fc5c69c17a9b82c3b186be06cd
SHA1 5551606726eddff58064ff992833ccc50efc2406
SHA512 6a1564e41958e69add8f35ab02994b6e198afce578adbc79438dd6e17cc163ba895a16833432378cff88a7e264b6f26e409fb1433712d9820dcf4bf23763f702
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwyN:J/sCv7rTiw2427h2bUqjtyN
TLSH
T188254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 956KB
SHA256 85f5f74a6d657fcce7622fdc8f3a1299283bced6b49d9121f574e6bb67905751
MD5 ac9a72f69a83de16481692bf53e3c64e
SHA1 217eafee84e69010f04c20b78479bbea730c9230
SHA512 8731609229ac8567f72217622b4b891d8bac46c87c88dcabd542a5328586e686e9cb03454043a0f6655a27746d4c609b4dd2e85bc0524bd26c64fb181d258cb7
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwof:J/sCv7rTiw2427h2bUqjtof
TLSH
T16C254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 956KB
SHA256 a72f8dea77705152b4db8482baaa5e0013c768c4eb13264dd9e82b3bd9a37d9e
MD5 c4db1a2835698ed37520f9504c8c70ed
SHA1 ea33273be312d8752b9c89d3567829bcadf5ae2a
SHA512 8523c546ef4753539a9af501eea16a8af1f961887a31418fa822c4564048bfbeca9a542f9a0d2d9e78431812f28580c73048dee68b335f1cd9e047d17d122f35
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwCo:J/sCv7rTiw2427h2bUqjtCo
TLSH
T1A9254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 956KB
SHA256 f6885369283518ed34787bf5382a1ea25c287868e502851c1ee3fd9caa6edb93
MD5 041b436e4b50aca6fffd352a782fdab3
SHA1 79906a87224ad303625fee3e16106341c08a859f
SHA512 0f9202cb71b13a8d3881ba183e0272c353b079818ca48915045c9c933e2265416f0856357985461eb68e62db082abf628a522a501ff8894b5f9fe1e2ec731d2e
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCw2u:J/sCv7rTiw2427h2bUqjt2u
TLSH
T174254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 956KB
SHA256 3a909943d398630c0f7e0be6f0cf3a9fe042b69caa6bd865b9022f19956f9a58
MD5 ddc5ecae0e84525e054c529e653a9e6b
SHA1 3a0aedae2f9ea4c178dfd6d21c0a046772388418
SHA512 8084b455c039e1549cab34c5b835b320297ac48876a068d4b5e1bc9d3c5c63fa7d9322ed34c710d98f78362f2ae0414bb0e62d50c96b8a128528555e53051502
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwq9:J/sCv7rTiw2427h2bUqjtq9
TLSH
T180254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 956KB
SHA256 e09f79367ff54249bf06b4daab213c262d60238d98c2b942e9b37574b732ea50
MD5 c76d31c97b6597caf13afd7ccb20aea6
SHA1 87f6a74bb0ef2deaff0fab82600a51bc17b6b65c
SHA512 a34feb32ed528410f5f0a348fc7253469135303f5b3082de2a31906ac09ba99de83b94ed1f976cb31338a06191fb3ce0257d1ef771500d52aa1044682b3ef167
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwqc:J/sCv7rTiw2427h2bUqjtqc
TLSH
T1B1254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 956KB
SHA256 85b1c0c3c3cc19f1baf8db7f18859dff1264ceb0878407e26e42bf4509d97dcc
MD5 5ff6e846586ff5288be79c536ff7f4ae
SHA1 032fff0160eec9c90d52060c7fb01845743ae425
SHA512 80f9501a4a62cbcfed054d26f47eb0d8a397f213bd0e104ec0c0cd6c8a9c0598e39d272ccfa2eb50c81bd7b0bdb751135ce44a7a809ec8fc9c641bf735a9c52a
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwjp:J/sCv7rTiw2427h2bUqjtjp
TLSH
T185254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 956KB
SHA256 72331b5394c0a348e50846629771eaa6697c1f9413a1651eb2eebfcce663a6ff
MD5 fc3d2fb408e2216e344d673ec7c6ecb8
SHA1 bf7d86c64e1abde38214bba83369ea9dc430fd2b
SHA512 1e0ded57419197c6f623387017f97217bde5ae723d6255b24dac1b23e74330bac939c13b3b1656b873b0ede9d35214a15b337a11d9b43f057ebf2b160412de40
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwE0a:J/sCv7rTiw2427h2bUqjtEN
TLSH
T166254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 956KB
SHA256 dadc7493a65c74c617119253eb908237aeaa18287bc3c8f1939730f44a4e0bdc
MD5 8000f13dc88765109a361b1468f7c3d8
SHA1 2bc70bdf1b51d9da3142a9dae50953e44aea2a20
SHA512 e9bbae365749b7aea1d3b06c4db5e738355c1f908b0f59b016a5ea2ff60a2f73bdde3176b1b9c8229e60909807542107ef744f99758c70e93414109aa146ec07
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwsF:J/sCv7rTiw2427h2bUqjtsF
TLSH
T1E7254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 956KB
SHA256 1789e838c2b367460205a926a3d5021bcdcbc9b0a45aaadea4898d635058c76c
MD5 625c5ca9056ac79c260e891a1f125d47
SHA1 1b471b0c855933f6070aeace774e32008eb1d097
SHA512 4a0b40dd211051ccf46af363a039a3011e7f3000451ac07aacb2c47428309f7c1e575cbc2084ac92192e25f28451046d2864574d3323a251e95aee00b9bc818d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwZC:J/sCv7rTiw2427h2bUqjtZC
TLSH
T184254B136AE84861E5B3663049B54611DA76F8651B31C3CF167C8B2D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 956KB
SHA256 eb218051f826c7caffc1098c5daa73f78b182fd3665521b53301b83f96c639b5
MD5 0e45fc4e8f97a955b598c4802f61d9f6
SHA1 6e1a6e52c39be79d454c3cba901c37eeb73b81bc
SHA512 f82da6d857aab3d17717d56dfe9a25ecaef26d11d10be3b539dcdb3bcae521c49413420c60aa20544bb2fc48b15fab5ae2b58f1f9b94351832d66beb70188137
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwaw:J/sCv7rTiw2427h2bUqjtaw
TLSH
T1E4254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 956KB
SHA256 b7e3f60d238def771a5f98be1ee2ec7a32f52bd031764e73c6ad8d34e9ebb0df
MD5 743ee9f239196466c59c5fe55013ff6f
SHA1 b59be77fe933171356e7fbae221173001b7f0f98
SHA512 b9789d8bb5e73eac36604b14aac8e1c55b56aa70c1322d757e31ee4ce539b7429143b7105cdbf00a4999649893ee8a11cf9c1cd0ea430b171f76c0ba5ba4eca0
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwhT:J/sCv7rTiw2427h2bUqjthT
TLSH
T1EF254B136AE84861E5B3663049B54611DA76F8651B31C3CF167C8B2D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 956KB
SHA256 8bb0037dd26aadd77b0d7622c0f3f39cb7c3b407f871ac3f13d302cddf0cbe0f
MD5 6c39e101ee14e0ccfeb4c5fb14aacd47
SHA1 bd1392e7f5f056acac8d0d8eb162f3dd0977e963
SHA512 2e805875f46eb2206e9ba5236f2e2ee2f169517020fd22f51395ca05ff86f3cf357016e754df565342c7e5c887bb79dd20ba7985ef7e62e5e08d5d122c55bc5f
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwPu:J/sCv7rTiw2427h2bUqjtPu
TLSH
T1EF254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 956KB
SHA256 36a406902594d7fcdbeea0ec9ad464d539dbfa89a9daf26ee47f73e92a34ef44
MD5 6dd7f2fd0ad44ff3c8f63e54ab5211b9
SHA1 b4fc43a6347b8a4e76015438f611dc0f13c824ff
SHA512 ccab8a720985c13c950b3c0e35f255ab2746b2d76bebb567fcb5d877cd5b43e782e08cc81eb56ca003f081bf6ac09fe8b3f217f13058838570ea1a7595f66649
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwzb:J/sCv7rTiw2427h2bUqjtzb
TLSH
T103254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 956KB
SHA256 8ba7321ed1f118f901d5ee7dcec014585fac3df6860ef9a48fcc4056eb39adba
MD5 807471def4d84ecda04f55a6369b099e
SHA1 e484395ae608935829215572e905a795b33826c7
SHA512 af74876c7153c6104b26955b36b35624d1ea53a7fa2b68b03b430996f48cb240f76dd4d2e01a7195bdb3058e68c8a1ee4cb4d53874e98e21ca4c0a3e07676ffa
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwHf:J/sCv7rTiw2427h2bUqjtHf
TLSH
T148254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 956KB
SHA256 644a56ba024684fb8fa0468736a0a39436b77e15e573864d377674e20c13a53f
MD5 4c23960c06f83b41e70c11351e86743d
SHA1 998b1544dd5388724c2dbed931e807af2fcf0fbe
SHA512 bd3f2c937f86353d16768eb8b1b6c5aefefebf445ac5dba32c027ebfd8ad1def57097b356c0c56b20b739ac4296196b8b1b77f18e5e4ab711e146c026eaaf52d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwwK:J/sCv7rTiw2427h2bUqjtwK
TLSH
T1BA254B136AE84861E5B3663049B54611DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 956KB
SHA256 0481b579cc1b907b03cab02c5748b79b55be4150ee1ff4c732101d59d0c3feac
MD5 087256a1f786e9ce144ecd88b155d504
SHA1 5c790bc499790dd2d34a6c1056dd5447aff44297
SHA512 0dc79db6fead90a21981329f0a419bff449249187c79c13b8bad5807ec28ca2aac27f46c9c4b776cccb7ae938c91f594fb2cf178ab7c25d185d98c0451fb6f52
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwtk:J/sCv7rTiw2427h2bUqjttk
TLSH
T1E9254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 956KB
SHA256 4e6bb9c9c0b3f2b52a724ed0e5689548cc832b6501f498952c2a31337c3f2bb1
MD5 9a9c7c5bcfe205c49fe851f7363a9cc3
SHA1 1d629a0bb42725b65b6f17bee07f91bc57ffcc3a
SHA512 9424f1de3e3c7a88000bb61bd095d94d0ad0c7e7604e07014d878a25d2ddf8cfb4a011cf6650b708beaefef5b8f94c8135a37486fefc9b4bda738f5136bcaed3
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwy0:J/sCv7rTiw2427h2bUqjty0
TLSH
T10C254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 956KB
SHA256 ac89f60fc9077954e917f0a2a7bfe3a2ec48d0882caca3aae30d665c2a10d52d
MD5 e57e866c035519f5ccb4cab023d88a3f
SHA1 f0c7e3701d60ef6cf39fb2cbcb6a87a0187dfd32
SHA512 631481beae0ef6ce4e4d39d472889e55426abdd64392220f8a9a9558b53b689d34db53209db25c068f248281091734dd8a24fecd336ab76639b5fd4542862130
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwB70:J/sCv7rTiw2427h2bUqjtBg
TLSH
T1E7254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 956KB
SHA256 e4b4c615d7cc21ecbfc8bd7d9c7907b554636e22cde3d62f870c82732641f5f4
MD5 d81ae54d40832cb02400cefb0ec06299
SHA1 ef7122271385e02484f24654cbca28b0f27db1ab
SHA512 62f979a6dfb266a2abe0b5a3389b12e569ac3efa8eda1d41d9a7e6c1e233fe60ba613a7c894378c0f7f6c7671a6c15bb9f79dec537a64ffc57196f3f485187ec
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwor:J/sCv7rTiw2427h2bUqjtor
TLSH
T11A254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 956KB
SHA256 e920192c5cc2f8f1cf03cd6d4ca9179ff60ea57f8e3d526f07a33d7f796be1f8
MD5 81e353bcfd2548a9cdbe6cf7593d69b9
SHA1 198b08f23a6bd58b85b5424904dbcd97e8fb960a
SHA512 8386e73a97551402215e03e5ffec988c035527433ee34d7dcecb4ce554e9b174da5d3b26b29fbe0199217f568ca3ce4e64b6001276ace15f49b1b78b3ef4899c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwGn:J/sCv7rTiw2427h2bUqjtGn
TLSH
T127254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 956KB
SHA256 053376c29c0c0c1fa783043ae108af28e7268eb8e7ceeae4de84a6e4f6802ba3
MD5 540c453a506ff63304926b5fb90e99c2
SHA1 96fec9c69459fc9881d937420072ce0c940b1068
SHA512 ba5913bf857ffbb12424c100c5e7ea4d9ed1f8452a078a346823537cc12bca8d0abc5b5258cf9ff53204abb814c8ffd13c7562b5d14554636a431394cfb13e8d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwMx:J/sCv7rTiw2427h2bUqjtMx
TLSH
T147254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 956KB
SHA256 1146407b136bb7154e61f16a9b3dd3d488929298f10087af7a09374ea3562417
MD5 9840bdadcd45eec4656a57491454621d
SHA1 4fdc31d5bec6bdf0005e03c7255892380ca7c9ce
SHA512 ec8d1f276de04a6177c6945e3d1e8fb443122e5883e1cf72ba8a6d10c64b1a20f497343199ba1be756cdcba36d804d463e8a8c7b2cca7c2f3e6aa1611968a7e0
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwGA:J/sCv7rTiw2427h2bUqjtGA
TLSH
T1F6254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 956KB
SHA256 48027614de7e50582e6409f77f37e8d6dcc0da12974cd98a815da0b9ad4ee97a
MD5 99e92a7909c9ca797e2ea4fd95a5b80e
SHA1 7d143e430cb5a3a9b0f0c59a300bc51e0f528805
SHA512 e3d1bb28da184be2d36fc0e4b23125294130fca6c3c58ec23c370273f26a1b25f34e56bf6c1cd4a3139bd470f9042b40045bc44ef90c1ded370224259e993901
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwf9Q:J/sCv7rTiw2427h2bUqjtf9Q
TLSH
T16A254B136AE84861E5B3663049B54611DA76F8651B31C2CF167C8B2D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 956KB
SHA256 c08e91e053aa51c82e9d7b7b3df31002da40e85f0674080521c2127c17c4f49e
MD5 feda5a544380c6c12c046289a4396769
SHA1 57cb743ff4208979c569c874b6c317f871a5c595
SHA512 9ad27c99c6ab0439de6979c07ac6b0872e3318af0f6cf8c55b8b7700ea7cdf8fcd045b1ca844133f4357959fc644ed2886b267c635e56a05c97055e3dacb3b5e
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwW4:J/sCv7rTiw2427h2bUqjtW4
TLSH
T137254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 956KB
SHA256 9339496df56f6117abd2d5573c90735a3cced270863b583a3afae5431f02153d
MD5 2009fa7c379196a82166268e8f767258
SHA1 92fcd335dd3a31ae3168fa8f59144a436c7884b2
SHA512 baa25f60e01f5590b03531ad1f5620bfc8d8660a88fdbbbe9f14cd3ac5920a90061d572c71be94698f62b066fe82825d65274df830b1953b2fd5c6158a4f522c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwFu:J/sCv7rTiw2427h2bUqjtFu
TLSH
T112254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 956KB
SHA256 30d8b95a15b0b92b0c291cb62e12b1a6ecbf9c6ea27caea0987a4d029548d488
MD5 eb65a7b9382c2a1cd21260f16bb03406
SHA1 be14d8723af62649fc7aecbda17b2747abf1240d
SHA512 e74b7fc0a3976933512ef52233884b5210d41c9d234e3acdc6a8acb6f35ec14a82635fa0068453833dabea54092cec1d95ce152964ff3a485f579319902c412b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwYj:J/sCv7rTiw2427h2bUqjtYj
TLSH
T168254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 956KB
SHA256 a9934161135dda5ad901c74370c3b4512fa1e1e52510507e0d17e1e785f9f396
MD5 171d8364be84e317aa56a3eaeb50816a
SHA1 d9c503e589694c75094f76d1ff87b9282846487e
SHA512 d96077ddafd33d8f62deb709d382a1da05775418e112bea5cfceaa304228fc465ada1f397bfe6ee69f884099310037fd367cdd5597aaca521e9afab2ad79f3ce
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwpg:J/sCv7rTiw2427h2bUqjtpg
TLSH
T1A4254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 956KB
SHA256 df694b82aaa90567fd8d621335ada6e186017b87f6b0604adbd9f4f2192c8799
MD5 e45d43b1f5f161f43378a5a775568b50
SHA1 532e53f6d27e1f51cd2e161dcad3c92d2c75a0f4
SHA512 afc8941f1bdc25aaeb53f6ac176c862fdd789c70d8031ed06f5cc3788f73d89e5118b99d705577bb2dfdf80031d586e51b8b1d76705a7753de93cbec2c50fae4
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwwI:J/sCv7rTiw2427h2bUqjtwI
TLSH
T1E2254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 956KB
SHA256 0002a8a64d610954793a8978379e4813572285013558a7f7f14a6fc0fdef2211
MD5 fbedfe0996416cde7fad04b3b42dc794
SHA1 1689ffd155243299463da2d53fad7d83891795ea
SHA512 88e926124293fc7d48aef1aca7c5577ef1cdaca037707cb0fd7e417ef080f041866a0be9538b635f18621323f8490f4a84f06f9f1b7bfeb87a64a45a41a2ccf4
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwyo:J/sCv7rTiw2427h2bUqjtyo
TLSH
T1DC254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 956KB
SHA256 8d7e0634ef6185c02359c7e8ded9681de1591007602af0d14fc189e48400ed82
MD5 d4915486e0ed00100c709c579069aedb
SHA1 65eb18f95bf2c3d4595120c4a48e66ea9df50f77
SHA512 23b548a5b15eae03503379efb92ec28c67c5338b4e399c6a0cee0d0a11eca257304b8718877e1c44f21da91cc09b45abccd3b85a10ebb89fbfe9eaf5f2c18c1d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwp+:J/sCv7rTiw2427h2bUqjtp+
TLSH
T157254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 956KB
SHA256 59cff8479fd073ff0f74c82fd4c8666c86985e88bd300bdbf61759e591ff05b6
MD5 947fb141c00a1d4923c98b97ead11c88
SHA1 8a5846a80d295c70cc9914604d45d9bab1122fab
SHA512 1dc6416f96ee32009896e9b0d646bb82b66590457a2d5520525b05fabfd734e2695213258e42d8573045a6a0192c1006d93a8971a57844e0605d59c56dc63cb3
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwXQ:J/sCv7rTiw2427h2bUqjtXQ
TLSH
T172254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 956KB
SHA256 4471e4ca598e89fdd20ed1b2a526f3ffcd75e89e987964ff4080147ed5bdb600
MD5 66e549cd633579c9a60d487635ea7101
SHA1 23a532f375c78d9875ecf0ea5e45113fd18dac98
SHA512 3e791f6df1ba3319f329c6d45c5570a4ea14401ad801ab3f981e91243d17339e36e134e887ac79a8034f866f03f41f7a34fa83d7beaaf0f72bcab08c38095502
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwsX:J/sCv7rTiw2427h2bUqjtsX
TLSH
T1DC254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 956KB
SHA256 29b78d64b208b98a148581810ed06934e4026e8ba0953bf0b0a8f726e8e43c09
MD5 2f3fe266c9ee2a648c218c918b5741cf
SHA1 701cf6214c38576ed02b1b03d8a887e3490b28ac
SHA512 8ee8cc10925ab279ddd2dbfe0f32b9e280b0d09e216a028838fe9d8a61c8537de124b90c9de174fe5f1832bc7f9905ba5c22a499bba9ac8a99b17882d2464a5b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwKL:J/sCv7rTiw2427h2bUqjtKL
TLSH
T1FA254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 956KB
SHA256 01ea655750a2bc7466dc54e27a80c2f49d70a9dcdf30756444dd941234fa8b55
MD5 8f49e785e915538913889fc2c95fdcd4
SHA1 53553fa559120bbf709e403e3ff869d4b5719adb
SHA512 fe3d7d24ff15efc3ba3c9e7cb7cdccd9233354e6e0a6cca7304c07cfec35c5c1173e4a8d1b996a1a037ae233738f58928edaa41d1b2bbea2bf1c7cfc8be1ae2d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCwuFC:J/sCv7rTiw2427h2bUqjtuM
TLSH
T1AF254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 956KB
SHA256 a642fe8d6288b0312ded058adc97da0acb045f8208170f4ff92b20fba5132402
MD5 b5fd27112c7ee7efa9109e123a51405c
SHA1 76c465276eb05d741bfc5064286d151a3192f907
SHA512 a6ecf8897160e3a81b65fa893e45008287db0b7453a84c33a8a88e0f74fcb352e2a8dc0a3e102f233d917c0da16122471d7eb5614dc9e39e035332356ddf5a9c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/+7obE91zhTdfu7bU+DkKCw3h:J/sCv7rTiw2427h2bUqjt3h
TLSH
T1EF254B136AE84861E5B3663049B54615DA76F8651B30C2CF167C8B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-2034-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4964-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4964-2015-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads