e7db83a587c8672cdf72389ba68af71955c0d5599bc4d4edd31553e9c8c53806

Analysis

max time kernel
95s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
Size 792KB
Sample260826-wgh2naee95
SHA256 e7db83a587c8672cdf72389ba68af71955c0d5599bc4d4edd31553e9c8c53806
MD5 8dccfca73ae1adb5beb172d40cfaf074
SHA1 bbf001b935c2521af7bdb8c5edd3143fe85238cb
SHA512 d8278e908c203fa9568a360e6981d6b699aaf0d62410d837518b84f393245a6427b8f3494466467e30724e69299ecb0f0c8cc72f9aba4f74b812ff5a799bb02b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41c:J/sCv7rTiw24DIVCec
TLSH
T11F05181767EC4865E5A3613089B54605EA72F8561B31C3CF12B88B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c523-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-701.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1039.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1163.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1317.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2932-2047-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4736-2066-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
4736	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\InitializeRestart.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
4736	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_8dccfca73ae1adb5beb172d40cfaf074_cobalt-strike_conti_elex_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2932

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 792KB
SHA256 e7db83a587c8672cdf72389ba68af71955c0d5599bc4d4edd31553e9c8c53806
MD5 8dccfca73ae1adb5beb172d40cfaf074
SHA1 bbf001b935c2521af7bdb8c5edd3143fe85238cb
SHA512 d8278e908c203fa9568a360e6981d6b699aaf0d62410d837518b84f393245a6427b8f3494466467e30724e69299ecb0f0c8cc72f9aba4f74b812ff5a799bb02b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41c:J/sCv7rTiw24DIVCec
TLSH
T11F05181767EC4865E5A3613089B54605EA72F8561B31C3CF12B88B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 223fe25219261d2f8e32c8d51df526c1e85daf12c2caddd4a3ed75c2c79ec9d1
MD5 bfb3a7c896ffab9c99c16a15c279ffe5
SHA1 557f9d7c2dc2bbe8f285f4dd17e52343f1821f0b
SHA512 5b6f7a5cce625046332fcc16f26bd95e389f2857927c2add88379e0a0acce9e6b2136568448bff45228611368b2c28d01a1933c37fbe464e69613246b9a8bdd8
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41kXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:J/sCv7rTiw24DIVCek0Le5ji0hmxNrM
TLSH
T1DA554A17B6F84661E073D174C5E6964AEA72B4461B30C6CF12A9C73C2E23BF1A939731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 806KB
SHA256 5d41c9139ec5771b94b548a5bacd2e070f146c97c89fb3485b29c8b5e5a8ab96
MD5 ea9e5ce8aa7b26ee3e0e66beb7b0ed49
SHA1 c6fa1605c1b57f0f3d34f678cbe645df7e54790e
SHA512 e88713a22756391359477a5a6c130a782ddafbe489ef451a9af2e2893d1c7655b360a6041ece5e8ce40f769f8fa3ee09c6673c0e26b923763baae050d544d1c2
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Oa:J/sCv7rTiw24DIVCeOa
TLSH
T1F205191767EC4865E5A3613089B54605EA72F8561B31C3CF12788B2D1E73BF1BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 815KB
SHA256 b83f22d4c802a9fd313a36bf73c54d4f3cb6b4753d99f62aa76af97493bcc2e8
MD5 24f8c106778f2fc55dac2f00ab9ba709
SHA1 886f07df20ecc46fbd1da069327fd1e308b0056b
SHA512 f4048a2bc3e1390177ae5a65f5f89cd8f9f08aa2967997d89e050124b1c993b2040fbf53ac36a88433f360dd8c0271e0fb8327511668595610370406cbfc87d3
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41v6:J/sCv7rTiw24DIVCev6
TLSH
T18C05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 815KB
SHA256 66b7b52ae313ef2a81c93b9015f1caf03ac569db717882de47990e1c6b0ab614
MD5 21350e4ed9d01c5f9be00aa8167e134e
SHA1 3d3deabee4bef81cb1de5d79484b9d650775595a
SHA512 3a61ee8c9c71201591e61b309a9b8120df29b4f17f1b30bd2e62e6c76d0e71b70348b10db98850f94a2460aba0e0d0410cf7ea7acee684afe2d7a5f834853c23
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41xN:J/sCv7rTiw24DIVCexN
TLSH
T11905191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 815KB
SHA256 240036f17e76eb7c88dc074499e9508772f4325384449c99f26bbc5cf2c3c3e2
MD5 df7662c3b9a10072aed5599f0e6d60d0
SHA1 63bcd0728172667a425b23a89a395e91b064cdc7
SHA512 2113b065871b21ffb9d6f2b1c08272eaedb7ff1a1a4ceab8dfb6f6f55905ba762726d5d0c8eab606a24f045c3b2e653091789a03335e33fadfc7cb4b1b3d44ec
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41nf:J/sCv7rTiw24DIVCenf
TLSH
T18705191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 953KB
SHA256 64eb4cfc3a62f15a2b528c8c221a5a77812bf4b387f53bc952d35fc17b13bf00
MD5 ef3095f1724f8970102677ab693cfeb9
SHA1 a0cc9c155d0eb92342e4dd8c46d2df8076e90882
SHA512 c240783fb8ecdc71c71d410b500e9b13bbcea8456ad3a8d1461b311299209c4b26bbb75760664ee72237c91ed3ee53ccc23c917c47d17bbff89ed9deaacf113d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41DyPz5L87:J/sCv7rTiw24DIVCeuzy7
TLSH
T1A825291767E804A5E5A3623489B54601EB72F8661B3187CF12788B3D1E73BF07D39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 815KB
SHA256 cfd7ba1c09820297fa7fabc34718e0c507194d0257734519e3580748c3091ace
MD5 ea6734cf9f4c107f138e4d8212bed20b
SHA1 d0f42f67065f45c3cd332ce7581ad6fd6ef19ba1
SHA512 dee1bfc942a6cae966012615f899ef8444b868655b2b1d6328f4cab38a72f03eacb2b0c3df3844cfb05282f4e0cd7123a64ce1e114232042399dd49bdb98544d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41po:J/sCv7rTiw24DIVCepo
TLSH
T11605191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 815KB
SHA256 80dacd0b154a2ff47de4602d29090ec55779043a7afb9353cc0817d143e72308
MD5 ba69280bf5b6f94620898779bcc4468e
SHA1 578b292388a37e956ded5f276639920d077336a1
SHA512 1b5c642045ed06f3f4b17c04e899cae7ac464764ae8af3becab3565a9d8ac337cee24344abaca3d21b04905d676bb0fe443792671342e44b74da1461943ef812
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Zu:J/sCv7rTiw24DIVCeZu
TLSH
T17C05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 953KB
SHA256 5118fefbb06bdd1c7bb7b220a9898b785047de6badd709b75982b8288d1f52c0
MD5 76ad6c03db55ac10d4513f46ecf3ece1
SHA1 4ae51c0dc283f738fb6f405b8ebab6bf40e7711c
SHA512 a056c7c82bfe56853858e7dd19c9a187175202f1345b14547250a19f507489758662ae5a7563a5d965ba5542daaeb7c3b9837cc72232c50dbd49dc277e77edbd
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI412yPz5L88:J/sCv7rTiw24DIVCeLzy8
TLSH
T11625291767E804A5E5A3623489B54601EB72F8661B3187CF12788B3D1E73BF07D39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 815KB
SHA256 101930f642b4b3ca67e64086128f24ba432b6d0b24b6f5f68c3982504d6f380b
MD5 b4786c0f47f76079d83268f1ac2d26fb
SHA1 d58523fe885d96bdae1f840c3c2f89fc6cd6a1e7
SHA512 441953dee19f648e4f23482cd4e4072ad648ef877a30ca40292b5e888b8b227eda47f00b504252b21b9d169af6fde431ba58e14d70e2126b5dd65809bbffa9e0
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41/9:J/sCv7rTiw24DIVCe/9
TLSH
T10405191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 815KB
SHA256 0a12938cbd070a8127e7b95fa93c4528e01d64387c8b0e58e5e46b9553072fda
MD5 c996f37250e3f40e6cc18f34c42f740b
SHA1 af890d946cb357f58218505136a096b828436747
SHA512 d9a8c0bde8b2f4d79dec08b99f693dde32609028132168178700c01fd5f2af6949f9ceb7733ea97d7e5e72cdfd77b9dd81c003b5068d3ee44eb329317e062b3c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41bc:J/sCv7rTiw24DIVCebc
TLSH
T1A105191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 815KB
SHA256 f63df2f37774b994c7cf4a44f5f336fdb55894adbc52daf756a99f3b67fdafda
MD5 ab9c2cfc152f5b42e3917e9ceb91ab3f
SHA1 5addab0492bf5cddbeeffdfd1ecd65f503b8833f
SHA512 6ced7c421f8faaa49d30fcf36a14c6395b5422f4131cd3ab7b4012ee675714124a9aac4b93f695d776c71b32e87c9a110fe740b67e745a3b1d94f629a7c58454
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Ep:J/sCv7rTiw24DIVCeEp
TLSH
T1C405191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 815KB
SHA256 a07643ee21f9b30bcd7bc1d0969c789aa8a757a5c3a06060e12880f0ccb23a1f
MD5 d6bbc44071eefaa1bf0c978bc5b11129
SHA1 2ca6fd1eca2b268b8c0c7af7451474ed2bbc7a76
SHA512 27c4d309ddec9daa8ad955d3dcc1afc81a8029d53656a58a698ecc56ed43c5acfb156c3e8b4c9f1f0ec476a1ed9cf2983c232380d8af036e9e8d8adc0a0b1c48
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41L0a:J/sCv7rTiw24DIVCeLN
TLSH
T15F05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 815KB
SHA256 8c28fe0438339d4f251753ad3de541bb3cef0f506d50b780991126891091883b
MD5 b61d035edc3c245ecdfbf522b3d922a6
SHA1 ad139f449d861e1af3b7bbfe4b3ddf46d0a16867
SHA512 b0b059c568fccfe706fba762c4203c315cc61adea1db1d2baff91116a410c50e6afd8c6c19a41053b9f8b633d23d14f59a78e27bdf148bd21fbbfabc02ca8d48
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41ZF:J/sCv7rTiw24DIVCeZF
TLSH
T17705191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 815KB
SHA256 993da89ef8c67dddfb7fdb8c73814f11c54dfc6d175b9cfce468fda4c87bdcdd
MD5 ce2b9b337c698776ad6197d04e55d38b
SHA1 63224a6f42d99662c248142d13b638898b669f30
SHA512 36f1554e84e3208e674e753a59ae79124bac0bd7932223fa50d2cbf2c9422612a4a57a003ceec3b5cca43490506c6652c0b6ee7e8483f511c507e884913712b4
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41yC:J/sCv7rTiw24DIVCeyC
TLSH
T1DC05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 815KB
SHA256 3396dd37d1d50e6505828fcb360f0a10af68c8446390d6506f634621b075208e
MD5 3e774ba9cbdb8676fa5b86317ffaea5a
SHA1 595466ab364df7da10bfc53f7ab4b3e1f92f17e8
SHA512 b9e0af2ddc03116664f78d499d7ae12bbf20cf580e6c378eafc36588fb348781c6a0af526e14705479228bd3e20ebaf0b32409be979318df3c0c6c815f5cff11
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41tw:J/sCv7rTiw24DIVCetw
TLSH
T1FE05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 815KB
SHA256 e09970cede4f97eefa85e6a7ecd4c002de9c786b4b9fd7475a9b6ed10b3338c1
MD5 824ad81ac5db35bc43123e36cbe0012b
SHA1 f6c26959094247f79d3a062b9c03efce3b64b2c7
SHA512 80e5fcf44b5a84791e92ae44126e226574e919ccbb068f69a856f86589b69a01f4bd8144f2d13a8b74cbbfe8ef1b4ea2901f1b2eea3c0cbf4e2761501ceedcc1
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41cT:J/sCv7rTiw24DIVCecT
TLSH
T11305191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 815KB
SHA256 a197fe8975ab9c9d1f84b5ae88baa2e429d766d8ceb4eccf5759d0636780d44d
MD5 3eff9d4ebcbdf25d003ddc83c8333f5c
SHA1 580dabec2a7cd065111601d507d48bc9ff362e3f
SHA512 9e929172deefbdc422071aba079e3dc4ccc0bfcbb2ecd73c3c35c841e04b2c0e56e53cd107ebb85a79acbd77ed4d075cbfb988e24f4b9b21fdac80ff6a586a61
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41wu:J/sCv7rTiw24DIVCewu
TLSH
T17405181767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 815KB
SHA256 6e09193e912db5e0fae6d291e2cfdf20a1a1b08e5b28ab309cffff5482575e53
MD5 d1e55fb660b98c4b5f2b36dd9a0fd812
SHA1 3ce27a779f29ccd59e3b40bb3663f2085bd20562
SHA512 6878a733f56c888f06772ef6375c13288fc24b2cb4a14ec506085b94ad9811d8a66e4eb72bedde8c3c7e2e889c3364e8bd00a9a94cc17293139b6fc7a6f9f340
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Ob:J/sCv7rTiw24DIVCeOb
TLSH
T1E005191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 815KB
SHA256 fe1a8864b1818f9ab2d3aac87f6872ff9f8e63948c0eca9b79b9b8a102f48dd6
MD5 f58496ddf6d88fa2e5a82ab1117cb26e
SHA1 3c866f83a5233d885a9d79702104ef103ba5b003
SHA512 f69c99840723b6445f70f7599ed0b13a7bba9c1752f30d89b75f4b20e24bb8461a22e7a729c445f056a5afa66f095cc92e157a71038a7bf11942dedbe3f5d316
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI414f:J/sCv7rTiw24DIVCe4f
TLSH
T14D05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 815KB
SHA256 4c628b25dafba7218782b5aee674c4859e1d75416e13e6d711ac79a0211d3e3d
MD5 dbad311aa58f575e5bcc722d8e4f6ca0
SHA1 e9418a2da51ddc265637037a48fbe80385f0853b
SHA512 a1e8066762386b045835606e2b1cd1672e0e7b0b0e454d5c12c54dd9c2a59ce1d7c68c73eae513013650781deb6222e9e3a2149d1ab97f4319bc16a0ca5256b0
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI411K:J/sCv7rTiw24DIVCe1K
TLSH
T13F05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 815KB
SHA256 7d26adf479df23eb964e38b34e7be6ea81e17186167b16e4b213afdf11208e6d
MD5 6ddb2ae9e3187b9fdf6b58416062011b
SHA1 1e8afa01d3370340a96a05f23218b9480328f553
SHA512 a3c9d96072b571e91f81299689f7e2cabb0e8d49dd9217f26ed7c54eee177ea6c2ccb0bc82fb63a6f6c7256889b97e45f3ed5e338d846c782b0e0add8056d87f
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI412k:J/sCv7rTiw24DIVCe2k
TLSH
T1B205191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 815KB
SHA256 693fe9a8dee1c06200d49db3c8269ffd4ed43e5fc114be0c69460b9f12fb4280
MD5 f6efaa5eabce776820424f4e6d59a7b5
SHA1 cb30c2505063271ab717daee10a8c321a1c4abb6
SHA512 e689a9a8a7c0a5ee3c5674901e4e05d1d7e6de19a6b8fe809a7767bca5127cbb55452329b1abc6251b2f48dc3cf039fa9481b24ebf209c9f269306edfd54e0e1
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41T0:J/sCv7rTiw24DIVCeT0
TLSH
T1AD05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 815KB
SHA256 be5deab71adb62596b33f94a998a1a5bbef2b75465ff10355e02e22fb6270a0a
MD5 6edab3e21244fa2c8a896f64b7e7728b
SHA1 58ac789fc20fa5b903008063cabfa3204bdb791e
SHA512 aea3b055bc5d1ec2083c7eba7701db21082fc6066f4a2fdb721a76e3611b7a3712e8acc82b8036a1da20e869bf964ed4ee94abf6f84721cc6c79e5ac525c476e
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41i70:J/sCv7rTiw24DIVCeig
TLSH
T18F05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 815KB
SHA256 d8dedae6d029fff228dd5bda0971221b94d4d9e3ef705afce3e0aa65df993d06
MD5 66a69f9ef94406453e9de270645020a8
SHA1 ac74dc94198eff816b22d27f3a3857cc62974ffd
SHA512 4501272c7b751bf656bc89a36c5238756910bca3035f8a03391c69478aa5921583f4622f5f392d147785e070958346c4da6579bc83857bdb30e64da61ce03573
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Dr:J/sCv7rTiw24DIVCeDr
TLSH
T1A405191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 815KB
SHA256 4b2848f999a125dff9e1e4c04d38e519ade702c2ccbdcfa9a446576e3bb7f85a
MD5 33c1c23a488057b3762a57e3f318ff18
SHA1 2d1f31a3a451b6f13873085b8dae6b258863563b
SHA512 db9047f44a0ebc5755f658c82f797cca1c2dc99d4ada9b026ed29fb7272e5afee859135c8a7a0606d358e711250bb1ee250c0c657ed31d8893114ef8eed74151
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41ln:J/sCv7rTiw24DIVCeln
TLSH
T10A05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 815KB
SHA256 375cfbd6edbdfced7ea06a603aed3a2b3a840ebc7a9aafaddc4057c48d85b8db
MD5 f36ad2f7ffb0cd0dff1e7d593f0a8b2b
SHA1 f4a762af621956e6e9b66c96cdbbcb83ea7e593e
SHA512 67019b4cec48272dde5542389e29cd2601dfb0b3a1d59d8470fbcc01203c07363aeb7ec6098c18ee35a893e2a1f668e7360d6a02db841d6f4e42243ebc61ee4f
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Rx:J/sCv7rTiw24DIVCeRx
TLSH
T1FF05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 815KB
SHA256 b06dd3b306b2b851beafb6352edfe2bb3b1831fe11a2c66b86fff001091286a8
MD5 dca771bd3b9930fcc1f08c0509a11568
SHA1 5c3db84115856fe55e88503dc7d3fa4a6caad5f1
SHA512 92f7882da5550e7f54ce4ba7e1ce6881099205491e017e59ed6cc9a356820c1a3cffae254014369ed8a52f35fd3b5b932e47427494a8b4e6d13f01d89d322590
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41/A:J/sCv7rTiw24DIVCe/A
TLSH
T14F05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 815KB
SHA256 70ad674e288b48274cbe5fd49cf505fe34a75347404ee8e962a2d7679f5bb99d
MD5 c2fbdaf38549d34aea2d9e4d2df579cb
SHA1 7c4d3f0a8c926668548753b75583cdc94778930f
SHA512 5fe11f0006200bbcb2e707d52ce38d566af8ad4f5ac62e90a4a50b8055fca96091d0b6889cc5b0c4c9a9aa029d09dfb5958660b1cdc5f1831205fc6034a471bc
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Q9Q:J/sCv7rTiw24DIVCeQ9Q
TLSH
T18A05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 815KB
SHA256 e01e48bfe68f4b07af7be4398626fe0bcae2abb07f39b41820f6ffeaa8017d22
MD5 e58c724caacc47a7c785437dfebaec65
SHA1 b6d229b8a04ab0b78e46088a9eb94a867c3b89d6
SHA512 a27d43d4016bfe0388bba3eae35953822140fbe8ad979af209c78b2e3d77021fcfa1b1e357108b0d63007cc664c1e6ac72165e3c8ee0905a2fe73fa1e79bc09f
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41x4:J/sCv7rTiw24DIVCex4
TLSH
T10C05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 815KB
SHA256 fc533e25a5152de3817b171474f99ada0302bf6b56371668b5ea84ab0ab672a5
MD5 ee75bece77b175e139cebc25452c1a31
SHA1 408d91b0fe23c2400604815307ea9583abd32f7c
SHA512 fec038d1cc6f3ad4039940c6e5821a99985f954882e7522b6e31034b90500e7f9958b0aeac7ba2f6542d27c1151c70e4a6c670d93a1f0478eaf3d9f890271a46
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI410u:J/sCv7rTiw24DIVCe0u
TLSH
T17C05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 815KB
SHA256 05c458dd75604398676399c1dfce1095561fe6c0718ffd7992992a5bd089ca31
MD5 fec3882b467bdb4292b691b2a21b2291
SHA1 abf45dedada689e8f7e7ada883d92e3924db979e
SHA512 68906044db87126c92e419cf24e1480d151802f1cdfe2717895f2b2b0b7148608e263c50a79e3532342bb52dff079f2cfb99457d9a4daf5664e75fb1fe86356a
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Fj:J/sCv7rTiw24DIVCeFj
TLSH
T1D205191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 815KB
SHA256 6ec1e1ce6de3f18bab67c535b4011a6ef2ba75136a3bc3a3780773d4491fe1a3
MD5 f6469166c410d0e427f367e5affc40d3
SHA1 f2a3c48ecfd11912ce60ff7adb459b1eebb08a50
SHA512 9824db45c57c875f087b0308d5cd93252ea4cfed8057cbefec0c42b306c4c467ccd43f1216471a1664cda625e3ac7e0c82414cf2ce3c5e426f9dcf630c45dbfd
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Mg:J/sCv7rTiw24DIVCeMg
TLSH
T1DD05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 815KB
SHA256 8b867ff1578d4a805ad7289d9b7dea7a8886d195d2d949286cf3dd4f32f16230
MD5 6e58762f000bca255d22ff61e3916bf0
SHA1 af2be25cadf46bb31163e88693663f4d99ac40de
SHA512 c70078994b9ac11c79a8b5042419f5b430fb225c094dc7b99f638f3617f6f77fc2f122bdfbb7d7bd8d16c34cd0692015e02e236c3143b09d960e75f0ecb1fd15
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41TI:J/sCv7rTiw24DIVCeTI
TLSH
T1D705191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 815KB
SHA256 ab988e2435439cff356f296d66015334b796ad176a530753e2e558d57c58324e
MD5 895bc0b26265c3978ee536b1ee488514
SHA1 77a7c2ade00a6185fd3667ef6c02972dcc15850c
SHA512 39978d43b0afbad4a55f105fd9b41e8e2ac704890fe10a750099ced21b1541403751b493d9e9de1f800b3abf57bceace4aa592229939a1555fe633020404f7a3
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41po:J/sCv7rTiw24DIVCepo
TLSH
T10005191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 815KB
SHA256 236f13e67f99c975c97241216e750e49e2576cecef0c942db425cfb533a42d22
MD5 f0ce7defaeb08e01e1d662b5544b35eb
SHA1 5ad2d5f23b9faaa1c52310181dbd2001c5fe6136
SHA512 195106a9dcb05286796a1a055ee91b695180a34e67c372f5455e0966b47ad598c94b15d6598dec7b904fa4ed1fae84ed309df228984a2ccf99c67230fae35dd1
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41a+:J/sCv7rTiw24DIVCea+
TLSH
T18305191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 815KB
SHA256 a8d578415693dd807e6748dce97c2fbc2b21e539ff80441b2e486847671e3eb4
MD5 11785fa788f5215d73d03c428a3c8aa8
SHA1 ac05d0e22eb03337879d91cad023d453aa25baac
SHA512 f0bb6e290b57898d5965577e16bffd75becaa4174aedcc55ada73bfda06a6e7e9d2073177ec4ef410e4930267207e8b13afe250fe0af7c3cbde5da470eb8699b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41aQ:J/sCv7rTiw24DIVCeaQ
TLSH
T1EB05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 815KB
SHA256 273cdf5d89bd7f2cfc3eab3e80773786130ea2790e87e59146e345c37feaf247
MD5 f2c06eac78a09564124b45217520a951
SHA1 91eae3467ff6319b1f8727e91639d219c70f844e
SHA512 700517bb8f90aa0f51a6718743ab7fdd5c06eb51ef8d2fd464ff0b815c053d973c2c5877ea74b537859014ab72217ff5594a661d01f609ff69b879971e83dd96
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41rX:J/sCv7rTiw24DIVCerX
TLSH
T1C005191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 815KB
SHA256 d0f3a4c07d6813cb874d444f7d63f0613750c834ceac3f0bdb18b60af599eb42
MD5 65f86a63b2d126ff408a0b281872026a
SHA1 fe756f718cb6cebfc05f4da618155aa322d8ca0e
SHA512 a25a424d56aee60ce552eb3325e236ff6356e4202e37ae90f2491060051eebb04f6b4689e5bf0b91f43b216690bfb8dcb3ed6da97d8ce43c1cb7f7f4db85484c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI415L:J/sCv7rTiw24DIVCe5L
TLSH
T1CA05191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 815KB
SHA256 08d92926b79b427f3b6aca5459b8141314165deef930f644a108ec90148d98dc
MD5 fed60106f68f7633065504cf61d5719c
SHA1 847b2062575494e49bd386297b3fd3aa0e52b46b
SHA512 9c08aee8b31f78a963d8ea3e26a5d49b9204d1bf9ac5f62cb52f252de9d9436b1008667afebb0a060006b59a224e86fb9f219e959fce6e6d51b4a906c785182d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41nFC:J/sCv7rTiw24DIVCenM
TLSH
T11005181767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 815KB
SHA256 0a035184a3304df1324c703ebe1dab21a9b200a3ae54ed74535e27257fb6c07e
MD5 a9e2f11193161c4b402d51d488d1da7c
SHA1 4a4423a7b7fc0aef3ac02caa5147879f57165951
SHA512 682aa30034491fcc8d6232a55dc11648e8747a49a0db22432e35b7622671af15a16df3fbc7a4c0f6bc1fddcd498cd2b45aede48df27017956143dbbee71b4740
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7fAVxI41Qh:J/sCv7rTiw24DIVCeQh
TLSH
T14105191767EC4865E5A3623089B54605EA72F8561B31C3CF12788B2D1E73BF17D38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2932-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2932-2047-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4736-2066-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads